{ "Event": { "published": true, "date": "2022-03-16", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2022-03-16", "timestamp": 1647475381, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "7b74ba22-9111-45d6-afe0-c000b86db535", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e603544e-a4f5-11ec-9275-42010a9c0029", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1647413657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647413657, "uuid": "803fa06b-1bee-48ae-9c3c-396fbca1b2b5", "comment": "Malware payload (AveMariaRAT)", "value": "534f2a442034a8bc495ba12f1cb1ece8", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647413657, "uuid": "69422bac-d5ca-4111-a157-5092b33efbda", "comment": "Malware payload (AveMariaRAT)", "value": "00130a7cbb5c32a73a1a07b6720034a2089dabf2c1085eb4a0c19d247bb25ddb", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647413657, "uuid": "5ad749a6-eebd-44c2-a550-7be7031c1c89", "comment": "Malware payload (AveMariaRAT)", "value": "cf6a7bdd8d5b1da72db763c357ae49f7572c13ea", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647413657, "uuid": "6a0fab34-bdec-4561-85bb-4d1148d5a445", "comment": "Malware payload (AveMariaRAT)", "value": "8eb9f397533088889e6cb6341f6f39845402817317dd540057d2d8e3403d0782fe422b9735456459eda53dc9185d0e2d", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647413657, "uuid": "abfba226-266a-4548-9b15-83ae1b621412", "value": "T17B0512283394DA12C7EE793ADFA0C13407B2FC69A562D24A14D13DEB35FF35605503AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647413657, "uuid": "6d892bc8-b7d6-4766-ae96-89834bb01911", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647413657, "uuid": "ff8cb07e-8acb-4ac0-934d-aec6174aa007", "value": "12288:kX6wOEJfA/Fx95M5QAJGHSjsveWhhZOV95jd71rNM60Ap9Gp:w6wOgf4JHeUhZud5JnhG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647413657, "uuid": "e8a6d2f2-1b86-40bb-9011-8905b6516c05", "value": 865280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647413657, "uuid": "450cf5b4-057f-400b-9842-8f6f5a8579b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647413657, "uuid": "09f49b8a-e5ad-4706-b24b-404430fb9144", "value": "Arrival Notice(BL# NGOB33562507) VesselVoyage GREEN WAVE 0020S.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86664b1b-a530-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647438837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647438837, "uuid": "16c517d4-2d2c-4df8-9791-1359ebf76112", "comment": "Malware payload (AgentTesla)", "value": "531b60eda6d632a6085b6ab6a912935f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647438837, "uuid": "89c43193-ba4f-4e2e-afd7-c9a22af0c567", "comment": "Malware payload (AgentTesla)", "value": "003ea1a6f6f13e5ee4c894259b48bad8e70f308f4720ce2a706525c92d38b1ac", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647438837, "uuid": "af640148-6450-44c6-a795-37c2bbd8c2c4", "comment": "Malware payload (AgentTesla)", "value": "74cb6d1612b2388119f48795508699c2f32d2d0f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647438837, "uuid": "fb15089b-fc17-4239-bdce-894271ada677", "comment": "Malware payload (AgentTesla)", "value": "7925b321a86f0f2dee587fd09eac2f7870cb9a0031c008e1260286d5104f7c3278f53fb7fad29af7bda338259220edad", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647438837, "uuid": "bdb6d454-369c-42d8-93a0-a3699611e922", "value": "T1B023081A688A6629C5D97BFD58B2A18366727CF10624C28FDCF97F19A833723CCC511D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647438837, "uuid": "80487f07-79d6-4ee3-93c0-3f5e97bfac0c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647438837, "uuid": "36343a0f-b121-41ff-8f6f-1df59f1b0aaf", "value": "384:Mc5L5vuYYZ0/3p9v1XFAqxU77bg3t0QXulaiAMwCKFH2S3dd0hUADkac2v:MmlvZg43p9v7S/5xlmMwCK/3deVDe0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647438837, "uuid": "4028d219-87e9-4144-b1e8-dd5615943ec9", "value": 49664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647438837, "uuid": "d92503ee-375f-42ce-86de-1c051bd7ad54", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647438837, "uuid": "0de5aaa4-0507-4536-a06c-1f73d7671b24", "value": "90856210.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa2bfaab-a50d-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647423864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647423864, "uuid": "d4ebc291-74b8-4c15-806f-aafd5b1e4295", "comment": "Malware payload (Heodo)", "value": "b16cf2233857b50f445cb1a090d78173", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647423864, "uuid": "0205aa1b-fb58-4964-a4ac-e165b2ff0c26", "comment": "Malware payload (Heodo)", "value": "004674e393b07560871c5a44a38f770744cf559bd167bd74bb9b83f8c2440e17", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647423864, "uuid": "2cb5ee3f-05ee-42ab-a837-1d711667d649", "comment": "Malware payload (Heodo)", "value": "2e198df6dfe26eb6055e2f57ab61c9f7c3fc580c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647423864, "uuid": "3a30a4da-4b1c-45c2-a828-2d4558adad97", "comment": "Malware payload (Heodo)", "value": "0a3d6148662ac84024bbd6f3708df0f02dbc68b898a96a0ddd71e439c39a556e179a55628dfdf3cc3ff7e8a1a5739bba", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647423864, "uuid": "c8197450-5045-4727-adc3-6658e89c695b", "value": "T131E47C12F461B2B9D04B04741F1723A86EEF5E518629CA13AFA8ED5E1F31251FC3FA16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647423864, "uuid": "372bb534-adaf-4b74-992d-1eed8018cd47", "value": "066d4e2c6288c042d958ddc93cfa07f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647423864, "uuid": "77eea7be-2a87-4f09-b450-62ee26ef1653", "value": "12288:DtAanana8Meee0GBGu3qI+3DNJ3vE6v5ewxS332d7t5hT/hexLx:Kanana8qGBGuoNxESxCM7o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647423864, "uuid": "4f39474d-9829-4150-b695-ac547070c980", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647423864, "uuid": "34d7abda-78d0-41bd-8ca3-7841c52ceddd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647423864, "uuid": "3d9217a0-95e5-4831-b60c-16932502b15e", "value": "b16cf2233857b50f445cb1a090d78173", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c363f41a-a4e3-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1647405868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647405868, "uuid": "ff0b3c1b-ea6d-4505-89ff-67cbb758dfc7", "comment": "Malware payload (Loki)", "value": "02dd41ae5a97eafa7a7250e64abacb08", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647405868, "uuid": "bb9488a8-e2b6-4b42-a4ef-df26c81702f4", "comment": "Malware payload (Loki)", "value": "0070689bd4d52fe73254dc4d1f507adfebc49bc302ecec500c47fe89811da603", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647405868, "uuid": "0dfd9e18-c4b7-4c19-a93a-b1c907ab5679", "comment": "Malware payload (Loki)", "value": "80f0bd201537d92f470ef76d2e8b8372a07cc945", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647405868, "uuid": "e8e54a9e-acd8-43e0-a4fe-fb3e29f92280", "comment": "Malware payload (Loki)", "value": "6af2670a8ae8879731a2dac13fc02a746a633cea3ef413f2c057b69c3afe05754fb0a816e568843530941e8dafeb9c43", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647405868, "uuid": "e7df0722-269a-45de-b72d-d8a4b37c255e", "value": "T1C6E4122833C48FA2C7BF8F37E97452015BB6F122B432D74E5E9469EE1A9BB140910397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647405868, "uuid": "fbc157ff-23a4-47dc-8ece-06b669a88360", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647405868, "uuid": "e4180f6d-f89e-4baf-8852-c41903955fd8", "value": "12288:5C3NwOEEpe2Nb1zhqL0++TRhR7ZG4utq1UcVhzBY0hXEnVTyEc9b:QNwOBpe2NbVYL0++ZtGa1vVxXEVPcR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647405868, "uuid": "e8dd2876-b6f1-4b4b-8bd3-fa3731c541f9", "value": 699392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647405868, "uuid": "c60d50c2-cc8a-419c-9605-f60291bb3f71", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647405868, "uuid": "dcd0238a-fc79-4130-b8ad-b06b459b21ce", "value": "lobo.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f42e697b-a508-11ec-9275-42010a9c0029", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1647421841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647421841, "uuid": "9524c4db-97f6-4bf7-970c-e2fa37cdcaf5", "comment": "Malware payload (RaccoonStealer)", "value": "3fdbc531d132ec0b5e02efc6c11aa27a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647421841, "uuid": "6b10185b-de15-42de-bb8e-0c47d76ac0f4", "comment": "Malware payload (RaccoonStealer)", "value": "00f6bff1ff217479f31a0f7e95079e836d5db24e06dfeb10eb907019e80d52a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647421841, "uuid": "dd52766c-11a2-480f-ab65-fc73858801fb", "comment": "Malware payload (RaccoonStealer)", "value": "83d939fcfb1072a53e0a991a071d06d3d9b2a19c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647421841, "uuid": "be06183c-cd40-4ead-a117-b8537183362a", "comment": "Malware payload (RaccoonStealer)", "value": "241615e7a1d8753ea70b2482fe49bdbbdcdd4a6c4f42b8a97cfce1d710d19a1c6361090c5d29c0ce0cd3c417ecebe27f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647421841, "uuid": "eacf045c-db7a-4fc6-b298-691ea2712e4d", "value": "T171B412127610D573C45B31747C8AC9B06E3BB6313B71CA077A88177A2F716937A3A36A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647421841, "uuid": "f4a1c2e5-58ba-46d9-8ac3-4e1b290f65ab", "value": "6f7f7795d0111d5087004eeee90a01d8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647421841, "uuid": "f3ef1511-c8b1-458f-9c91-be3f46555343", "value": "6144:daEDkyRl5Hz8BOR9N+ZsFhCbEHW8pcACcdEcdCDBju5IhUEJ8LISNPTbZXB4cgTA:kOk4z4ORWsFYiE8ssRESRNz45", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647421841, "uuid": "d454b940-00c7-423c-a826-a74d79b88a40", "value": 536064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647421841, "uuid": "78c1d4a9-a66c-40b2-99b6-778ae61beb6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647421841, "uuid": "a84c43d9-a9f9-4907-aa44-e62bec2abe28", "value": "3fdbc531d132ec0b5e02efc6c11aa27a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71840e6c-a4ff-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1647417756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417756, "uuid": "026e3fdf-9bf4-4565-ad83-1a838c9fbfb2", "comment": "Malware payload (Loki)", "value": "4594a12ab2ff1b7886b7d855fea49343", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417756, "uuid": "a641c6e3-eb65-4563-8086-c9bfa3fbf9ca", "comment": "Malware payload (Loki)", "value": "01555b012d513726b2f1a5eaf17c453f9b2e9fa0d4df5b45d293e779243a13d0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417756, "uuid": "3feda0a9-966b-4b5d-bd84-5ec2d3fb4794", "comment": "Malware payload (Loki)", "value": "0fb229eab0cbab6b56cfde11921cd8a6d825fc30", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417756, "uuid": "73e2912d-a344-4a90-8f66-5b84865a0225", "comment": "Malware payload (Loki)", "value": "729a461440ea0a93c419bd06db3c598da6e45c9f4284c188aec9666becb48ad385c24cc578055aefe146bafec33658b4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417756, "uuid": "6ced9a8f-ff5f-459e-878a-48093e69527e", "value": "T12D54121358C57963E2421EF51633A7F5EF36999702B2188367647F2FBF918228D42B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417756, "uuid": "bc0c3ed8-a004-43e4-9ca9-750b728c6afa", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417756, "uuid": "5afd3c25-2a38-4457-b914-b63637ab08bc", "value": "6144:rGitcm4q6py86hbwm78Y1s4vHhLA88q7l/kQpa/bWIX:pJ4T6xRx1s4vHpN37hnphIX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647417756, "uuid": "7131907d-1fa1-4af5-acef-b6fe620272eb", "value": 302589, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647417756, "uuid": "658b8018-c162-4c6b-b7ea-f077c013fd7d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417756, "uuid": "828cf648-6927-484b-9a04-83ba7a703be4", "value": "4594a12ab2ff1b7886b7d855fea49343", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b5781ba-a56b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647464212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647464212, "uuid": "b4dc9276-0c9b-4232-9e0a-7b65b2d0a711", "comment": "Malware payload (Heodo)", "value": "6e8a74c8153a57cdd2fdb30a04d054f2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647464212, "uuid": "362918b4-3373-46be-ab20-b1216294759e", "comment": "Malware payload (Heodo)", "value": "01a461e7a392cdd5816391ce7a992785b213017812884e51cec01198a7bc235b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647464212, "uuid": "9c6eaf13-9204-46e4-a770-f2e476a70892", "comment": "Malware payload (Heodo)", "value": "c3b90cda01517d1cfd56069ec9af339dc2fefe87", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647464212, "uuid": "45a01227-24f3-4e01-8a7c-0c731d59d556", "comment": "Malware payload (Heodo)", "value": "5429fc8fd782ae90d6ab2516a8efd4c3a442b42f18ba523b475578ba1d3fce6f71e29f304e10b75531d642399a210524", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647464212, "uuid": "abe628e2-55ae-40d6-a166-a644f0c2dc20", "value": "T105F4DF1176E1C076C1BF12304956A38D23FAFD509FB986976FD02A6E3EB41828E34767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647464212, "uuid": "93b23987-7ea8-4e5a-bf12-bceaf5743506", "value": "66a21a1bcb4077b3ed89c00ee693486b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647464212, "uuid": "7ad5764b-f28b-4457-9524-06c1035e01f0", "value": "12288:g6O4TpP0XjxCCFJuf07j+Xk7hJ8rLneTfABCJoWRWwfpW:BeCCF88j+Xo8OTYA7pW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647464212, "uuid": "ed2f0f62-a0a1-4bb9-8d2f-6ce883ddf35d", "value": 749568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647464212, "uuid": "83fb9ecf-4c92-4338-8dc1-b1d357b46d87", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647464212, "uuid": "a48c80cf-e333-40ea-a7ec-2e54d59deaef", "value": "6e8a74c8153a57cdd2fdb30a04d054f2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e70c89e8-a548-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647449307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647449307, "uuid": "06187de5-f6ad-42b6-abe0-843ebc432ffe", "comment": "Malware payload (Heodo)", "value": "c29d53f2d7d020434d9b2551dac8daf1", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647449307, "uuid": "9e2a0b26-afbd-44bc-bece-98983eb4c838", "comment": "Malware payload (Heodo)", "value": "01af5b1157b1dc63828e2989e9b283406935e5a097aaff8605a0a28acac90a97", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647449307, "uuid": "6e81ae15-b7b3-485e-8bd9-65cc2ce3693d", "comment": "Malware payload (Heodo)", "value": "5dfe324c9e4603f937b970ee0e10aa879db9bc82", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647449307, "uuid": "05b3965b-718f-4f56-af79-d7c96b8fd4f0", "comment": "Malware payload (Heodo)", "value": "fe19ac78bb4d80b02d9b272fdf3d666b34e2c3dc51aa8c1e89760ad3c193cf0f7772ba08e9cb693a0bf96262341541b6", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647449307, "uuid": "dd176876-64b5-4365-8d97-28d4e66fc32a", "value": "T185F4CF11B2D1C076C1BF06741916A35D63F6FD608BB9878B6FD02FAE3EB45828A34356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647449307, "uuid": "f10254a3-0361-492d-9120-43b47f7a7edd", "value": "66a21a1bcb4077b3ed89c00ee693486b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647449307, "uuid": "bcad9a68-76c3-455d-bd17-ddfa99d64f1f", "value": "12288:WZjb8BOPxue5dKV9M/98f0koPcXvkgKtuBdfMAofD:WCBAdKV9Xf0kX3KMBdkAofD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647449307, "uuid": "95f29681-d36e-40e5-b78e-bd53ad0aa7d0", "value": 753664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647449307, "uuid": "367e760a-6a4a-4407-90b6-022132f3fb87", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647449307, "uuid": "b9e0c317-6118-47bf-95b1-6023949b4e10", "value": "emotet_exe_e4_01af5b1157b1dc63828e2989e9b283406935e5a097aaff8605a0a28acac90a97_2022-03-16__164822.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "744fd9c0-a4ff-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647417761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417761, "uuid": "03227d0b-697d-4050-95e6-7408fea008e0", "comment": "Malware payload (Mirai)", "value": "bfb30707badfc99a690d80a9e4867f7e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417761, "uuid": "55573dd3-1813-4653-9405-3c359c001c22", "comment": "Malware payload (Mirai)", "value": "0264d735302eea6683c6d23fb85492dae329b843f95815cb8765a158f14d2aa2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417761, "uuid": "432c2b37-18a8-4901-9124-646f6d9e8896", "comment": "Malware payload (Mirai)", "value": "f1616680c7393b095d606eabcfb26242b9c4fbf7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417761, "uuid": "87234bea-8e0b-4241-bc15-a1c608ec7e07", "comment": "Malware payload (Mirai)", "value": "142e9a6f30fdd07f9ffbfde7c08514b7c778cfa2ad6ad1a741be3a71e261090255caf34e3c18d1b9fab4a7ae88041aa9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417761, "uuid": "e5ac9209-4a23-4680-bc2b-5349b9711e84", "value": "T1ADE2E07456490E08DB8D7BB2191D8FC2B3B60F80AFF8E6B371879F55A625713C409E92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417761, "uuid": "c13d9c65-e89a-462d-a0d3-39f7e34622a6", "value": "768:NCwf9IF1oUTWt8MaEv6Caq3OCz8TCq54uVcqgw0RKWXw:Ewf9ILo+ASC/zAL54u+qgw0UWXw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647417761, "uuid": "86fc30e8-d46d-4049-ac02-56843a163c41", "value": 33684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647417761, "uuid": "93a6750e-27f1-41e7-860f-bceb09d89827", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417761, "uuid": "ac442cb6-1c8a-4e97-92bf-f9cd90adfc23", "value": "bfb30707badfc99a690d80a9e4867f7e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e14c583-a532-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647439628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647439628, "uuid": "775ccc23-6b4a-4dfd-b4a8-22cecdbd1b22", "comment": "Malware payload (Mirai)", "value": "043977fd3674b1b01e6eb33f9c9ea3a5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647439628, "uuid": "d4b11acc-9015-4594-a434-b7fc51aac804", "comment": "Malware payload (Mirai)", "value": "02814338c6e2d5bd1c1f729c7b03451df5e19023a96fc7acf7052174e17457b7", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647439628, "uuid": "33af26a2-933d-4782-8e87-c75f5113402c", "comment": "Malware payload (Mirai)", "value": "44ec35ace07b2a49ecec2bb9f5b93274cfe2119b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647439628, "uuid": "224cb246-f0d3-4b1c-8940-83fed47062a1", "comment": "Malware payload (Mirai)", "value": "a81700a2c09e8acf521e132ebb0323fec1b031fb7842233bcd22b0aba21abe6e337ed1c1eac0827b030c180e7fea81a0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647439628, "uuid": "a7182a0c-2387-410f-9dbf-957eb3d9e29e", "value": "T167034B81FD8A4B49F1F04172EE3B6314E22BCEE0D1CAEB2791589240D9532795FE7719", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647439628, "uuid": "8b03f742-f036-4065-adc8-d5ebb2e836c9", "value": "768:oPS7FLUruL5guRmPtBMnvNYNlUZyGAZNSnYnE1Q:oqhUSL5guRGfllUAjHS11Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647439628, "uuid": "e92e24b0-d5fe-46f5-8060-83d30956c0ce", "value": 39440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647439628, "uuid": "c3b8da77-30e2-4b9a-926a-3d2a282d69e8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647439628, "uuid": "9855f3ee-57af-4e9b-b299-1f138756c9c2", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f69657ea-a568-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647463077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647463077, "uuid": "8b55ed11-b80d-4445-bfc6-922dbaa6e413", "comment": "Malware payload (Heodo)", "value": "d738f15ee8a96e6538ca386a960b80a0", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647463077, "uuid": "5ac4866b-0bb1-432e-b3ef-44b2cbe6b3f4", "comment": "Malware payload (Heodo)", "value": "0289c32258ab98311e9e2a40e90bb49b93779f725f68c460f7069438f6328e51", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647463077, "uuid": "5e1ad4c2-b2b8-47fb-8ecc-2a0b335b67dd", "comment": "Malware payload (Heodo)", "value": "3d1d56b9f0651bf00afab6417582d476ad416eca", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647463077, "uuid": "febdb256-1e37-46e5-a1e2-681e11410f83", "comment": "Malware payload (Heodo)", "value": "e7a1b217fcc7b76f10a839554958d5d55ac37d6d3b576b51b903355b6096ca9ce69835181908b16d38dc376effc6e17e", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647463077, "uuid": "000c62f0-f2f5-4cb0-a70d-1e1e3ac4a5f3", "value": "T19DE2C02DB370EB1DC21EEC3944A995DA825A74268106EB4E6C6CFB0D2F456C2730F1DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647463077, "uuid": "07432982-f0f1-4e94-af09-e685f94f945e", "value": "768:cjFH4QqFhN+DizXT2RdFfPdkqstJkjE6oB:2S7TkgXendkqJE62", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647463077, "uuid": "e6a450df-1fda-4118-b2e9-428202620221", "value": 33758, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647463077, "uuid": "7e4c8285-8576-4db1-a613-c6346c18bded", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647463077, "uuid": "3c6f6767-344d-4bc3-aec1-6d2a7eb82495", "value": "documento-16032022.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d5ee6b7-a4bc-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647389054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647389054, "uuid": "241fcf0b-6637-4caa-818d-6ab9bbc9c562", "comment": "Malware payload (Heodo)", "value": "2601146a6117271990287ee57d7001f6", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647389054, "uuid": "21ae2017-d292-48f0-8110-b1cb6d6db458", "comment": "Malware payload (Heodo)", "value": "02a19967e4d31415b42f914299d662ac5c737b814de73eb1904078ab77d06205", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647389054, "uuid": "55d32b6a-f5d4-497b-b9c7-8762bc295854", "comment": "Malware payload (Heodo)", "value": "c9e62ff015ed4a58994c60054eda9cafbf6b7f4e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647389054, "uuid": "a3edf293-d391-4c14-8293-ee11d94b4e16", "comment": "Malware payload (Heodo)", "value": "a1eeb2c182f90d71296d4b2eca02502184ea48d1b2576c2b77797323e0c510aaaa2a74f729a69667fe88a249669c4fd3", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647389054, "uuid": "33211885-6d75-4290-83b0-ffbc38681bd5", "value": "T18DE46B0124A29C71C3E7C9756BD91E1539EAEA92CFF7800BBAE06B7CD874942C337516", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647389054, "uuid": "e454f748-fcec-45ca-b8c2-14f80e8f7770", "value": "a38617efee413c2d5919637769ddb6a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647389054, "uuid": "ce2cfd9f-12d4-41f7-b6b8-dbc196b6cbce", "value": "12288:KFxGsTPy4BHT4Sj1zfbf7ABqDLkWynCsZ:obPy44Y1Hf7VDLkNnh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647389054, "uuid": "80e16215-ce53-4322-b107-b732e56c7dd7", "value": 704512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647389054, "uuid": "b00fcb7d-821f-40a7-84f7-29a8f2285d4e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647389054, "uuid": "cd37ea0b-0faf-453e-adc9-8d9f3fe599af", "value": "emotet_exe_e4_02a19967e4d31415b42f914299d662ac5c737b814de73eb1904078ab77d06205_2022-03-16__000408.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b85966d0-a53b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647443645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647443645, "uuid": "eed83486-517c-44e7-8782-35bf866b7920", "comment": "Malware payload (Heodo)", "value": "15e54530c2f9e5c27552b18e6a492d9f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647443645, "uuid": "34234a3d-d3cf-4a2c-b593-530f215af13c", "comment": "Malware payload (Heodo)", "value": "02d1d737cc64bd91e0cd907b81ba62e4d858912d7389a4b67fadf6caa9b2a6c9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647443645, "uuid": "1abf3f40-6b8b-4a94-ae08-259cde9be3dc", "comment": "Malware payload (Heodo)", "value": "9f7ff3276e88580a4d6277cd573c20fe8d489245", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647443645, "uuid": "053c2979-731d-45ae-9481-c50a3ceb06ee", "comment": "Malware payload (Heodo)", "value": "30812578b6fbbb7b8ea4c789fb730029f27ba190047f8652bc85743d1a6a8d03a26ca25f16261aa232bb7e224be09f5a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647443645, "uuid": "d9bfbb69-bebc-434e-aa79-998d0f41fee6", "value": "T125E45B06AF22A1F0C06B03B40555125AC2EF7ED0A72ED657825DFB7EDD339977A30226", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647443645, "uuid": "1a33950b-e807-47f9-b476-36a4d2537a41", "value": "066d4e2c6288c042d958ddc93cfa07f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647443645, "uuid": "0cb90d77-f0bf-4414-b8e2-2232eaab2364", "value": "12288:jc899XKPmN4WMkoH6ZPJSFTdtXlcIL9v6O8:7GP78gFTdFL9v6F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647443645, "uuid": "1add52c2-2f87-4355-996e-c49ad8037eb9", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647443645, "uuid": "94446f26-f5aa-4a64-9247-7cf507ed661d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647443645, "uuid": "454c8a86-980d-4bf6-8ec0-97145d1e1c51", "value": "15e54530c2f9e5c27552b18e6a492d9f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbe7b734-a568-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647463086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647463086, "uuid": "ed9e3ae1-a703-4748-9d02-b0c3c24a8a0f", "comment": "Malware payload (Heodo)", "value": "13625a9abc909d2c7019665cd68b8d0a", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647463086, "uuid": "f86b8231-bac8-49d2-8909-44f2b119882f", "comment": "Malware payload (Heodo)", "value": "02fa715a98862076beed07e4bb0369dd6692c58175713c3af2a8206dd35db9ec", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647463086, "uuid": "d8d7262c-55c7-43ae-b430-69759a5ad812", "comment": "Malware payload (Heodo)", "value": "21fcb8258fa1bc0539f6bc41f25e485d884bfe91", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647463086, "uuid": "1675d339-505b-45b9-85b4-391e40f6dcae", "comment": "Malware payload (Heodo)", "value": "db165e69272307854290e1cfcdd67644d1378a4921837dd1a90d5eb7eced3fa28dec5fa9a407ea2a344c7aa45dfe541d", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647463086, "uuid": "15611e74-f490-4357-a240-e39325e57f15", "value": "T122A29E1DD4216849E37B643CD20A50EE918F1D166243B49D7494BB6CAF337A7038FAEE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647463086, "uuid": "e99088e1-68bf-4d03-826e-46d111f2a634", "value": "384:rPmxuAi/Nj7z3S8EibbwB37gSYrLb5CzgObff9kC+xbXy/8y6jk:rqsN3z3zXa2FCBn9kC+xbi0y1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647463086, "uuid": "4aa0d8b4-4d1f-41b2-91ae-816e4a1c9673", "value": 22810, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647463086, "uuid": "c542b71d-224e-460f-9e2f-d0dd9370fdb1", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647463086, "uuid": "9f8d3618-3b70-484a-a601-47a844f06356", "value": "mensaje_1603.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74243cda-a510-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647425062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647425062, "uuid": "5c15f020-5f70-48d1-a7a6-6573824cc051", "comment": "Malware payload (Heodo)", "value": "dde66e773ac4ef2d2e52982e89ac0f0a", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647425062, "uuid": "0022320d-1692-43d8-8382-c06837d36977", "comment": "Malware payload (Heodo)", "value": "03388a6497a25612b13bb11bef62d9674072067826c05a2bf8de87f6607ced92", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647425062, "uuid": "1ec2a138-eca8-4f7e-809a-c6292d849250", "comment": "Malware payload (Heodo)", "value": "d28afc04eb96023f60ce5df3da21514577893b79", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647425062, "uuid": "35742ceb-858a-4b2c-b77d-b339911c7578", "comment": "Malware payload (Heodo)", "value": "e9c9de8805bd66abd81e6846f58ec101ee06b0894361b01a56655e60d8c55bab6ac663989e3b0979ef3655d02c978b4d", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647425062, "uuid": "4b38c1a0-4c3d-43b9-8172-f5407bbbe464", "value": "T123E2C02DF3A0EB1DC219D939446981DA420A74258506EB8FB95CFB1D1F4A6C2770F09E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647425062, "uuid": "4410914d-10dd-41f0-89b0-216fea384ded", "value": "384:wjxzKpZPFhNjHEBOA7iEibbwBLg0SCdiVZKgUrNU/qWhZOdBNPJM+kqr9eCgh0kB:wj1uFhNClizXT2tdFfPdkqstJOE6K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647425062, "uuid": "2229bfb9-ef3b-401b-b285-f486aa9cfb6b", "value": 33745, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647425062, "uuid": "5f9328a2-5ddc-4bf3-944a-46880b7104cc", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647425062, "uuid": "2ed817ca-73d4-4a64-bffc-24bd21caaa0d", "value": "Liste_76627867.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d90d18a-a572-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647467088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647467088, "uuid": "f49fb76a-c124-4ae1-b770-4745c1e8940b", "comment": "Malware payload (Heodo)", "value": "56b89bdaf94f50b3af2521762c99bc05", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647467088, "uuid": "d9e46293-0b33-4bfd-b3ca-4967f3a70212", "comment": "Malware payload (Heodo)", "value": "03ae4894dbceb45af6a5a112c66d837e6b8814a37a6b73bc36eb6e09a97f9151", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647467088, "uuid": "3db81e77-5130-4837-adef-bb37731a19db", "comment": "Malware payload (Heodo)", "value": "b42143d6a635a5f607712b8a54ffe23113637633", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647467088, "uuid": "75d899cd-bbe5-466c-87e0-a0009ec69949", "comment": "Malware payload (Heodo)", "value": "2f5d07d6f7c5cc9f44bde351df2de6c2dbed03042301aa4c2ae08d5f5bca6c59faa61fdc3370bd26dbf088678bdd3737", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647467088, "uuid": "8554cb20-aeba-4245-a512-3c96d6528b7c", "value": "T13BF4DF1176E1C076C1BF12304956A38D23FAFD509FB986976FD02A6E3EB41828E34767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647467088, "uuid": "069cd993-33e4-49ad-b300-c995352941d5", "value": "66a21a1bcb4077b3ed89c00ee693486b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647467088, "uuid": "4ea6755f-c8a4-40e5-9296-62a7c7644e4b", "value": "12288:g6O4TpP0XjxCCFJuf07j+Xk7hC8rLneTfABCJoWRWwfpW:BeCCF88j+XX8OTYA7pW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647467088, "uuid": "4f681d9f-409e-4bc0-9a6b-d4c80089c194", "value": 749568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647467088, "uuid": "9a571991-eaf7-4caa-8322-f763e6dd7321", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647467088, "uuid": "11582bcb-85a7-473d-a673-d2e93d9305bd", "value": "56b89bdaf94f50b3af2521762c99bc05", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d29c169-a4bc-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647389053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647389053, "uuid": "1980346b-8eb9-46ec-a13d-bdb7bed7cf7d", "comment": "Malware payload (Heodo)", "value": "a6b9658e4fcea48cde166369c0310a11", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647389053, "uuid": "b86c669c-2084-4ef0-b386-8431ffc52231", "comment": "Malware payload (Heodo)", "value": "03d1a90e471079374627b073b9f07aec92c3dc90480eed3a031dda9623454240", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647389053, "uuid": "69e73d6f-a10e-4db9-95d4-af537e4dfc22", "comment": "Malware payload (Heodo)", "value": "cde70bad57454a5065ad4f2d00ec522c5ae798c8", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647389053, "uuid": "4693a917-339c-4de0-bdd6-63fab229237a", "comment": "Malware payload (Heodo)", "value": "b8a21c9aed0b630b2f6db0254513e06ade9368840e0c20c4ba7a3bfd424ca9c0a82e2c723022c633039d517e74b2e958", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647389053, "uuid": "1030fae9-415a-4345-b812-cf1add5e1672", "value": "T1FDE46B0124A29C71C3E7C9756BD91E1539EAEA92CFF7800BBAE06B7CD874942C337516", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647389053, "uuid": "ce5659e0-45d8-47e8-a82f-c656e5352544", "value": "a38617efee413c2d5919637769ddb6a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647389053, "uuid": "b13355b1-52f1-4fe2-a62c-81f6f9fc1dc2", "value": "12288:KFxGsTPy4BHT4Sj1zfBf7ABqDLkWynCsZ:obPy44Y1Ff7VDLkNnh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647389053, "uuid": "c5262ae7-cdcc-4119-9ba3-00a6afb6ef6e", "value": 704512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647389053, "uuid": "85e82ac4-2d86-43ff-96a1-95142ff810b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647389053, "uuid": "49188a44-c057-4f50-9de9-e54608e4f993", "value": "emotet_exe_e4_03d1a90e471079374627b073b9f07aec92c3dc90480eed3a031dda9623454240_2022-03-16__000408.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f4dde6a-a4d6-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647400170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647400170, "uuid": "99909838-12c5-4151-9c7d-34126b93a949", "comment": "Malware payload (Mirai)", "value": "00185655d9439f59f62b2c3c3fe3cdb6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647400170, "uuid": "39c733d7-5705-4578-bfdf-ca64c6d81519", "comment": "Malware payload (Mirai)", "value": "040f038abb21ba1ec0aeab1cb093d858c9edfa7947fa998934a1e5d1036dd1a0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647400170, "uuid": "36f28af7-b615-4272-b946-c2fcb8d1678c", "comment": "Malware payload (Mirai)", "value": "8b81db9ba51c22e79eeaa5b5e0f5fa3cb74b42d3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647400170, "uuid": "ff72379a-4b83-4e33-a02c-25810a787c81", "comment": "Malware payload (Mirai)", "value": "95bed4b73359af408f05967ab19b1c1345352404081ee7213fb0caa0251a25d0aad26cdc8131869dbcfd56fb89977f1d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647400170, "uuid": "a8415a6e-dba6-43f7-863c-dea8415b5fbf", "value": "T154539E72D82A9D14C0850134A4A4CE345F23F2C883667EF77AE146B6544BEACFA0DFE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647400170, "uuid": "d089a0cd-1ddd-4129-bbc9-aa10e5c873ce", "value": "1536:grVY+slN+DSfUI+xKnlApwZNy7CqZJa10:gq+slEX+KpwZNy7V4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647400170, "uuid": "43df6e11-4859-4b60-bbc3-00232d563713", "value": 63760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647400170, "uuid": "e4015106-e074-490d-84c7-de988a817612", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647400170, "uuid": "7d648906-0d37-4c88-a9d3-1a1c90499f8e", "value": "00185655d9439f59f62b2c3c3fe3cdb6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33abac88-a54f-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647452012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647452012, "uuid": "6359dbbe-3510-471a-9501-b002fb5055cd", "comment": "Malware payload (Heodo)", "value": "0a4a2dd94d25336e93e5419e13222411", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647452012, "uuid": "34b908e9-ca83-45d7-a1bd-46a2bf2224e2", "comment": "Malware payload (Heodo)", "value": "0465345dd3a9450d52e7f1f41bde2e93a91fdb312de2971a90c724104ecba408", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647452012, "uuid": "505488dd-ad1b-4f72-8e4c-8bf2973c0337", "comment": "Malware payload (Heodo)", "value": "016553aa83074a70962dad26e5271c61a505d0bb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647452012, "uuid": "1954e21b-b004-43cc-b0a6-483aa6800b16", "comment": "Malware payload (Heodo)", "value": "4e903f2aa8afe705ba4e56fa8df901ca530910d46125250dd26067f3c3987d8fe6acf60694ed43318ce08e1b5fdadf19", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647452012, "uuid": "d04a8be5-010c-4ebe-92f0-5e8291a4bb00", "value": "T192F4CF11B2D1C076C1BF06741916A35D63F6FD608BB9878B6FD02FAE3EB45828A34356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647452012, "uuid": "48a03d09-ec7d-4e72-b465-33dd81d5406b", "value": "66a21a1bcb4077b3ed89c00ee693486b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647452012, "uuid": "51df09e0-5cde-496e-8429-0c5885a9b87d", "value": "12288:WZjb8BOPxue5dKV9M/98f0koPJXvkgKtuBdfMAofD:WCBAdKV9Xf0km3KMBdkAofD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647452012, "uuid": "616a4985-ef23-4c2b-867c-0406b76d1cb9", "value": 753664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647452012, "uuid": "5610b1f9-5b3c-413d-847e-ea8e8e673095", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647452012, "uuid": "4137b9db-c23a-45e4-80e9-79857fece838", "value": "0a4a2dd94d25336e93e5419e13222411", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f956448-a4fb-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647416089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416089, "uuid": "1e3bd488-7a12-4f16-af6a-c78a4e170d6f", "comment": "Malware payload (Formbook)", "value": "5215f5c19b3fbffeac64c226b7ac2e02", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416089, "uuid": "2e560074-9e44-4505-8695-a3cac10266e6", "comment": "Malware payload (Formbook)", "value": "0482134079f147f5535027b2a9e3b0f0c5c841d8d1f38d59ff3e3fdc89f18b7d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416089, "uuid": "cf128852-874f-4bba-a2d2-0feaf7b27142", "comment": "Malware payload (Formbook)", "value": "f045adb78beb685a1db6623c1037e562238b9bec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416089, "uuid": "61520bf4-3a13-4c94-b92b-a58e0910cbe8", "comment": "Malware payload (Formbook)", "value": "c14fffd7209c9fb1f0f3b2daa13c5c53f0aadb92c39c90b573a3316fc461dea9a95394b6feaf687c925016fd010129cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416089, "uuid": "7b7126c0-c7ae-478a-86a1-8d7d73741aee", "value": "T179F4120533D49B23DAFFAF36F870A0111BB1EA667276E74A9FC455EE5BA2B500410393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416089, "uuid": "129ccffb-aba3-4de3-adc2-8755e68efe63", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416089, "uuid": "30a58e12-2cc8-4559-a6be-aede77f2bc4a", "value": "12288:+TRwOEuydZzn6FZMX/zs4JRzTivk0lz7ez9G5LM6m3cF76CKK2tywg7GO13VAOfh:CRwOMdZzhrs4JRXivdz7eU5ScFuEwghv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647416089, "uuid": "0aa0c874-2e76-4357-8e34-84f2d07d4ac3", "value": 769536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647416089, "uuid": "2397f142-2feb-44d8-9542-19b925695840", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416089, "uuid": "efacf6d3-1db9-4279-ba04-829b429507a6", "value": "iBs00DQCkazvXvC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "930e4fe1-a4fb-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647416095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416095, "uuid": "749efe6b-9ccb-45d6-a1e6-efe23c6fd64c", "comment": "Malware payload (Formbook)", "value": "af197b5bcc62d64ed682bfb692b95324", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416095, "uuid": "4411d4f0-99b8-4014-a0fe-c9e3b0ba6bd9", "comment": "Malware payload (Formbook)", "value": "0505e2e270d348f002fbde872676a6d126e14f1eba4ddec833ec5f8a456a050c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416095, "uuid": "1a5252bc-5a32-4438-b09e-ace315d25aaf", "comment": "Malware payload (Formbook)", "value": "0e4611ccb5821caf57bfa320c5040b5b614f58a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416095, "uuid": "f4b6d226-aef1-4029-a900-cd0ce0d26830", "comment": "Malware payload (Formbook)", "value": "fae8b46af6db6809cf0e9f83f960d9d5a76053ce6ad4064219b17fa6d405ab3bd3083e7a294eb58762e0081f0374ee5f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416095, "uuid": "a94fe543-0fb9-44da-b4c6-38d9ec60b9d9", "value": "T1CE159DE3FA5C837EDD206236E0B804700EA55F4B2410BF59B5CD98DE0667ACF19961EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416095, "uuid": "213fd240-6dfc-4af4-acfa-4ac0dd49a246", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416095, "uuid": "64f12801-7140-4ff3-be3f-15e49c798bde", "value": "24576:tq1MxxujO8oq0fvNdSNYSzg0xcfmdYeTl4jiilw:88Tq0z8YInd9eji", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647416095, "uuid": "174affec-a7e4-4ce6-be4b-03dea1d36ebe", "value": 932864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647416095, "uuid": "a22f7f4a-c7bf-4acb-ab6a-5108f673f430", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416095, "uuid": "20c6084a-05fc-43ae-a04e-edb59c761040", "value": "PO.011322.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "905ffc77-a558-11ec-9275-42010a9c0029", "comment": "Malware payload (TVRat)", "timestamp": 1647456033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647456033, "uuid": "edb38fd8-af9b-43dc-9801-5ac8cac7804c", "comment": "Malware payload (TVRat)", "value": "c057657b41f7b25965c3ba1974f9a032", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TVRat", "colour": "#739DE3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647456033, "uuid": "7e9f91fb-ade2-4b97-b39e-791aaf1ea794", "comment": "Malware payload (TVRat)", "value": "055b1959dd1e2de0cb28051206e54da4dd7bb32d492ce608629e457c76c20d60", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TVRat", "colour": "#739DE3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647456033, "uuid": "c28519a7-2a9e-42fc-a361-aab05e781051", "comment": "Malware payload (TVRat)", "value": "ca6adb5ceab7d0997ff5aab6973006c7013bd7a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TVRat", "colour": "#739DE3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647456033, "uuid": "a477c530-7616-4b8b-bc06-9a9cdd92fdc8", "comment": "Malware payload (TVRat)", "value": "583aa949b7e6d1168c9f10e2339d9c56c838fd4ffb74e53b5c0c1c8e6e2c05de5a914c45459259c5c59d217a4c65db1d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TVRat", "colour": "#739DE3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647456033, "uuid": "b095b54a-b3cc-4341-a542-125bf1f4e750", "value": "T13E663302FB8B547AE91E053ADD60F4512E0A3EAD8DF5206B3CF5DE8E49B86C449BF150", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647456033, "uuid": "a12e636e-cb1d-4168-a92d-e9b735c3db89", "value": "483f0c4259a9148c34961abbda6146c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647456033, "uuid": "8dc2f6ee-8dfb-4d8e-8d71-28b0278232c2", "value": "196608:yo29i2vmZjIa2GPwbPs9Gt/plJdLAicrGi:729T+FIa2Gv9UJdc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647456033, "uuid": "fdfda161-bdb8-4148-bd24-80c5c6a46c0f", "value": 6923186, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647456033, "uuid": "ce3ea8a3-a256-4470-aacd-cfc33c7895ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647456033, "uuid": "c1868fc0-c453-4acc-8a05-028abc086699", "value": "055b1959dd1e2de0cb28051206e54da4dd7bb32d492ce608629e457c76c20d60", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2676373-a55f-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647459124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647459124, "uuid": "d049bc71-8f25-4575-b512-8a63705d2aaf", "comment": "Malware payload (Heodo)", "value": "d14f3784bc6790e1f352bad838a95fc1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647459124, "uuid": "1e354c50-63e3-4512-a1a0-d07782f8a594", "comment": "Malware payload (Heodo)", "value": "0576412b7a70f04d0840b599bf19018701065210d5518b7177ee34afe074868a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647459124, "uuid": "f3792195-6133-43c3-8c08-3a2f6e8df33d", "comment": "Malware payload (Heodo)", "value": "5b415b0ffaf8fe329a8980280ca069eb9ae9caee", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647459124, "uuid": "9b891ec6-0b75-4d5d-b20f-1f54b7de1c09", "comment": "Malware payload (Heodo)", "value": "5ebe4c9b7149fc4996be4e79a0f1cdde9547c8bfe5fa72271e4154553c58c069963e10c63d08928e06f4a1ebaae6ebe0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647459124, "uuid": "287c681b-9c10-4dbd-bcd5-98c5b86b9307", "value": "T1CBF4CF11B2D1C076C1BF06741916A35D63F6FD608BB9878B6FD02FAE3EB45828A34356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647459124, "uuid": "a8f62535-2d71-43c5-84ac-0f68ffe43f98", "value": "66a21a1bcb4077b3ed89c00ee693486b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647459124, "uuid": "e76f4961-a9c4-4c89-8375-abbbac352ed2", "value": "12288:WZjb8BOPxue5dKV9M/98f0koPjXvkgKtuBdfMAofD:WCBAdKV9Xf0kA3KMBdkAofD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647459124, "uuid": "99c389bc-ca13-4aa1-8439-707f9fd90623", "value": 753664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647459124, "uuid": "934ab16c-150d-45b9-981a-c40f69a95968", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647459124, "uuid": "40ed8843-7af7-402a-81fa-3df25b107885", "value": "d14f3784bc6790e1f352bad838a95fc1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a6781b1-a53d-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647444293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647444293, "uuid": "a72235cb-bd05-4e6a-b01f-05eff4d1dbcc", "comment": "Malware payload (Heodo)", "value": "072813f7e2bea8c975e4bfaa1066c378", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647444293, "uuid": "91bb73aa-57b8-40d1-ab82-174a5c125b15", "comment": "Malware payload (Heodo)", "value": "061c3b7083f9591ef7535e1d3155404bd38b6db8394b2874a08aadde630ffd95", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647444293, "uuid": "8501be93-0cea-40b9-8e3a-3742d0d29d6f", "comment": "Malware payload (Heodo)", "value": "87cec2dc61ebb6dede6cae761eefe5076bfa7292", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647444293, "uuid": "51f7b5ac-7b5b-4b6c-9a23-f978e4468070", "comment": "Malware payload (Heodo)", "value": "7ee62042a1209e09a29084a4285cb6f21a8893ad83b937c23f6f7f65cd034996e2a361834aa3a2767a5f64fda05070a7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647444293, "uuid": "5d889b72-7640-464a-9b4e-f7142b3491f0", "value": "T115E47C12F461B2B9D04B04741F1723A86EEF5E518629CA13AFA8ED5E1F31251FC3FA16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647444293, "uuid": "9d8461be-66b6-456a-9704-7d0b88d3b009", "value": "066d4e2c6288c042d958ddc93cfa07f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647444293, "uuid": "12e93f84-282e-455d-946b-d0fe601408f9", "value": "12288:DtAanana8Meee0GBGu3qI+3DNJ3vE6v5eCxS332d7t5hT/hexLx:Kanana8qGBGuoNxEkxCM7o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647444293, "uuid": "9aa5ad4a-a349-492d-a695-c6131bf74fa8", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647444293, "uuid": "edcc0b8c-fb80-4031-acd8-1644ad156811", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647444293, "uuid": "147ed52d-352e-410d-bf9e-e85d2ea9b678", "value": "072813f7e2bea8c975e4bfaa1066c378", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dfe23e0-a532-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647439494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647439494, "uuid": "533fd149-8897-4e17-b69f-63450038db75", "comment": "Malware payload", "value": "09bcf904d2c44dfe4010bc84da471975", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647439494, "uuid": "fb22fd4f-6c57-4979-831e-3a6d96cd25c2", "comment": "Malware payload", "value": "0743500f6fe8b69ead7e13af21cb458d5afa36b53286ea8256ea509f4179465d", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647439494, "uuid": "df19976c-d094-4ce3-9023-77e1e7cfde5b", "comment": "Malware payload", "value": "34c871c355d62e42e89da734cd8103193047b701", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647439494, "uuid": "996e2d8a-9c7f-41f9-8faa-0493cce2782b", "comment": "Malware payload", "value": "6ef46dab5193c6260ac049e0aa03a1616ffcdbbb15dc011836502d0f75f6f675c19344136408c2ea3e97499cad1c590c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647439494, "uuid": "db6f6557-f385-483d-b529-3ec682e4c462", "value": "T1C543395AFD81CB11C1D412BAFA1D518E73131768E3EFB226DD346F216B8786B0E3A905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647439494, "uuid": "9397efa7-d41e-439c-bcd2-044a4f7a6374", "value": "1536:ACnfS2NpssRrMHHKrcujmRnIMdiY64yYAX:02NpsZJ64yYAX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647439494, "uuid": "c68421f7-dd4f-4391-a30c-14c137015ae6", "value": 55392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647439494, "uuid": "b22e1939-8bd0-4a36-8d8a-f545ca025040", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647439494, "uuid": "c00aa36a-e4d9-4485-885a-a00678d79814", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fd4a3e1-a518-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647428330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647428330, "uuid": "d9d99eff-f991-4525-a817-4fa50cdee233", "comment": "Malware payload (Heodo)", "value": "e31715b937312d08132c1579178657c8", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647428330, "uuid": "544abc60-f08e-4c00-ba04-8b44a34be8f4", "comment": "Malware payload (Heodo)", "value": "079cb29d21bf28a7d404ceec3fc270eb1f7ba9de50e6f3e4ff68ef4447319375", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647428330, "uuid": "fb8d7e7a-9a0c-45e8-b924-b5ec04457413", "comment": "Malware payload (Heodo)", "value": "3421b86f813169ff67d11c8fbe1db2a5ae95b472", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647428330, "uuid": "d17571b4-1488-4696-a886-818e79f07d0b", "comment": "Malware payload (Heodo)", "value": "e21060fe6b807193e7b612c8577d432ecb0e03ac03e29463d5120acf58458e12a81ac34dc06c444493fb6d69bcc14ce4", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647428330, "uuid": "88dd00fc-e066-47be-bc10-b958ac609a1b", "value": "T14FF2CF2DA3A0EF5ED61DED38849881EA421579154506EB4FA85CEB0D6F493C33B1F0DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647428330, "uuid": "364a001b-fbf2-4c07-bb2c-b1c634ce8b78", "value": "768:MjFhNKbeXizXT2LxdFfPdkqstJ1goE6vS:MBTGeXgXUndkqegoE6vS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647428330, "uuid": "682ce52e-7e04-4082-b3db-c981587c05c3", "value": 34391, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647428330, "uuid": "15c162a2-04ce-488d-a425-158be76fa0e1", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647428330, "uuid": "e4b39a06-bc1d-42ff-9a44-bd11fcdd2f17", "value": "ARC_ZMX_030122_VOS_031622.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "932d550c-a56b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647464199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647464199, "uuid": "0284e21b-6e4b-4413-9e47-03dca542438e", "comment": "Malware payload (Heodo)", "value": "da3ffd6e3effe07e9521c7d21423c8ba", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647464199, "uuid": "75541ac3-e5c0-4937-a5a4-8fdaf7a99b76", "comment": "Malware payload (Heodo)", "value": "0845c0e135117f04cfde8baa525334e1e12a7554187a46164e4ed814c4060369", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647464199, "uuid": "c037e24f-a25f-4afc-aab3-33f2618509df", "comment": "Malware payload (Heodo)", "value": "ac89b645dd2d64000dfadc00c333c6a90fe931f8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647464199, "uuid": "47fc0147-00d5-4505-a43b-9354f695153a", "comment": "Malware payload (Heodo)", "value": "07284859c4821e2dcbe5b4176a30dcbe76765ef611b6cdfa85dda9400fce374d2692d16a1b28184665761aa45119c8be", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647464199, "uuid": "6cbd48c4-882c-403e-a08d-1510db4136b1", "value": "T1E0F4DF1176E1C076C1BF12304956A38D23FAFD509FB986976FD02A6E3EB41828E34767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647464199, "uuid": "bcaa9f6d-f1c4-42a7-bdab-963f477cb77a", "value": "66a21a1bcb4077b3ed89c00ee693486b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647464199, "uuid": "48ced49d-f67b-4971-81d2-b417704522f5", "value": "12288:g6O4TpP0XjxCCFJuf07j+Xk7hT8rLneTfABCJoWRWwfpW:BeCCF88j+Xq8OTYA7pW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647464199, "uuid": "e1e375cf-bf21-4f7f-8807-740cb776c66e", "value": 749568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647464199, "uuid": "1b81f2dc-7b59-4c90-927a-0601a679c43c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647464199, "uuid": "0121eb8b-7306-47f6-bdea-430974bb9bea", "value": "da3ffd6e3effe07e9521c7d21423c8ba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "105c1387-a4f3-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647412440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647412440, "uuid": "e3844a4e-7274-40fb-96b5-4090dd1b9f69", "comment": "Malware payload (Formbook)", "value": "239ce4f126d4cb8882d12e66e1dbb9ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647412440, "uuid": "e263fc79-c763-476e-854a-13747030566e", "comment": "Malware payload (Formbook)", "value": "085110f2c00a416220b4430ff77cb8169f85db7d282f330db50d4831506e82e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647412440, "uuid": "75648a26-7f9a-4424-9226-12f8ebb16162", "comment": "Malware payload (Formbook)", "value": "c9ce5d24d50e1f16decddfe48bb9db87c5dbaa87", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647412440, "uuid": "192f7422-d6f9-42ac-b643-6266d666fc70", "comment": "Malware payload (Formbook)", "value": "33d3982f795eca58c92f36f1d1b341e2c40c14c7920aad53c5e547b3821b00fbcddad42227fb1ea0123b2e326718a95c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647412440, "uuid": "ceb30a83-0076-4981-96e0-093f6004c156", "value": "T1CDB4AD9D312135CEC86BCB3189709D28EFD16D7A931FE22754D335AE667CA8B8F04462", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647412440, "uuid": "19caea77-328c-4175-8b80-ca3f754df03b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647412440, "uuid": "d965cac8-c008-4606-82f6-913daf02325b", "value": "12288:1vuwIYIb+QeAnJFRte1h+5/WN6cG9mhQzpQ9q5SbmP5ORUcZ64OQlRpKO+7G:5Rk+Q3n1tq2OdG9ZCU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647412440, "uuid": "b340f2be-951a-44df-bed1-38c4de8e990f", "value": 511488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647412440, "uuid": "ba5b6ad2-a6ca-4a38-a6ee-aa87fc9c9dd0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647412440, "uuid": "a48d9108-655f-4b7f-9c99-dcf100ab5e8f", "value": "PURCHASE ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9a27834-a4fc-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1647416696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416696, "uuid": "97bccea5-c706-485b-a650-dbd062c190d6", "comment": "Malware payload (Loki)", "value": "461ae66785b4a9835378ec834fb6692c", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416696, "uuid": "16ccb3c5-20b5-4130-8cb0-32b937eb1575", "comment": "Malware payload (Loki)", "value": "086ee3eef55b4cb156603b91210e430d39fba2dfe6ce1cd815a1d466e94e0399", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416696, "uuid": "18f9d62e-2711-4630-9cca-07881b07559c", "comment": "Malware payload (Loki)", "value": "7440fddf2226fc267cbf886af76ca58f38e0a6b2", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416696, "uuid": "716a1508-43a3-450c-8ba1-47ad9abe39fa", "comment": "Malware payload (Loki)", "value": "2329ccda3c74b9706160bae0a2a15d8c4637b2ef9435ccfd114ce90401294bec2ff2bd0f0dadda9aad56fff80da133c0", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416696, "uuid": "2f8b95f2-cb4d-406f-b51c-35613e2d32c9", "value": "T1D704126D39862DBDF4BB207307A48131615AEC9A9B015942F07BF4B5027FFA942FF216", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416696, "uuid": "f83b4a60-a54a-4b35-90c7-11c1e0db8a73", "value": "3072:SSc2FUmjsI5hBr7QLPOZOBRJlH49cOgit6+aODfebzdMkfSan4aAgqody/zrFd4:c2FlVyFBFYSHCulzdMkfz4aA3odyrrF+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647416696, "uuid": "1ec989c9-00d1-4822-a294-b15a64bf9ff8", "value": 190328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647416696, "uuid": "019c9e70-cdc4-422d-99bd-219334ca736d", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416696, "uuid": "1f63bb43-cc56-407f-9f4d-28acf7c77e32", "value": "Swift copy.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51aff8df-a4fc-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1647416415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416415, "uuid": "b6566bce-e7dd-4f08-ae3f-438e919648b0", "comment": "Malware payload (SnakeKeylogger)", "value": "1a6306fa5b516fd6c62194def4478933", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416415, "uuid": "b96d2362-c388-4007-8d23-7571fd4d36d8", "comment": "Malware payload (SnakeKeylogger)", "value": "09497bab468a29eb9ed55963756999a4351647ff3af1038c5c1b469d276e018c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416415, "uuid": "c800b095-b6dd-43e9-89b1-f483fc3507d2", "comment": "Malware payload (SnakeKeylogger)", "value": "296ae2200120bbc95520e4235d3f6d1ecceb987a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416415, "uuid": "de1fe58f-c5dd-475a-a086-cf5c51f31d1d", "comment": "Malware payload (SnakeKeylogger)", "value": "c365f3555e35abfa05b293ff46e4eafedb39c7a536eb4c2c296f74c728992c0beb90dd727486e68b8f5044279c93585d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416415, "uuid": "75be7a3d-1048-4831-803c-01750d5cef46", "value": "T1A4E4124133E88F13E6FE9E76F860110A1BB6F6677462D70A4FE865EA19D334142503EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416415, "uuid": "ffd99d23-3644-470f-b317-2243751cd5da", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416415, "uuid": "407a4e78-2336-4188-a115-b215ae466365", "value": "12288:ukwOEbPJNgaTc5EZsYAGiOPAwGp67CSBN8Uv5V/PtKg+p1Fd9O9s/rpPU9PK:ukwOAPJLuEiJGiOPpGjIHxV/PxEFdQ9D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647416415, "uuid": "25e0566e-bde7-43d9-8eae-a26c30c01c73", "value": 722432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647416415, "uuid": "6d7182f9-93a4-4d2b-8de6-342fa7f026b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416415, "uuid": "a98b4649-46db-44df-ab86-9d6bb01ebbdb", "value": "Ref#625374546BX.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81b16b1a-a533-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647440117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647440117, "uuid": "840d828f-f053-4970-962f-bb4d337e9d35", "comment": "Malware payload (Mirai)", "value": "f5920fe16ac0428c149dd915fe70a74b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647440117, "uuid": "2f357eb6-69d2-404f-87a9-52cfce0bb66a", "comment": "Malware payload (Mirai)", "value": "0958b6728c92c97659ae89bad26ecae104405f029955eb3ac9542df9c0cd7d80", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647440117, "uuid": "2ce436cb-cd30-492f-8dda-b33948ec56aa", "comment": "Malware payload (Mirai)", "value": "dcd3e7b36bcf496d6f2e088a729d70dcaf56f71f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647440117, "uuid": "9e75a02d-5d0d-4d24-a17d-c369263a6568", "comment": "Malware payload (Mirai)", "value": "21353d721ca14a8fa62fa3606e093dd45581e620850a1047d84ca809cb99ce1e82ce2152ca1a36fdc7ec6bbb1e681c9b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647440117, "uuid": "11c81d85-28ea-40d7-9757-32c59cc25c95", "value": "T18FE2E14DE0545A81CA9E083C96BE030A6A0075D595CF5BDDB3A04E49AB4A35BFE4B0BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647440117, "uuid": "779ca94b-4d6c-41aa-af9a-0a4546d4fd2f", "value": "768:3YhzjQg5yM3AZYAP0QBYYjWRSVUww2cF4Am6uYXkm5WMs:wjuM3AiGnBYYiRRHV4Am8UmW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647440117, "uuid": "7531a5c9-cd4e-4672-a5a8-9b35f2a1aa45", "value": 31796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647440117, "uuid": "d2c06c09-deeb-40b5-8f25-44403e68af7b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647440117, "uuid": "d5f01f36-d326-42cc-a17c-737a6a828245", "value": "f5920fe16ac0428c149dd915fe70a74b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "888d05b0-a4ff-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647417795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417795, "uuid": "b488666d-ef3d-40a4-b375-8f8c3331193d", "comment": "Malware payload (Mirai)", "value": "a72b03864cacd1b7fa77b896fa8e5bc5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417795, "uuid": "8eada691-4fee-45d3-8cf6-d6696b82300e", "comment": "Malware payload (Mirai)", "value": "09828e1b24c60f2497c1856a8999e89f2214cb51c7fd8df218dabc1deceaf6f3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417795, "uuid": "e6549d36-0e0e-4b05-ab33-76bdf2a7dd8f", "comment": "Malware payload (Mirai)", "value": "90ef28106c9b6af78290b4378ad099079c8878a4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417795, "uuid": "9d9eb80c-4802-45d0-b965-b3f552288bcb", "comment": "Malware payload (Mirai)", "value": "bd38d3b5c9093b5855b93473bd49dae581608f79489dd27e384c2cf052c76bd9ef34b7885a9d586bd025ce130b497239", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417795, "uuid": "4a0c1528-ad86-4086-be79-a5dfff7996f2", "value": "T15543F1D1C11BDAB3DF502C7041A6C0166669ABB0C8D620EB7B1B8FE92D093559AFDC19", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417795, "uuid": "94a5a71f-533c-448d-a7fa-1f973377732d", "value": "1536:DSl/vEYEKXFnhrGr+/xpvDnzNB6A/kgM9IM3/EUrmYc1:SsYXthBpzzD6MkOOZrmYo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647417795, "uuid": "63125dfc-1662-44e7-9fbd-4bc47b0fea6d", "value": 59760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647417795, "uuid": "13b92ddb-8832-429c-9721-0bd3419ccbad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417795, "uuid": "68820534-203a-4af9-b7cc-0fb1e8cda39c", "value": "a72b03864cacd1b7fa77b896fa8e5bc5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef7db126-a568-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647463065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647463065, "uuid": "293a9cb5-06d1-4acf-b90d-6bc618d188da", "comment": "Malware payload (Formbook)", "value": "95ab2fa4938e211e9ef1e85ce3f8cdb4", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647463065, "uuid": "4adabd4d-3e40-4a83-8ee0-1cd9c4ef2438", "comment": "Malware payload (Formbook)", "value": "09a4bb5cbc24d7a796bd640bed530426679098c56a1077f8682bd8ad2bb74f08", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647463065, "uuid": "333ea1c4-fb52-4b57-81ee-4a44a9d8e353", "comment": "Malware payload (Formbook)", "value": "51fb144f530f547c58f028f3411e98613d7711fa", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647463065, "uuid": "1680adc8-8182-49d6-9512-36491b4d6b32", "comment": "Malware payload (Formbook)", "value": "b2dc3a72847790d54cf01e53681b63d01428f7f4b63cb1c46890b2259fadcb3fbf3bafc69da7e4bfad1a2f5248a09b21", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647463065, "uuid": "2f5b9ffd-2d63-41f3-bc0c-f2b919f55eab", "value": "T1B81412943E381954E6400D35AB7E6D1C2635CE2BAC25BF7C6F9E721C9031DA248D27BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647463065, "uuid": "5cc89646-72e1-4088-a950-539a5af021de", "value": "3072:+FOhryLQnmXK0iMw4RvjqsBtVoImIeQ4Ol0okFQJC1bjEGD7CJrLqoBD95/L34:ulXK0bvuKDoI0VOlHGD7in5Bpl4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647463065, "uuid": "e78f3e40-62d9-47c1-84cb-143691adaba6", "value": 190648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647463065, "uuid": "428c78e5-c095-415e-8328-fbd3fb1ba112", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647463065, "uuid": "026fc8b2-4d52-4155-9bcd-a206d4d581d4", "value": "000986556543-SwiftAdvice_1.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00635b43-a507-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647421003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647421003, "uuid": "648cd10a-3849-4725-988d-4c5c14c3c20a", "comment": "Malware payload (Formbook)", "value": "d8fdcb0e44f5ceeab2d516d93cc08df7", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647421003, "uuid": "20c15888-901d-42db-8d64-4a0a1c9b3292", "comment": "Malware payload (Formbook)", "value": "09ab6cbe2e3f6ba90584b1d8ffb69d84135cf84c3a13400c8923d1ad36218c87", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647421003, "uuid": "e49232d4-8d26-4966-a326-9020b2bbf323", "comment": "Malware payload (Formbook)", "value": "6aff283f855c07285e74a55c23f84a1cc0b22b48", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647421003, "uuid": "17375ff0-9b27-4186-8e91-99af5098f815", "comment": "Malware payload (Formbook)", "value": "3a1d078e13e03f9d05130c020b0992b5b066ae36d4504dddaeb4e5c2b98653355f934f29cbfed3c99a03faa03a0bf5eb", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647421003, "uuid": "19971edc-a028-4bb2-8a6b-35f86d9deb6b", "value": "T1E9F4339B3775B2F38F56046F467E260B8C0E459B2C9B1669C1FCD2E810F965D292B2CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647421003, "uuid": "ed57393a-cc21-488b-ac8a-e7575fd7bc83", "value": "12288:5jjEDCi4HE8chXCcbQsc5gTRVCfqmnJJerZwcgZlHVcuM2TQ76f/ALHq5rJ5sTkt:ZADYzcQcbQP5gTRVCfqmnX06lHajtLsh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647421003, "uuid": "46dfa610-31bc-4a07-8b64-c27b549a80c7", "value": 753563, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647421003, "uuid": "06136e63-63e8-45ee-aab8-5dd881044138", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647421003, "uuid": "4e592a72-1a16-4a0b-b84c-cf0c3dee8089", "value": "Invoice.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "946ad123-a500-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1647418245, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647418245, "uuid": "9175b4f7-7d80-4561-af3d-39f266a3a476", "comment": "Malware payload (Loki)", "value": "b62d90a20e9121521519a27e065a679f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647418245, "uuid": "c4b95e86-7a41-4f2a-884a-971f6704f6e0", "comment": "Malware payload (Loki)", "value": "09f835800a6248941746215d46b09965fe23a6d30c7d4512e360c7518f30b437", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647418245, "uuid": "4a20829a-f7ef-4f63-ac76-c0cb2d925b1a", "comment": "Malware payload (Loki)", "value": "3ff0bf7de5d7ef8ace3cd84d9a219b16044d9113", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647418245, "uuid": "5c43f194-2c1d-42f1-a1d7-7e0e0e357c34", "comment": "Malware payload (Loki)", "value": "9063d64e3fcd56dbdd7139ead95251ea3519cfeb9929eac737250d9c44c46092f7cbdfb059283574cf5fed7ea3b6bca0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647418245, "uuid": "56e70931-6b43-4bd8-ae34-d871d4b3f9b5", "value": "T136542262B1F1D667E39B2D351073FF3DD37E8628029ACE936F856FBC55A08C25942280", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647418245, "uuid": "b09fd829-a329-43b2-bf5a-e74f4bdaf71c", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647418245, "uuid": "e4f42cb5-fc14-42a1-9a52-bf4be34785e6", "value": "6144:rGivK4WBXMIhQQw81gdvvgILwNSx4ryfTsPmk7l6+0o:bX4cIhHw8Kdvt7oH0+0o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647418245, "uuid": "27c11db2-c1e9-4db0-a316-378fcc562b22", "value": 301114, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647418245, "uuid": "23adbdc2-6735-44bd-8428-a591f176c6c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647418245, "uuid": "6dd374bb-a160-41c2-aeaa-08b0a958aa74", "value": "b62d90a20e9121521519a27e065a679f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d4df183-a4bc-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647389054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647389054, "uuid": "80c65c92-faec-4ed8-95c4-5167dbae6446", "comment": "Malware payload (Heodo)", "value": "29d44676efcb8f01b0c564c081df9fd5", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647389054, "uuid": "4d4e6f52-6004-41ab-9696-8bf20bdeecec", "comment": "Malware payload (Heodo)", "value": "0a86cf33c9ac646fed6454100b059dc9b7edfcaf6e0affc73c10dad0ff0ae8b3", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647389054, "uuid": "99792ddb-4bda-4656-8d99-5c32e3852c34", "comment": "Malware payload (Heodo)", "value": "2fc3e3e77c9cd9c5478edf5ba5a544f06d41b1ad", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647389054, "uuid": "de4c12e2-b813-46a2-a705-01d31aab1e55", "comment": "Malware payload (Heodo)", "value": "8c77c707befd92dd52dd747c8d2fdcdfe77a29ee055166393b29302d5d3a781161ac667a7f2821703f8b69f86db2c14b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647389054, "uuid": "ffd236a3-5874-41cd-8c3d-0d78cb0b55d2", "value": "T157E46B0124A29C71C3E7C9756BD91E1539EAEA92CFF7800BBAE06B7CD874942C337516", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647389054, "uuid": "daf1e3e8-329d-49e1-b7c6-cc5b4680382c", "value": "a38617efee413c2d5919637769ddb6a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647389054, "uuid": "dbbeac17-bd20-42d9-a62b-a32694fd52fd", "value": "12288:KFxGsTPy4BHT4Sj1zfFf7ABqDLkWynCsZ:obPy44Y1pf7VDLkNnh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647389054, "uuid": "1fd141f5-7688-4c2f-bc28-47c0e0d7df69", "value": 704512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647389054, "uuid": "a8b08208-f628-4e1a-a642-cb71fac2207f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647389054, "uuid": "3108e116-6b2e-46ff-9688-de0b2cab1910", "value": "emotet_exe_e4_0a86cf33c9ac646fed6454100b059dc9b7edfcaf6e0affc73c10dad0ff0ae8b3_2022-03-16__000408.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8217a310-a549-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647449567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647449567, "uuid": "9ac7ee70-8f15-4b9e-b0c9-188682a62dd6", "comment": "Malware payload (Heodo)", "value": "c18c6415b268bbcb0a31ffff84b51bc3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647449567, "uuid": "405bccec-74d0-4053-8fcf-1ebd7de75043", "comment": "Malware payload (Heodo)", "value": "0aa4fe2da113594917f837228a8bf59b09cee2cbc5085586d4c2ddc51cef35cd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647449567, "uuid": "3a05dbf3-73da-40a1-b36a-adfb5a0b6ac5", "comment": "Malware payload (Heodo)", "value": "f9a81fbeffbcc6b85e137609458fa4cc5d4497c9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647449567, "uuid": "1aa61d58-f876-49b2-b4a4-f4673aab3377", "comment": "Malware payload (Heodo)", "value": "369dc387ff5e6854684ad800c7b7e83a4e643f26200edf6bc32adcc8eca24f47a6fa5d2987a670638363e63e0ffa73e1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647449567, "uuid": "81d48283-87ea-4443-803f-9f9b10bfba7a", "value": "T1F1E47C12F461B2B9D04B04741F1723A86EEF5E518629CA13AFA8ED5E1F31251FC3FA16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647449567, "uuid": "3b8b98be-1217-41ce-95d9-9591399e67d1", "value": "066d4e2c6288c042d958ddc93cfa07f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647449567, "uuid": "8c55ef29-445f-41e4-a255-96184f771969", "value": "12288:DtAanana8Meee0GBGu3qI+3DNJ3vE6v5eDxS332d7t5hT/hexLx:Kanana8qGBGuoNxE5xCM7o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647449567, "uuid": "19d3024d-1ec9-4891-b936-7e04e2b48809", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647449567, "uuid": "8ebfe4a9-3a1d-418a-8d8a-8b0444c87994", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647449567, "uuid": "de22ae03-d5b8-4ab8-a53a-fae7297ef7e4", "value": "c18c6415b268bbcb0a31ffff84b51bc3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "876b3d09-a4d6-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647400184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647400184, "uuid": "160c2e7f-d004-4e81-8738-ffecbcd7b11b", "comment": "Malware payload (Mirai)", "value": "bc627dacfd4d3841f4693c489d111c90", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647400184, "uuid": "5569c1e5-b95a-4e6f-8a40-b706d306c53f", "comment": "Malware payload (Mirai)", "value": "0b065c595768e517eacdf89dfd7d289679824fceab759d71646c9cb755122910", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647400184, "uuid": "034d2b3b-88f8-49ac-a632-1a268d3d6b08", "comment": "Malware payload (Mirai)", "value": "31939acab3fad389a78f8dbcca5e868e425e9484", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647400184, "uuid": "722f1a7f-5a92-4384-8d6e-a1934c0e4289", "comment": "Malware payload (Mirai)", "value": "fdfa3dc5fabeff835b6eda12a881fc16116986f45a0309bf7aab10f51080b82c7d3923a775a08998f0bbc8680df2b1d1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647400184, "uuid": "a876dcd5-540d-45b7-8103-6ba89a6bd97a", "value": "T1DDD35D56FB404B13C4D5177ABA9F42463322A794D3DB730699285FB43F86B9F0E23A06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647400184, "uuid": "58f2bb78-a710-41a7-80ef-c48de56dd577", "value": "3072:4Sm2Vmd4nbnrhOhDf1mEJt75kZA4WX/FwM/9vymNwaCST3:Nm2Vmd4bl4Df1mEJx5/dX/2M/9KmNwaB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647400184, "uuid": "2dbe0807-34b7-45b8-9e86-d5b658ab0d2f", "value": 142653, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647400184, "uuid": "f5c08a59-2270-40de-a385-d5b8f0f8b095", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647400184, "uuid": "d3695d61-da3a-4c73-823d-c955ac2e8074", "value": "bc627dacfd4d3841f4693c489d111c90", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9eae6a7c-a4bc-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647389056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647389056, "uuid": "49ae30ee-d140-4fd7-b5c1-edc66df97191", "comment": "Malware payload (Heodo)", "value": "a1978271d6238f2b2e5a5c8c1b7f17f2", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647389056, "uuid": "e0907ed4-0207-4c34-92d7-429fde7d788a", "comment": "Malware payload (Heodo)", "value": "0b88807606f0c5d7a8c312aaa0581942eaedf43a4c51fafa77beaadd6d37f7f2", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647389056, "uuid": "5811c2a3-92d8-4168-8700-77a31b23f158", "comment": "Malware payload (Heodo)", "value": "2cfc1ea5ba0f1cf495d3176eab36122866112f2a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647389056, "uuid": "506c6cc8-f806-4a55-92fc-ebd610a2b37f", "comment": "Malware payload (Heodo)", "value": "cd3345f4c3b0f9ebe82114fdac7d5d28d5bf6aca5f4aec1999d6114f92700e3075ab77f30a532cf0629bc91e3efb0b9c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647389056, "uuid": "9c91b284-dc74-45d8-8c44-54a9d6cd07dc", "value": "T178E46B0124A29C71C3E7C9756BD91E1539EAEA92CFF7800BBAE06B7CD874942C337516", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647389056, "uuid": "b232a107-045e-4036-9c79-94e3ae6d1746", "value": "a38617efee413c2d5919637769ddb6a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647389056, "uuid": "a786dcd4-256f-4ba8-96e2-6c98c4bf6702", "value": "12288:KFxGsTPy4BHT4Sj1zfIf7ABqDLkWynCsZ:obPy44Y18f7VDLkNnh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647389056, "uuid": "98e21897-478b-4453-b1ac-842440a402ed", "value": 704512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647389056, "uuid": "ba364b1a-3349-48f9-81f7-926321d3f780", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647389056, "uuid": "a1b0166d-d749-4a72-b663-85997d2fb8c2", "value": "emotet_exe_e4_0b88807606f0c5d7a8c312aaa0581942eaedf43a4c51fafa77beaadd6d37f7f2_2022-03-16__000410.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e706e9e-a4ff-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647417778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417778, "uuid": "817d49ea-6735-4204-854b-9c49e997720e", "comment": "Malware payload (Heodo)", "value": "5b3c2a14f9c7337d48a55fdf8aaf1f57", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417778, "uuid": "f3966f5d-32fb-4175-8d74-63cc9c777248", "comment": "Malware payload (Heodo)", "value": "0b94236da72f03303bb550ccadf5ec686cc33590037eb338f950b512338ca471", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417778, "uuid": "1f04352c-db7d-4ff3-9444-6ca8640f4c91", "comment": "Malware payload (Heodo)", "value": "204a076785bf7e64a951204f206b8cf62a5d8033", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417778, "uuid": "76e74196-15de-417c-aa2d-5e995d368e16", "comment": "Malware payload (Heodo)", "value": "da27feee0771bf39391dd7bbf3b32832df740c37a35b087f0cd0259f37a10aef821e7d837a09306c5ce1b23209cd148a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417778, "uuid": "90356d16-4e01-4c1a-b5d3-af85d7e68a88", "value": "T1D9E45B06AF22A1F0C06B03B40555125AC2EF7ED0A72ED657825DFB7EDD339977A30226", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417778, "uuid": "4d3e55ac-18a3-434a-b091-672c66c2d772", "value": "066d4e2c6288c042d958ddc93cfa07f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417778, "uuid": "a89b0e4c-8790-4059-86b2-136e8d46f906", "value": "12288:jc899XKPmN4WMkoG6ZPJSFTdtXlcIL9v6O8:7GP7FgFTdFL9v6F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647417778, "uuid": "656b7320-8617-4dcc-b4e8-1c30654f24f1", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647417778, "uuid": "51f91049-cbc7-4fec-921c-629207ac28c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417778, "uuid": "a882601d-a1ba-4b3d-8e8d-e24721fed7fd", "value": "5b3c2a14f9c7337d48a55fdf8aaf1f57", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c35022e0-a573-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647467715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647467715, "uuid": "142f36fb-b44e-4223-9302-fe515fb353d7", "comment": "Malware payload (Mirai)", "value": "3b9e17392cc976a57887304418461d42", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647467715, "uuid": "edd8a35f-66c4-444a-908a-04d9ecae6f2e", "comment": "Malware payload (Mirai)", "value": "0bc42e87e6c1bcad53ede6453d22a5c4d48411539f6e83b337e8725dd6380772", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647467715, "uuid": "d420f424-ab72-4f89-af34-c12f235f919e", "comment": "Malware payload (Mirai)", "value": "18719b98c5b9025ec990a183bf64f1f109974714", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647467715, "uuid": "a3365baa-6ee8-4b44-a2c2-e4be487c998c", "comment": "Malware payload (Mirai)", "value": "98d2144aed2236b2e452893b492d955d70c4dddc046c37e3d66882c34bf8445f8e2f250c4c0d3465ebfba815579d3e95", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647467715, "uuid": "a492bccc-8707-450f-b20f-4c97d91b91c9", "value": "T155B3C40ABF610FF7E8ABEC3745A92B05249D550B21A97B75B930D828F61B60F19D3C70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647467715, "uuid": "48a4e3fa-2957-4f2a-ae81-4db91ccad2f2", "value": "1536:g9DYWFx+xx+AaEPiJMR2jk2EkZ+BzYtjKoOvDBgplbngVZ14hvG:gqWFx+xUA0KR2hEkZ+BGpZK1+v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647467715, "uuid": "f86a0976-9cca-45f1-9fdd-f04a6f1db2d5", "value": 108960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647467715, "uuid": "4dd20470-8d94-405b-841a-554503adc602", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647467715, "uuid": "8d48b504-e064-4116-a559-1a6be97145d4", "value": "3b9e17392cc976a57887304418461d42", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2013233-a566-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647462076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647462076, "uuid": "f14cb72d-cf2b-478d-a8e4-e57e65768dc9", "comment": "Malware payload (Heodo)", "value": "1796f90d5a2d062a770c48ed334150da", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647462076, "uuid": "a765d0cb-12a8-4f30-9cab-e1aaf282f036", "comment": "Malware payload (Heodo)", "value": "0bdf7e8b2ef56ae668d7ae7aa19aff9e36efe370ae0c154234b9c9608a57617c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647462076, "uuid": "624abecf-ce17-4da1-a0fc-020cc995444b", "comment": "Malware payload (Heodo)", "value": "3269d407e1f44ab03c4c741c01214c2ce8d80bdf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647462076, "uuid": "6db375c5-fb4b-4b2e-9741-1048c8998a60", "comment": "Malware payload (Heodo)", "value": "09f0eda1871aa463fb59eb01108f0c4e90ec96f4b2f827400f9980bce881570816f59f8c890ccc90c16de53f1ce98199", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647462076, "uuid": "15c83973-8283-49f6-80a2-4c8ffdd81328", "value": "T1B8F4CF11B2D1C076C1BF06741916A35D63F6FD608BB9878B6FD02FAE3EB45828A34356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647462076, "uuid": "1ccda5b0-0a64-46c5-b4d7-a875ae090a9c", "value": "66a21a1bcb4077b3ed89c00ee693486b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647462076, "uuid": "df098a0c-a696-4d59-9a9d-dd73c31d406f", "value": "12288:WZjb8BOPxue5dKV9M/98f0koPdXvkgKtuBdfMAofD:WCBAdKV9Xf0kS3KMBdkAofD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647462076, "uuid": "6241f049-ddcf-4f1c-9a32-383d1996a016", "value": 753664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647462076, "uuid": "9d52e931-d3a4-486e-bd0c-727e6f0427ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647462076, "uuid": "dc6efb57-e426-484c-923f-6d1961a64bf0", "value": "1796f90d5a2d062a770c48ed334150da", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ae26894-a563-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647460695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647460695, "uuid": "b20f3844-10a7-40d2-935c-38001b1c62c4", "comment": "Malware payload (Heodo)", "value": "f8101c7f60fd9d5078e7dbc45b6ef32d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647460695, "uuid": "e5172c50-1a79-4496-8a48-65f4ea26222a", "comment": "Malware payload (Heodo)", "value": "0be231868c55d9caa2c88f080d324ecbfcc37192ad640d26666fd770555f9809", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647460695, "uuid": "a0fe3bd9-4f4d-4ec3-9a12-d0d4d19809d4", "comment": "Malware payload (Heodo)", "value": "018137eb0255a859eb09673379051074a65724bd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647460695, "uuid": "6cf9ef4c-6b9b-467a-8425-575338d5eaa4", "comment": "Malware payload (Heodo)", "value": "b58bd2f4bab94c7754f35fcb055c76ea4fbade58832910eb706557b7d42a0812df111b34119052d8fb2f8359be3acc9b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647460695, "uuid": "86ac6160-752c-499f-bbf4-a98dd1acf7f3", "value": "T1BDF4CF11B2D1C076C1BF06741916A35D63F6FD608BB9878B6FD02FAE3EB45828A34356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647460695, "uuid": "a3dde0f7-f237-45c3-ad30-6aa2ce1fa129", "value": "66a21a1bcb4077b3ed89c00ee693486b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647460695, "uuid": "6774f1f7-0b23-41df-a52e-b5b25e8d9764", "value": "12288:WZjb8BOPxue5dKV9M/98f0koP2XvkgKtuBdfMAofD:WCBAdKV9Xf0kt3KMBdkAofD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647460695, "uuid": "d966cfef-f8ad-4513-9e28-02e9a431e368", "value": 753664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647460695, "uuid": "364ec6da-e7bc-46b4-a255-98e36006b329", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647460695, "uuid": "b51529ec-ae11-41b3-91dd-45f0c09eb3a5", "value": "f8101c7f60fd9d5078e7dbc45b6ef32d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ddd9f72-a4bc-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647389055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647389055, "uuid": "76892d79-dc3b-4126-866e-f603fdf57bde", "comment": "Malware payload (Heodo)", "value": "461e7d848f859ab9491e1526d2172472", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647389055, "uuid": "5e9384b7-6c4f-4ea1-b223-29944ed8f145", "comment": "Malware payload (Heodo)", "value": "0c1673842170a7b02159b7c8f5209c02113caa8a197adbf8da9c0a19abab65b1", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647389055, "uuid": "2ff631fe-c90a-44f2-8b6f-40afe3b14ed1", "comment": "Malware payload (Heodo)", "value": "e62c972db2635cb428b7d59b9f04a717b1cf6499", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647389055, "uuid": "c619f463-7e39-4342-8832-b8ceca9419cd", "comment": "Malware payload (Heodo)", "value": "6ec2298980823b35c5a9e9f64a9189bc90b543f11c330c635450aee3ac037f25d5ec0d37be89d9b4012abf840d9598f5", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647389055, "uuid": "b679e157-337a-4b48-a88a-bf26f927836e", "value": "T110E46B0124A29C71C3E7C9756BD91E1539EAEA92CFF7800BBAE06B7CD874942C337516", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647389055, "uuid": "5d03fd7b-8f60-444d-97e3-368e42f1cd19", "value": "a38617efee413c2d5919637769ddb6a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647389055, "uuid": "b4f85e60-8444-42e6-acfc-8a8fd4ac1760", "value": "12288:KFxGsTPy4BHT4Sj1zf9f7ABqDLkWynCsZ:obPy44Y1pf7VDLkNnh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647389055, "uuid": "72425d4f-602f-4fe5-a5ab-7ef806f3e470", "value": 704512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647389055, "uuid": "0aea5b99-e83e-4bbb-8218-1cff2b17c8e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647389055, "uuid": "804a4929-5d74-44de-ac7d-2f93dc2b21fc", "value": "emotet_exe_e4_0c1673842170a7b02159b7c8f5209c02113caa8a197adbf8da9c0a19abab65b1_2022-03-16__000409.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d30dcd8-a4bc-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647389053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647389053, "uuid": "4ad4854f-bf95-497b-9064-e3ef04bd5a5c", "comment": "Malware payload (Heodo)", "value": "79e4252aa9aafb1af59cd694d571450a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647389053, "uuid": "44c9d7d9-7c3a-4c88-a88b-0e40ac100146", "comment": "Malware payload (Heodo)", "value": "0c68302e9320c34a37b653fbbf49175d0ec3e29b869e5dff20d4d8c7f3bc9c70", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647389053, "uuid": "b222af8c-fb87-429e-b432-fdcae34cca93", "comment": "Malware payload (Heodo)", "value": "a772311f07f5836b9199ec490b311451941caf27", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647389053, "uuid": "3c392013-26c6-4cfe-8162-679ebcc63a71", "comment": "Malware payload (Heodo)", "value": "593fb517e01f9937b8aa53ea6e4e16d9ad600c8f12b5d5c8d93eb36ecf7a687a4d03c7e1b8f443dfce3bf35ebd27c6dc", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647389053, "uuid": "a02fa632-2654-432e-8347-aee8c212de74", "value": "T1AAE46B0124A29C71C3E7C9756BD91E1539EAEA92CFF7800BBAE06B7CD874942C337516", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647389053, "uuid": "3f0ccbb9-8ace-4c89-a9a9-7120172ad18c", "value": "a38617efee413c2d5919637769ddb6a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647389053, "uuid": "294e9e93-5fa6-4d15-bc4a-fe16eb9287d6", "value": "12288:KFxGsTPy4BHT4Sj1zfFf7ABqDLkWynCsZ:obPy44Y1Rf7VDLkNnh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647389053, "uuid": "27f784b3-2b0a-4f52-a399-1e81f2c0edad", "value": 704512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647389053, "uuid": "35b44d3b-bea6-4818-b2d5-0bf3819d8659", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647389053, "uuid": "6fdeb7d0-af42-42c8-a3c5-d4f524472af6", "value": "emotet_exe_e4_0c68302e9320c34a37b653fbbf49175d0ec3e29b869e5dff20d4d8c7f3bc9c70_2022-03-16__000408.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a566b9cb-a51c-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647430299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647430299, "uuid": "115f3954-e034-442b-8241-b6837587fdf1", "comment": "Malware payload (Formbook)", "value": "94a93c148e9088673a8de329540de1fe", "object_relation": "md5", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647430299, "uuid": "8f9a29b6-0177-4871-a571-b43e7635f18b", "comment": "Malware payload (Formbook)", "value": "0ca81506cec552ca06332a20c79b220d36dc098318b5053116dddbafac7b088a", "object_relation": "sha256", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647430299, "uuid": "9ef54637-188a-4001-8438-d91cd34931c8", "comment": "Malware payload (Formbook)", "value": "d6a3e127018c7bec706c21fd5c1b025e97212a55", "object_relation": "sha1", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647430299, "uuid": "b818e59a-feca-4b03-a7ce-31863a74c910", "comment": "Malware payload (Formbook)", "value": "eda29c921ae831fabf01645bb19d6df06ab61e32432d9431d15044e487d1118ac02662047227b5379ae8d94ecf70979c", "object_relation": "sha3-384", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647430299, "uuid": "9474233b-89ff-408a-8ab5-174aff5cc933", "value": "T1E4841292A59645BBE9E505740535D71CA1F39E8D42B52B0F738CBE2B3FB3383801AA47", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647430299, "uuid": "70af7a51-0bba-4d31-81c6-2e77ad1a6556", "value": "6144:GGi4zy1uJetTHmKs9okWHVpvJYfbSSpNNSdtv04qdOE/D7xxSrnnpm:Vy1ukTGKs9o/HVBJYfbSSXYrvlq+7nM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647430299, "uuid": "cfcc4e59-0f5d-436a-a784-a3c25f26170d", "value": 393216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647430299, "uuid": "0db892c4-3fc2-4ad0-bba9-95a3220c3de3", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647430299, "uuid": "4b1a744c-d7bd-427b-b6b5-4478b0ca9cb5", "value": "KGA20-AC-B6 RFQ Mancuso Nro.6315-22 6313.cab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "feddd554-a4fc-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647416705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416705, "uuid": "83d3a3f5-8294-4e77-beaf-e7001a19a21c", "comment": "Malware payload (Formbook)", "value": "3d921c91217cdd2d7211a436aa939c77", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416705, "uuid": "f44f5714-5295-4ff0-b63a-26b32e9329c3", "comment": "Malware payload (Formbook)", "value": "0ce81f8966c506292d9b24dc4219910f7309f9a6b59d2b7bc89c3ec5fc46850e", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416705, "uuid": "b7a3a09b-bb7d-4237-9c51-f5187e8ea2a4", "comment": "Malware payload (Formbook)", "value": "302e950c8d331b8a950489c7183ae50f22406a29", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416705, "uuid": "bcbeb961-d20e-40f3-bc2f-af72c9783104", "comment": "Malware payload (Formbook)", "value": "2d011ad80c785c86ff2102b9281800d126b85457fe5d98d0abe9f93341582caf278c5c0b54e73eba3cf701f2fad13d69", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416705, "uuid": "4f77a948-a56b-4b9e-9db0-44bdec881ab8", "value": "T176141226B751A598F2B634BE5BBC0136C62D6D7FCC02A7CDF69A3F163474CA08921718", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416705, "uuid": "f582c723-3272-4ef5-81d7-4f6b30e6dc04", "value": "3072:9BKIGi4sEfhfgGFm+ihsn8TqfBPgdki435XilyaqU5bdd/SGBM+waogPiP/+lkPo:HKIGHs4Os8Y9i4Il13PS0UwkP+zLZ+Z8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647416705, "uuid": "304a6721-98b7-4972-90d7-af49c674c588", "value": 190904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647416705, "uuid": "7ba6c8a8-8729-4b9b-b262-2edb2e8d33bc", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416705, "uuid": "1b12ded1-fd42-4832-a85e-04b0676b9240", "value": "16.03.2022.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa1e88fc-a53b-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647443621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647443621, "uuid": "a872ad70-0f46-4275-91a3-8501d341900f", "comment": "Malware payload (Mirai)", "value": "e225e48fdf529f027616f72bafe84b6b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647443621, "uuid": "a98f4813-0264-4833-a069-c4a6a797932e", "comment": "Malware payload (Mirai)", "value": "0d927a566df90aa85433bd7c7b896bea1a2d86eef64726f620056a187e1842c8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647443621, "uuid": "8570cab3-2735-4e0d-8964-289be9301290", "comment": "Malware payload (Mirai)", "value": "a1d21cbd7d4641c6a68e617a19c49bb78b9b64c3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647443621, "uuid": "061aaae8-e226-459f-bb0f-36dd10404834", "comment": "Malware payload (Mirai)", "value": "03b95564313e18af75734c67570d6ddb6f4ccc57f2577bda4fce014c9c28bc218ad33dc2b43d4f82b163d315af09d6e7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647443621, "uuid": "b1812f2e-1a80-457a-b3cb-9369fb059ef5", "value": "T11D432914DF6B4916C4C054BBE1E3073DA7B843C66860FFAA7CE11A5CAB816D0329F5E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647443621, "uuid": "50ec1a61-147e-476b-ab4f-e59154350b5d", "value": "768:WoZ4z4U4XlQp7/JO+xH+g+D2EJ+eA5IWZrtfhJLRKEc6h6:WoDVQRJT+qE4eA5IWZx1Rh6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647443621, "uuid": "0aec87cb-a9c1-4494-82af-5271c7b6d9e7", "value": 55444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647443621, "uuid": "bf6a3e61-0794-46c1-8def-814cf812e2e4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647443621, "uuid": "78ed68fb-6baa-4e6f-a4ef-22a20a03d329", "value": "e225e48fdf529f027616f72bafe84b6b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33206c2f-a507-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647421088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647421088, "uuid": "e62538c8-2c89-4c04-8311-5cbf5e42b30f", "comment": "Malware payload (Heodo)", "value": "78f7f9f150d4d192dac8750f371750d9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647421088, "uuid": "f224495c-acef-4f80-b4bd-d6dc939c3d81", "comment": "Malware payload (Heodo)", "value": "0db2f13ae0b960892217bde035e94a955cb2a08bf3a634ce6ca32a71d2fde3c4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647421088, "uuid": "7a951b05-b185-4fb8-a206-5adfeb60ab6f", "comment": "Malware payload (Heodo)", "value": "078ce3fceb399ca6d5f83ca6024c312a99cce522", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647421088, "uuid": "239c6d36-3246-4f0c-b809-c75aeee21403", "comment": "Malware payload (Heodo)", "value": "0337891c5ce33ef3329a4e22c58234ee6006a0c462c5d87e65800c95df1ae4179dc24cad268d26ddafc07635035091ee", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647421088, "uuid": "b869502f-89b0-47e0-858c-02f0b584f642", "value": "T1ACE45B06AF22A1F0C06B03B40555125AC2EF7ED0A72ED657825DFB7EDD339977A30226", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647421088, "uuid": "ea397f5f-f024-4639-b144-96dad871242e", "value": "066d4e2c6288c042d958ddc93cfa07f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647421088, "uuid": "7b353369-4301-4fd4-b72a-927979c136f9", "value": "12288:jc899XKPmN4WMkoU6ZPJSFTdtXlcIL9v6O8:7GP7/gFTdFL9v6F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647421088, "uuid": "d2c77c94-5cc4-454e-b1e2-840692204153", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647421088, "uuid": "4eb4bee8-c60e-4f75-b269-a8f006dc5c66", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647421088, "uuid": "a9a90431-781a-4225-82e1-f1f7e056c929", "value": "78f7f9f150d4d192dac8750f371750d9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04ae5f5f-a54d-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647451075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647451075, "uuid": "f369a71a-7e2b-4872-8929-bed817f7e633", "comment": "Malware payload (AgentTesla)", "value": "957421802e9e289ea480ae4be0482824", "object_relation": "md5", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647451075, "uuid": "2005e199-b4ba-463b-8e8f-499369e3e695", "comment": "Malware payload (AgentTesla)", "value": "0e166bfb0662a0dc60c8ccfd78901144e8ad350dcdc5227dd27b3b11511aa1a1", "object_relation": "sha256", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647451075, "uuid": "a19bbf78-e6e0-42af-87a5-cfa7c83de807", "comment": "Malware payload (AgentTesla)", "value": "7a9e91fbdc1bdca61bcd418372cabf5269525d95", "object_relation": "sha1", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647451075, "uuid": "fac744f9-89d2-4db3-acf7-4975d0b50f53", "comment": "Malware payload (AgentTesla)", "value": "eb450487687f19723bb83a9c088f93d79e6782a4acf6f7c021bd206fcb0a0a23e81ddb80ce899403671f8599d37c6393", "object_relation": "sha3-384", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647451075, "uuid": "8d8bda40-2441-45fc-a4e6-4935c8cfda17", "value": "T1CD059D54725070EECDAA8F729A25DC34DF917CB9D30EA16620DB3DAF75FD9A34A00092", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647451075, "uuid": "3c67c103-1969-4b56-ae4d-cb2fe2e80ec1", "value": "24576:elJiVZO5I0Zr4lB6plbBUUD/MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM+MMMMK:elJiVZO5Iy4IpCUD/MMMMMMMMMMMMMM1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647451075, "uuid": "2507d552-30a5-4962-a83a-359bd4f77a11", "value": 815104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647451075, "uuid": "2d5b865d-0bb1-415c-9271-dc42a0429db0", "value": "application/x-tar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647451075, "uuid": "cee56a91-6c16-4c55-9696-ef00aa0e21fa", "value": "Bank_Details.tar.001", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00da002b-a4ea-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647408548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647408548, "uuid": "c6b8ee40-b549-4310-a9a0-3c70b2632e19", "comment": "Malware payload (RedLineStealer)", "value": "972304238a42cc5968f45d80afaccd27", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fragtor", "colour": "#F33782", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647408548, "uuid": "9d36b1e1-950d-4936-8323-c7790490b01e", "comment": "Malware payload (RedLineStealer)", "value": "0e2cc9df8f77ef24ad39d58ac0becb2d75462fb386d6714341965156455518d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fragtor", "colour": "#F33782", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647408548, "uuid": "353e6dac-553e-484b-bd62-6a9d065fdb58", "comment": "Malware payload (RedLineStealer)", "value": "cb9024f64c3c89347ce34d3956cf23c8c490e71c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fragtor", "colour": "#F33782", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647408548, "uuid": "27954d7d-47bc-47ce-b397-72367fce36f6", "comment": "Malware payload (RedLineStealer)", "value": "37d2ffb34f372afbc181197b5ab9ddb44e1fa062ac2e89004ed2c109ff5b7c5638793c65dcf9a6d75088eac6eb3353a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "fragtor", "colour": "#F33782", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647408548, "uuid": "b5ef4009-d892-41ef-a5f8-078a3db46ad3", "value": "T19FB4234C258ACA47E6925E323DB2F098EF0D791704D299AF8FDD7943F1309B85C911AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647408548, "uuid": "0d701eaa-d673-4c45-aa15-f471f5da13a1", "value": "1a19a680a05982bdf258e0caafeb3b72", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647408548, "uuid": "fed8b787-8c98-4290-bb33-0a06b28d0a59", "value": "12288:InAAZVdo0mKwe9r0CK/lGRgOUqmq9kR6lhKXMQs+Buqn:IAyVdzN9YCK/cRgOnmq9g6Yc2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647408548, "uuid": "604a4a34-b4b3-4a66-aee2-7c7eb3ae6578", "value": 525824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647408548, "uuid": "2e867121-abcc-4298-a130-6b89b72bd7a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647408548, "uuid": "2907f59b-1abb-489b-aee1-edfe8c17ef8b", "value": "FFFFFF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb73ffc7-a53b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647443650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647443650, "uuid": "4a4c6fe2-d250-4a85-beae-184ac7f83d3b", "comment": "Malware payload (Heodo)", "value": "0ffb61b7a2c8003ae34c116f7cfe0ff1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647443650, "uuid": "922be39f-f2be-446d-80b1-c857c67f0bbb", "comment": "Malware payload (Heodo)", "value": "0e5bff64ceed080d70f09b661483457e4ac1db1dadf87a07caf9127ea9a8d0c4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647443650, "uuid": "d5cd9839-3ed0-4fd0-9225-9ea4934b9fb2", "comment": "Malware payload (Heodo)", "value": "869f92c1dc0a0a41ab4fb74e1dd9ab65ba231dec", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647443650, "uuid": "b735463c-df76-4708-b4c0-09d23cddeef1", "comment": "Malware payload (Heodo)", "value": "58f99fec1b3e16fd110e83411dc0316c0b562240bb2ec68bae0a6bd254b003aa3dfa85fd8ca5f90507a6f62487bcca27", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647443650, "uuid": "25b6dfa3-3980-4b0b-b7fd-f6ff8dae16bf", "value": "T187E47C12F461B2B9D04B04741F1723A86EEF5E518629CA13AFA8ED5E1F31251FC3FA16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647443650, "uuid": "8490a493-4186-489e-970e-efe3f9132c59", "value": "066d4e2c6288c042d958ddc93cfa07f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647443650, "uuid": "34ddba60-1a5d-4e0f-b2cc-14762f604a8d", "value": "12288:DtAanana8Meee0GBGu3qI+3DNJ3vE6v5eExS332d7t5hT/hexLx:Kanana8qGBGuoNxEixCM7o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647443650, "uuid": "7d08b869-43e3-438d-9b67-104345260d81", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647443650, "uuid": "0e8ffe34-85be-4deb-9bc7-f4e6c4189662", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647443650, "uuid": "7db4768c-0d9b-4fc6-a6ef-29a600d63f2a", "value": "0ffb61b7a2c8003ae34c116f7cfe0ff1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d712d912-a573-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647467748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647467748, "uuid": "ee3fbc74-3859-412a-9d17-b44e54529617", "comment": "Malware payload (Heodo)", "value": "8bf8e53732a013625b50280053da11b3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647467748, "uuid": "499ca5e4-f00b-4772-9544-4e9fbe34836f", "comment": "Malware payload (Heodo)", "value": "0ed20bcff3bb675c8cf58b81b6175c24a99e04a8a98b3dd8f5f1354183c6ff85", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647467748, "uuid": "4174f064-e274-4a59-afb1-6bdccd7643ef", "comment": "Malware payload (Heodo)", "value": "3d20a8d9661b5651fdc6bc51f84194ae2d78a549", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647467748, "uuid": "e4b98e2a-2361-414e-8088-dc028baff950", "comment": "Malware payload (Heodo)", "value": "73ad1bd63f5765443a3192ef2354c2485e525e704e87362d8e9028a24d972d6c1164f2ecf5982335e5fc35bb58fad128", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647467748, "uuid": "3c1e15ca-dd96-41f8-bbf2-3bf815b124e9", "value": "T11CF4DF1176E1C076C1BF12304956A38D23FAFD509FB986976FD02A6E3EB41828E34767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647467748, "uuid": "9745c995-c77b-47fd-a3d3-03fa6e35948d", "value": "66a21a1bcb4077b3ed89c00ee693486b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647467748, "uuid": "2ef9c317-0115-45c5-9919-d9b325ced73d", "value": "12288:g6O4TpP0XjxCCFJuf07j+Xk7hb8rLneTfABCJoWRWwfpW:BeCCF88j+XS8OTYA7pW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647467748, "uuid": "98c4f5bd-f3ba-40af-87f6-3b3c2002d3ad", "value": 749568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647467748, "uuid": "11fa62cc-8daa-4d11-9b69-782e820d1ebe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647467748, "uuid": "41c80379-893f-427e-ae7f-c01f1e9e7b92", "value": "8bf8e53732a013625b50280053da11b3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cd7da36-a572-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1647467168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647467168, "uuid": "799ad571-c3cb-4866-a885-182fac914304", "comment": "Malware payload (Loki)", "value": "fe722008beda468a5b2cab79f33a93d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647467168, "uuid": "c7688c06-70fe-45d6-8a50-3a899a84a9fe", "comment": "Malware payload (Loki)", "value": "10e61062c4bd1e89a7e497909e0d4bdbf9636d9b7540960c090fad3dbb18752c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647467168, "uuid": "6305195a-95f7-4740-930b-1cef0ec369e4", "comment": "Malware payload (Loki)", "value": "bf78826c273ed944b2cd03c1efb65b63e478a962", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647467168, "uuid": "b1fd8f4c-e247-432d-b647-3077487a5d14", "comment": "Malware payload (Loki)", "value": "c148bd7e5efe27b232f75e819ed53bba9c267e6f6d1c19cb0ca3774f7cf00603f296ba9070be84a1653b784e4c037861", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647467168, "uuid": "cf7bfd91-0719-4eae-9c92-2b58ef74c722", "value": "T11C64D3C5E98465A0DD19AB716A37CD3592237DFDA874A42C28DE3E273FFB2931026053", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647467168, "uuid": "ac87a973-8dfd-458b-9977-df2b47c946c8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647467168, "uuid": "2abd5376-8d68-4b57-b1d4-57af6b1bf20a", "value": "6144:wRF2MKiglJE1PaAkzL7r9r/EDppppppppppppppppppppppppppppp0G:wRSiOmWP7r9r/+pppppppppppppppppD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647467168, "uuid": "18cede9b-9d4f-4f0c-9947-3d92b8ce2ae5", "value": 315392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647467168, "uuid": "02a5b68f-430b-4686-b0bf-5ccb2fc0a882", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647467168, "uuid": "2c3af76e-94e8-4ae7-b4ab-472e9e5d5348", "value": "OdemeBelgesipdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "017157b2-a52b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647436466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647436466, "uuid": "c6aad209-78a6-4691-aebd-3490c7e5ccac", "comment": "Malware payload (Heodo)", "value": "96c37cce95dd177a5425c2208d1db661", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647436466, "uuid": "020493cd-2c56-44ff-ad13-c196707d8743", "comment": "Malware payload (Heodo)", "value": "12781c0790452fbc44381fab4e3ca08673f08e05423d196a11d3939010050d06", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647436466, "uuid": "b82566c1-1887-4f27-bb5b-8668133067dc", "comment": "Malware payload (Heodo)", "value": "43b4364c66788b3d542c8c5c26886793ce9c6812", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647436466, "uuid": "db0f2b34-f8f6-4b9e-a36f-662bef8fc8be", "comment": "Malware payload (Heodo)", "value": "d5298859a94a24947474c990335fb04f4cce179f0c59cc460c06c3a8c374bcf6296f0475c3919048698ee4c5d2a24c0e", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647436466, "uuid": "825071fe-cf23-4044-ac19-7db3bf803066", "value": "T1A4E2C02DF2A0EE1DC21EE939446895DA421DB4558502EB4FB95CFB1D2F0A5C23B1F0DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647436466, "uuid": "a3e30750-cb07-4743-838d-7a481adf7b8e", "value": "384:cjzZPFhNjqEBOA7iEibbwBLg0SCdiVXUKgUrNU/qWhZOdBNPJM+kqr9eCgh0k5lY:cjpFhNNlizXT28dFfPdkqstJmE6/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647436466, "uuid": "aaaf44d6-e923-4f69-9d36-7fc39b03afad", "value": 33750, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647436466, "uuid": "8ae4b652-f71a-40b5-8dce-001a02318290", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647436466, "uuid": "47c4daec-d722-416c-aa96-0b40827a0e07", "value": "gescanntes-Dokument.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd0f4f8f-a52f-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647438606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647438606, "uuid": "2809eb6f-fd88-4dd2-8742-d108a00f1b9c", "comment": "Malware payload (Mirai)", "value": "fa51c6a26d0a6f0384d016ec8bb63f20", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647438606, "uuid": "122cd3fb-f2a5-4cf4-851b-2ba6d07556ea", "comment": "Malware payload (Mirai)", "value": "13054eedf8b002f51dbce77433ac4600eb980590c08f96d282b4dbc0a47d6df2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647438606, "uuid": "d9fcd753-c9b1-43a5-92d7-788cd7ce3eda", "comment": "Malware payload (Mirai)", "value": "2a27de4ab6b1966576dfe05b824f75e259ebc1c0", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647438606, "uuid": "6c24b9e9-1716-4437-bb9a-15b79b86e2e1", "comment": "Malware payload (Mirai)", "value": "c24102e36d7be32dd770ca9868f716b7bcd22606df32a6be2c9672abecd311a614c1198b3c524897fadf8b043e9dcb3b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647438606, "uuid": "ca92eea3-4fba-443c-8aff-9f92b4295618", "value": "T141132844BC97E661D4404876B02A5B32567FC6E92C8FDFAAC32DD636EC46401E70767C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647438606, "uuid": "ef5d088e-e183-4e60-bd9b-823b8af2c3db", "value": "768:rgQ5pSl3M+umDFlk5UzSGMxjUjP6qjfWtwJ3eI:rgCprLmDFO5UzS1wCqitU3e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647438606, "uuid": "33a10a6c-687d-4c04-96ac-3c681468580f", "value": 43308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647438606, "uuid": "b1e8262f-44bb-40eb-89ae-4417db79ffac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647438606, "uuid": "5c9e42f2-c55f-43f2-8069-f1339a412dd5", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe663e2f-a568-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647463090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647463090, "uuid": "dadb80e1-5e8f-4655-9bdd-5f70d37d65f1", "comment": "Malware payload (Formbook)", "value": "5b9134a510d3d880e270a954ae4f517c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647463090, "uuid": "295f6ac9-9d40-494e-b29b-4e7baed66390", "comment": "Malware payload (Formbook)", "value": "135c850eff9a58e64a4ab3604f32cc8595b8286892f390b5895711ef8edfd887", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647463090, "uuid": "8cb057cd-0d33-4e29-88c5-b487262af218", "comment": "Malware payload (Formbook)", "value": "1c08814ae5420b45c3cf1650610de9e4ef171697", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647463090, "uuid": "80f77b4c-6cb7-4a13-80e0-674c2d9ff752", "comment": "Malware payload (Formbook)", "value": "411b0c2abaad44cc21e18e1ae7cc12f3492dbb8b69bd026cf05b067add672b76b9fb1028ee1d6bd2bd512b374e8cb7f3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647463090, "uuid": "ce7fb789-4c68-4d6f-9dcb-44ae45b11cae", "value": "T13D04E58EDE2090A8CC255D7EA06109F40AB73DFCC964032E5BED76594BB72F3597218B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647463090, "uuid": "1d35724a-e54b-45a5-9f60-12b99ff49a54", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647463090, "uuid": "a00ddd92-2351-43e8-94c9-cb7e7f720750", "value": "1536:ZvxHr0sm2rQCPjnDhxG4yt/7xha4UnL9K4sQfRYceA+IM8BaxDGBMV:XHr0TyQInDhyttkPnLBsyYcwIM8YxzV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647463090, "uuid": "11212bd1-6e75-49ef-a623-f6a2ed653d49", "value": 189440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647463090, "uuid": "1684da22-08d8-477e-8f8f-7c805e38bc4b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647463090, "uuid": "2d16bf58-e211-4fa4-8413-f09e64a4f6c5", "value": "quote your best prices and delivery time.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eeeab775-a4fe-11ec-9275-42010a9c0029", "comment": "Malware payload (NanoCore)", "timestamp": 1647417537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417537, "uuid": "79322ae2-d09f-4759-959d-27efbbff6446", "comment": "Malware payload (NanoCore)", "value": "2f4d9aa14cdf33de7f6534bc5ce51eaa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417537, "uuid": "d6c95b0c-dcf4-49e8-aa8b-fc822be353e9", "comment": "Malware payload (NanoCore)", "value": "13687a295bb273d7d9f1c2eea25ce5ae3766b53f1192fb77a7db931e40e21c7b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417537, "uuid": "2ed31396-a42a-48d9-81c7-416a7bb6dcfc", "comment": "Malware payload (NanoCore)", "value": "777bfbb3b5e38a6d5da7db12fe33327b489a14fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417537, "uuid": "0496faa8-4baf-469b-ac38-6b0de8ec7ad4", "comment": "Malware payload (NanoCore)", "value": "10616e3d73ea72ff683d03ee850135863ac003a6149437e5017402a84bd3986c2b097d24d5c7acd476f65d152c42d9a1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417537, "uuid": "ff48e1da-a263-4a26-bbca-6559ea79baa2", "value": "T1D303B302FA488370D356867BB4DEF20CE2969C1D020BDA97F9523E8B16723E19DF955C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417537, "uuid": "92f47fac-e847-43d7-b716-d1243d919f56", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417537, "uuid": "4c50f138-1d4a-4e76-87e4-6ce5595d5e88", "value": "384:yCH3ievxUMreueOdenPCimzH94l786mMzvWP9TzsymafVUMUO+agvNeszy:yc3xWnqimqFmMifVUmyW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647417537, "uuid": "a3ebfebf-76df-4f02-babe-930f73fea2b9", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647417537, "uuid": "96b0fd3f-eef6-4280-98e2-890ed92113ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417537, "uuid": "f7c85496-1a38-48a5-8b82-87c371cefce2", "value": "HSBC Bank_Payment Advice_Pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "893067b6-a4bc-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647389020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647389020, "uuid": "77ef4353-1a72-425d-a4df-e4583e84a631", "comment": "Malware payload (Heodo)", "value": "1d5e24f834bb8ecef41528a8633d893e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647389020, "uuid": "83093568-d162-4a12-9945-147e48e9ead1", "comment": "Malware payload (Heodo)", "value": "13743dbeb64ab1e4108e9e1e354ff8ecba10dfac34ff5a6a5da1c01921c18644", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647389020, "uuid": "0db2aca6-a6b4-4ea1-b0e0-0bfceb21a25d", "comment": "Malware payload (Heodo)", "value": "42a64c8a5a717182fc2bf034ba1559ad40a12db5", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647389020, "uuid": "906e3848-4bfe-4ad0-bbdf-46bbe621c3f0", "comment": "Malware payload (Heodo)", "value": "3f2d296b5f166c2b991f96f88918699684202cc1973a75672f105c5216da7c725e2bfb400aa6b4512758acf83395b001", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647389020, "uuid": "ed389799-98ef-49c2-97bd-f109eb29129b", "value": "T19DE45B3071F74031C3AA1D3905D2DE64DAF5AD4B87B2F0D32F99AB4E99F5AC12B20616", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647389020, "uuid": "cc64f39f-faff-459b-abe4-6ca5be5f1eaf", "value": "a38617efee413c2d5919637769ddb6a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647389020, "uuid": "6653abc4-892f-4c21-b6f8-f22b6f67f325", "value": "12288:E94YBCR2xP7guDo463OP4epsiSOZjb2woE+MhJT:2kRAguDogPdddb2woEBJT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647389020, "uuid": "b20bc041-59c0-4f75-925b-ca4d35e34a8a", "value": 684032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647389020, "uuid": "1009bbcf-ec12-4835-8d3c-9ca81319b734", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647389020, "uuid": "7edf3e39-e1fc-4b8b-8983-28147c29be3c", "value": "emotet_exe_e5_13743dbeb64ab1e4108e9e1e354ff8ecba10dfac34ff5a6a5da1c01921c18644_2022-03-16__000334.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9af0fdd-a574-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647468102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647468102, "uuid": "29ff8c16-5b56-4680-893f-5caed975ddfe", "comment": "Malware payload", "value": "af3c8fce55089707d0a8ee12aad62ea2", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647468102, "uuid": "a738c6d7-16ed-46b2-bd20-a79e7271bfaa", "comment": "Malware payload", "value": "13c132557a017d360ea8ecef3a6a4811d79a8d015d12dd4b09eee3d5f0b2b9b2", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647468102, "uuid": "5319ea4b-2d25-4a61-861b-f50d1e9907d8", "comment": "Malware payload", "value": "ec99a6404b7c0ed192f7c0a18f6259afcc16760d", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647468102, "uuid": "d6dd3659-c8a0-479d-bb5e-da0bfeead62b", "comment": "Malware payload", "value": "c8881d5eb3983a879966749d5b0df160e133c06f975e562510c8daeb9f1cbb514577e555cc7c8bb4de0a0a68d40858d1", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647468102, "uuid": "e187e4cd-77f2-45f2-9274-890c7061272c", "value": "T108253315FED1E0D9C34DEF289FDD91AE86098A8D9AF19907400263C8CF2A5ECEC5D935", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647468102, "uuid": "179d9f9b-c249-48ab-80bd-fa159cafd2a6", "value": "12288:3NGWIyzoA3YEooGCko8CK2ZB2ibAjVCM/wkHy0b/k4xsyRL41DhhrmV+0TRt6+C7:dGWIsDbkRo8o6V7HpLi6+Io+CRo3V6t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647468102, "uuid": "dc9af980-5153-40c4-badd-a6b7c5a2b477", "value": 1034024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647468102, "uuid": "ce6cdfb2-dc7a-4643-85e6-85c1ccf97f12", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647468102, "uuid": "fad22b98-9aa8-491c-a60f-0c8fc6a27e87", "value": "Statement Of Account.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d37e1fc-a54f-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647452002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647452002, "uuid": "10cbf15f-dd17-4462-a64d-98ab30a2d1fe", "comment": "Malware payload (Heodo)", "value": "a275a231fc163222153c3d236922959d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647452002, "uuid": "02944fa9-59c7-42f8-8932-7f609c466d4d", "comment": "Malware payload (Heodo)", "value": "14522f7a9e80cdbfbcd5f762d813d4a2a77783e851254594f3ccc7796cb601bf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647452002, "uuid": "49db6b18-9993-4c2d-a85c-061de0b7bc8e", "comment": "Malware payload (Heodo)", "value": "ff96e13a522184f575dfe06f2d46ad88ee19b854", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647452002, "uuid": "0f5e39c4-9faa-470d-9ef6-889957a151e2", "comment": "Malware payload (Heodo)", "value": "1c3dbf4936e144439b14e1231ffc3ff1bcbfcb41a2e96a111e16f7659deddd3f20027de73a8bde415caa6f3f9f0962b8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647452002, "uuid": "2c56c214-93e3-44b0-a5bc-0ca7be382314", "value": "T1C3E47C12F461B2B9D04B04741F1723A86EEF5E518629CA13AFA8ED5E1F31251FC3FA16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647452002, "uuid": "d5032afc-784d-4452-8b49-208c467a53bf", "value": "066d4e2c6288c042d958ddc93cfa07f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647452002, "uuid": "60ac957c-79e8-489c-ac4c-432b4f604ce9", "value": "12288:DtAanana8Meee0GBGu3qI+3DNJ3vE6v5eXxS332d7t5hT/hexLx:Kanana8qGBGuoNxE9xCM7o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647452002, "uuid": "88d35e50-c06c-4ce4-9813-41cb57757031", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647452002, "uuid": "b18686e7-9ca5-4133-9a53-85c720a2cad5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647452002, "uuid": "1a75e964-4bab-4c3e-89cf-83cf3f8939a4", "value": "a275a231fc163222153c3d236922959d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c9796e5-a500-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647418097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647418097, "uuid": "323c8f03-72cf-498c-84aa-81bb5b2b25b0", "comment": "Malware payload (Formbook)", "value": "db60d14caa1c9ca90b0cbc735bfea239", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647418097, "uuid": "d3a3dc7b-deb4-4d7a-8118-b02826d730d9", "comment": "Malware payload (Formbook)", "value": "154e83d504788a5a1a35d1758157daefaed1810f8752601cf4dd5577d626b59b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647418097, "uuid": "9982f1ae-7a26-4c2e-a138-78144f178292", "comment": "Malware payload (Formbook)", "value": "2682190bbb23922d3d6c08d9e8dc580af959e01b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647418097, "uuid": "dd054311-2aff-4e88-95a1-5067975aa9f1", "comment": "Malware payload (Formbook)", "value": "ddb1a1d07a8bd8191df2909272abebfc72bc7664a031e38616816b83c37ada9ff3343b51d5dcf9733b2bc66402d9c4b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647418097, "uuid": "9b97e0c4-ab8e-4eac-a462-6a06657da3b9", "value": "T17F0501E9369C4B57ED25C3BEA579980413B1BC31A462E0199C827CDBB1BAFDC2015F1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647418097, "uuid": "de26973f-1a8e-438f-8927-95b5bd3da355", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647418097, "uuid": "edf4598e-45d2-4802-8e63-e7d6eb3d7da9", "value": "12288:QIuwOEqqiiTXkVH4+20Aj1RpcURayzCHI/Quo7cwLk+yFzgbLDPIbZB5tzp97YBF:BuwODqii7LPzTyduo7BL6FYPIBVXc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647418097, "uuid": "42f554bb-c1f4-45b1-b013-a5b576fb711d", "value": 812544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647418097, "uuid": "4c3baf02-ac39-4dc6-bbe6-f294dd286a67", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647418097, "uuid": "f8498dcc-1374-432b-8d75-90720e2d8cda", "value": "db60d14caa1c9ca90b0cbc735bfea239.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23b8bd0f-a525-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647433947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647433947, "uuid": "a9a28d95-a102-41a7-bf34-cc67d30be3a1", "comment": "Malware payload (Heodo)", "value": "f53444a996db6851ee1b486ac5a2a428", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647433947, "uuid": "245e22ad-0b10-43aa-ac63-e4fadf666a46", "comment": "Malware payload (Heodo)", "value": "188e2a927047eaf6f2f8254d9366ae65971d8db62194c5965cfa86269df73161", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647433947, "uuid": "97f48cca-42f1-4c82-a865-5ae1dbca4281", "comment": "Malware payload (Heodo)", "value": "83906e0c5efaa30e73f7744957c80c2c9c9d3a9d", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647433947, "uuid": "978f78d8-b912-49bc-8090-d2a019b674f6", "comment": "Malware payload (Heodo)", "value": "54747df21f20f2524dcdc40b4eb32855007b4aa4be70b31cda50353af2cf6d40fad72927f6ca48100ec88e868faea1f4", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647433947, "uuid": "57929261-1409-46c4-84af-6f8e028e23e1", "value": "T170E2C02DF2A0EE1DC21EE939446895DA421DB4558502EB4FB95CFB1D2F0A5C23B1F0DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647433947, "uuid": "b355e643-078f-4d4e-99fb-b8222f32b798", "value": "384:wjzZPFhNjqEBOA7iEibbwBLg0SCdiVXUKgUrNU/qWhZOdBNPJM+kqr9eCgh0k5lY:wjpFhNNlizXT28dFfPdkqstJmE6/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647433947, "uuid": "51fedc3c-d7c5-4432-aa71-665e74bbe494", "value": 33750, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647433947, "uuid": "745d33de-a9a8-4c58-bea0-a4c384049ea5", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647433947, "uuid": "dec4d19c-1432-4fe3-86f5-44a97cf2de0f", "value": "Dokumente 2022.16.03_1315.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bf30f85-a532-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647439490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647439490, "uuid": "5a8a25c7-f712-46a7-aa0a-d4b02e8a5287", "comment": "Malware payload", "value": "52695a3864725f3912a405c755f231c2", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647439490, "uuid": "383e9cd6-5087-4850-bead-463171d4000e", "comment": "Malware payload", "value": "18b01c9dd1f9f647d2e42d2edbd1080c83d722425f9a214f3f467fb3a3d68b7e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647439490, "uuid": "6521dc92-4b12-41c3-aa01-6cf53187650b", "comment": "Malware payload", "value": "1c74bcf866c0598b07e926abaa425142ff4665d1", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647439490, "uuid": "8dbc4fd5-c01c-421c-9971-cb5c3466971f", "comment": "Malware payload", "value": "1e96a5e4a919ed9a33d0146a29b552118cb62108689612d41df66f5170c07aa47dc51ca4b703cd0e45f8f52d2dcaf440", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647439490, "uuid": "ab1072ef-3816-4a11-a5a0-3fd1f7e39d09", "value": "T175F21A81BC82DE25C2D423FFBB4E518A33629799C2DF3256C8395B15778A5270F3AB40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647439490, "uuid": "fb6adc9a-b13d-449c-871d-c1f979cbc758", "value": "768:liq35fhf18/ef6bJt6vBEIxOOqsi0CtPjzKyzV9clXQ+zUeFG:lieht8/iqt6lOOqsi0CtPjzxV9clX3vE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647439490, "uuid": "31e4c7c4-289a-4fc1-be23-d3cdc8a7e845", "value": 35108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647439490, "uuid": "32b244e1-08e8-452d-b83a-d448f3550a34", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647439490, "uuid": "ab494bcc-2f0e-4f1d-93f0-269553635e6b", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d51213ac-a4fc-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647416635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416635, "uuid": "e04e3999-4999-4a37-bb06-bfe6c3a1809f", "comment": "Malware payload (Formbook)", "value": "a2b1df94e1dbbecda72e2e1eab655b92", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416635, "uuid": "ac0c4055-ebc8-4008-9711-3841fb2b27d3", "comment": "Malware payload (Formbook)", "value": "190f8004647951c8a6d90c2ba2c77b71216c7bef4dfb22655b21cd75ea386e65", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416635, "uuid": "847d708f-446d-4a9a-bcc6-80b94bc65497", "comment": "Malware payload (Formbook)", "value": "e04266f5080f844943ce2e9a8d166762114c7da4", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416635, "uuid": "0ca64209-107d-4628-a736-f4ea3a5bd7ad", "comment": "Malware payload (Formbook)", "value": "fe5d8a667f198949960d0e7aab5ec719d2ecfb9e3ba362bcb3c51ea6695a45d3d06125efc1ed3d9e6cf5149ae4c2a493", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416635, "uuid": "95249517-a908-465a-8c72-db2f19ee0b78", "value": "T197A5CB31B1327A87C3160561175FBE86430CBE47B2C65F8DA04DFAF82CA6CA79346D5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416635, "uuid": "916ce383-125f-4e2e-a8fd-9230217c0de0", "value": "1536:Jch6dtRGWbCtpl5kmrJ//RFxXxBpzB9TBtiBqK8Qf6YXkY0kY0kY92i3e+6fw5bz:d30E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647416635, "uuid": "b74ef17b-9e22-41aa-a071-460d660e1992", "value": 2172070, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647416635, "uuid": "c3ef4f66-f4dc-45f7-8140-65abf3c97e21", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416635, "uuid": "567c1cff-bca5-464a-aae5-529db4b11d5e", "value": "copia de pago.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0c75bab-a553-11ec-9275-42010a9c0029", "comment": "Malware payload (CoinMiner)", "timestamp": 1647453940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647453940, "uuid": "8903c9e5-1b9c-44b2-a4a0-eefef307f595", "comment": "Malware payload (CoinMiner)", "value": "98f55934672824279e2f1a8916d03389", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647453940, "uuid": "7022e243-1f41-491f-adb8-5b75d023c3d9", "comment": "Malware payload (CoinMiner)", "value": "19199652e05783b730da3acc2f0dc72ae691936d6af5e667ed52455316a30527", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647453940, "uuid": "8597a897-6557-4eac-9c59-d68160d35202", "comment": "Malware payload (CoinMiner)", "value": "c9bf90f92c57aaf44a139e4e86ada3d9732d9606", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647453940, "uuid": "7039c16b-8cb0-4058-8ba8-4a7d806219bb", "comment": "Malware payload (CoinMiner)", "value": "06969fa8b01e3863c3556bb4dfd8b05f710f39640d67cfd09987a93ea58e822d88c52a9698a74c00556670dde6f04dfa", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647453940, "uuid": "32820879-84bb-4eca-8c7d-f2e0ba8ab6a2", "value": "T1E2D302ABFBCC427DCCA847365C23672047B0E9244AD74F5F45EA362B6CA06E84D52EC5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647453940, "uuid": "1cd2cc6a-e156-408f-bdc7-f0017473bf57", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647453940, "uuid": "a4248c32-4a10-4529-a4b9-50a9e9ffcb18", "value": "3072:TS6E9Ko9XPIYaKhzxlIFh1NhfZyHXMcf9618SEgxHf:FUKolPCKZxIfZoMyY15", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647453940, "uuid": "318566f2-130d-4408-8c27-f941465ddeee", "value": 138752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647453940, "uuid": "bd3ff81b-e839-4910-8b20-223094b92009", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647453940, "uuid": "045d2923-1347-4b3e-bb00-41e1e3145aa8", "value": "98f55934672824279e2f1a8916d03389.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44b38be0-a54b-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647450323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647450323, "uuid": "d26d8e81-0c59-418f-ab80-605225d08b2c", "comment": "Malware payload (Formbook)", "value": "156816c3d63d78cc5a39396c1ff3cc1c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647450323, "uuid": "f1862879-716d-41ff-a2ed-ff16a2055c5b", "comment": "Malware payload (Formbook)", "value": "199cc04b9d617b58a11715354df9a83c93416a3906a352aeb21181d65021fdfd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647450323, "uuid": "8d021995-bd1b-469b-ae59-9d360e18c716", "comment": "Malware payload (Formbook)", "value": "46b31de7c2a0e6aa3ce9afc3ec33b1ae89011ef9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647450323, "uuid": "120ac9ff-e642-4820-b4eb-a744facd6526", "comment": "Malware payload (Formbook)", "value": "48c3e1774c8d7d367ac1e1ae12dbed5dbe4ec5e4152e6592c05d3e64a2616eaafacfee55070b0a01677bc1d7f3c17ca9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647450323, "uuid": "8355ab13-6363-4710-87d7-2cc7de2cc0f7", "value": "T1EAF48EE2F651493AC0161638BD5F6AB85C26BF54FD18AD82EBF42E487E3C3C13925253", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647450323, "uuid": "7cace1c1-8cc6-486b-8f95-8fd938b08fc2", "value": "f2bdaf9594ad1018c72c522ae344bebc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647450323, "uuid": "fc43911d-fe7b-4bea-b396-23bb274e6d80", "value": "12288:9X2hBsMWINdoGVgS2/q5x5QOMTvRi2cuWpkzADKesNCqI6F3HAh:9GHeGoGVg7/qn5QTR9LvlZNCqTHAh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647450323, "uuid": "156449ee-0983-411e-90e7-79ba5273bd02", "value": 780288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647450323, "uuid": "82bacd80-d7ec-4a38-8d99-0dd86e804b45", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647450323, "uuid": "60bde8ad-68d5-4f48-b09c-af78b1421d2a", "value": "Current Vendor Payment Application_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "642ab188-a53d-11ec-9275-42010a9c0029", "comment": "Malware payload (DCRat)", "timestamp": 1647444363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647444363, "uuid": "8d92f6f1-3715-49de-af99-6913996c420d", "comment": "Malware payload (DCRat)", "value": "a10d0cec05ea4eebce6e1b46051bbd95", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647444363, "uuid": "60fe67eb-ff1c-4b66-bdc3-75cb57846543", "comment": "Malware payload (DCRat)", "value": "19a9a634a261e2f413f3692ef9ea07b5caeb3a8ef5758a83778be2eeccd7021e", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647444363, "uuid": "d3acafb2-6091-422d-b8bc-c63c22663f61", "comment": "Malware payload (DCRat)", "value": "dea216ebd4cda09f5a70353a05f85515f3c0e33d", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647444363, "uuid": "ce5e22f9-d47e-4013-b7cd-17e8acdc22fd", "comment": "Malware payload (DCRat)", "value": "a0ececf97b47b16c50b581adf06534aca695069cb4b3e0df1162edbb29d39f9807bb70c762936854668a1340da04abfb", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647444363, "uuid": "6c503600-4265-4b07-9a72-b2416d0b5486", "value": "T1662529027A84CA02D06A5737C5EF845443ACBD417A7AE72A7E6F33BD25613A72D0D1CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647444363, "uuid": "bb090057-13f9-4fe6-983f-8b5d87ff6294", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647444363, "uuid": "9caa4db8-81cf-4bef-938f-9a51273e0af4", "value": "12288:k7liGOwEDhjYeCfApqbjpUrtXbmWbjrCPcHVHDzi7iS7E3Eb41:u0DhY7IqbFmFyWb6yVDzTaE3N1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647444363, "uuid": "62ed8502-5972-47ba-90d8-d4f81caf0e62", "value": 1012736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647444363, "uuid": "04df2fc1-a8d6-443c-b3ab-12b0d03ba389", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647444363, "uuid": "af651a97-de20-427a-8511-08c918615c69", "value": "19A9A634A261E2F413F3692EF9EA07B5CAEB3A8EF5758.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05f99925-a534-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647440339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647440339, "uuid": "c168ec79-329b-4846-99dd-8641d884ef45", "comment": "Malware payload", "value": "e4dd37d5075803ac242812fc4a49e5a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647440339, "uuid": "2cfe5dec-087a-40cb-94c4-0068b72aa341", "comment": "Malware payload", "value": "19bb38119e1c7dbdcd9e7eeb16dbd1ea4fc12ba92d2fbfdbfb7b387a21efdc08", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647440339, "uuid": "78fe31db-0925-4611-86fc-67d96f8cf939", "comment": "Malware payload", "value": "b37574a5e1ca1e0606f3fb88fe6455aa8df77243", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647440339, "uuid": "56ef5d81-4fbb-4061-a06c-c7d2bd6127ef", "comment": "Malware payload", "value": "e9a364f9cd729bc89d45f4df45fa7d8aa2e99142cb676f1794db0cc42c4b323d9d43c28f1b63ff26d1ae92ea2b75c9cf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647440339, "uuid": "29b788d1-a863-4864-ab86-e1e147551ed6", "value": "T1382523FC17458E37C3AD097EC99191C96BF6C762B2A3EF7265851AFB809BB5024002D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647440339, "uuid": "b1124d5b-eeb3-4894-b279-3c681ee5fc62", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647440339, "uuid": "326bc2ee-a80c-4d35-a8cd-2b63e1585f3f", "value": "24576:CwOs6pMDtLsPAGENASfPkkCH6o2LVsZS5:Cfs6pMdSAGEKmskI6o2LQS5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647440339, "uuid": "1f65b102-2f5e-4ca7-9f62-9f42ef0da2aa", "value": 1055232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647440339, "uuid": "041cb7b1-9154-433d-a8c2-2c57c7b96cfc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647440339, "uuid": "482e7a1a-b916-4de0-a421-77cfd05a9526", "value": "Pricing Inquiry.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04fd25a0-a4dd-11ec-9275-42010a9c0029", "comment": "Malware payload (DCRat)", "timestamp": 1647402972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647402972, "uuid": "1a00b8ba-e602-487a-8b72-cc02a8de9540", "comment": "Malware payload (DCRat)", "value": "bf39e76f683a4d03651be08412dcf89e", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647402972, "uuid": "0187ae9f-979e-4128-928d-a52644f3de62", "comment": "Malware payload (DCRat)", "value": "1a5d43ea8baa30ff244098b75894e2783583f0e07695d6cf6c5d357a1120c1d3", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647402972, "uuid": "8d284719-bc00-4b60-9af0-9d6c97df978b", "comment": "Malware payload (DCRat)", "value": "d5b98635b152794a395567b50dbc8daa4f90ac16", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647402972, "uuid": "a9f03522-0ccd-404d-a5f4-eb4cbfe68332", "comment": "Malware payload (DCRat)", "value": "3d3ed7650acda50c180745d921b2affcce70d3bb2047febe6de6304f3f1ea9d5345d21b78e0cf3aa73f513d541c3f741", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647402972, "uuid": "6bdb9d1d-451d-49cd-9b3a-320b01cf94ee", "value": "T1468533802355E4B6EBDEF67B4D20412379D668660F08C89DC7E4BDFEAE861903FCA145", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647402972, "uuid": "aa1e9d00-8ed4-44e5-a6cb-9740c49f45a8", "value": "2e5467cba76f44a088d39f78c5e807b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647402972, "uuid": "42525f4e-5e22-4afe-a1e9-5c26e83540e2", "value": "24576:lWOEo5k1LTLosNYZTgXbKQe797LOsQoee87oTyj5/GBEExTQU5sRecxsB8Npjz5F:Uzd3DNXTg9dXeeUoTTWExTQ5p9iDs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647402972, "uuid": "ee4513d0-03fa-404a-b9d4-10b942c4738b", "value": 1830912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647402972, "uuid": "1a218f7a-6624-4a4d-a512-912922e6dfca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647402972, "uuid": "a3e9cdc3-013c-4751-8e23-3f3c6ad54522", "value": "bf39e76f683a4d03651be08412dcf89e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "031c51b3-a556-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647454937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647454937, "uuid": "369ce3d3-afac-4576-a319-6ac4be84f7af", "comment": "Malware payload (Heodo)", "value": "d1d077fa3731522c7a6d270d2f818343", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647454937, "uuid": "4b2e7549-d2dd-484b-a549-9c9714cc4c73", "comment": "Malware payload (Heodo)", "value": "1b29de9daa342e64586e7a1298925a6c6265113f9b6c976c027ae715e9d53748", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647454937, "uuid": "0a3e473d-14f4-4817-a772-e34e3ffbfa7f", "comment": "Malware payload (Heodo)", "value": "f87af05ee61450fe0f6f99527778bd7ff95a3a0b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647454937, "uuid": "b1b1fb8f-7a6d-4715-9951-ae4685021eb9", "comment": "Malware payload (Heodo)", "value": "d1082f763ee33c3efe7d8def4442971af34a6c2a458c08c8167dcf3d62ee2fb5856fd1caa9be54cceb428bba94a863f4", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647454937, "uuid": "8196ad1e-e5bc-4193-92f8-38cb1ff4c16b", "value": "T1DBF4DF1176E1C076C1BF12304956A38D23FAFD509FB986976FD02A6E3EB41828E34767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647454937, "uuid": "366ca577-7a48-420c-bd50-64338ce27ab1", "value": "66a21a1bcb4077b3ed89c00ee693486b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647454937, "uuid": "be212575-4d49-4130-be92-4833e605c281", "value": "12288:g6O4TpP0XjxCCFJuf07j+Xk7hA8rLneTfABCJoWRWwfpW:BeCCF88j+XJ8OTYA7pW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647454937, "uuid": "2fd66bfb-64ba-4ccd-bf68-0788387219a2", "value": 749568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647454937, "uuid": "07d6608a-5c0e-47d4-af0c-038e3775979a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647454937, "uuid": "f9d8d3fa-9a0f-496b-8702-7e4b9c3e7c8e", "value": "emotet_exe_e5_1b29de9daa342e64586e7a1298925a6c6265113f9b6c976c027ae715e9d53748_2022-03-16__182206.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f81efad0-a51c-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647430438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647430438, "uuid": "1088c6e7-d53a-4c10-b872-b00c48b62f4d", "comment": "Malware payload (Heodo)", "value": "fe7125b11be1dffae548cfa8906681db", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647430438, "uuid": "7a632ad3-3453-4ca5-86fb-3faa6751a917", "comment": "Malware payload (Heodo)", "value": "1b6906d379911d2bbb4b53fd9e5577382d4a80f510cbd35e4443844b38e87a1d", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647430438, "uuid": "a232a5b5-8d39-4e46-ba9c-1d8d074bfaac", "comment": "Malware payload (Heodo)", "value": "9eb6fb688c0a6182ba2806decf5a6c8a1d750a9c", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647430438, "uuid": "3721ccbb-07e7-4c10-b341-5519b02905f7", "comment": "Malware payload (Heodo)", "value": "298595f9034243d3903af2d5ef62947bc1c25df5e4247cc03a59d31857b1b0041cb577077191c688ff7d03c8d88db64c", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647430438, "uuid": "e95d2443-1b4c-4767-8ed1-2b7c07b6bd5e", "value": "T172E2C02DF2A0EE1DC21EE939446895DA421DB4558502EB4FB95CFB1D2F0A5C23B1F0DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647430438, "uuid": "9f1b5173-bb0b-492d-a0cc-578c6b4e73ba", "value": "384:sjzZPFhNjqEBOA7iEibbwBLg0SCdiVXUKgUrNU/qWhZOdBNPJM+kqr9eCgh0k5lY:sjpFhNNlizXT28dFfPdkqstJmE6/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647430438, "uuid": "a8c3b3af-5edc-40fb-853a-68a54ab82754", "value": 33750, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647430438, "uuid": "7bd38504-b79b-4216-a33e-686dd6823df9", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647430438, "uuid": "802dc5f5-d3fb-4636-b466-d322a834ee29", "value": "Rechnung-M\u00e4rz-2022.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae037c14-a57c-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647471545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647471545, "uuid": "f8a88feb-a203-4e32-99d4-95aed13f9630", "comment": "Malware payload (Mirai)", "value": "ecf017b8857ef6bfd2b636dc662fe829", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647471545, "uuid": "0d538f1e-3334-44bc-a3d6-3af594eee596", "comment": "Malware payload (Mirai)", "value": "1b85ce4d5e214d1bfc8f977c5521ccd2bffb64908c9f4c98c7e338e5e8fa5926", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647471545, "uuid": "02b8e36d-42ad-4cd7-93d2-7cd46640786e", "comment": "Malware payload (Mirai)", "value": "e61eb32d967e03ee39bc38ae5cf7c7be7d8bd431", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647471545, "uuid": "1ab55edb-d9be-4a55-a54d-b4cd828606ef", "comment": "Malware payload (Mirai)", "value": "4c115f54ad47ce06075d4a0ead338db2f480cc6ce171473fe9eda605fd89ce53b4f3cf47eafee25445a281ee7303ac8e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647471545, "uuid": "3a913801-faff-4c89-8ceb-8027f8bb01d1", "value": "T1D7132858BE8D9A01C1C01076FE0F43897B26C3D4E5FEBF034A26AB583957466AFDB509", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647471545, "uuid": "be1819f3-ba63-4524-983f-57dc8bf4bef7", "value": "768:f9KjJ0mPmvBkvNgWgF6s61UkNlUZyRPCtP7tI/lwwadsCs4Auq:QjJ0GcRQrlUARCNBI/lwwa4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647471545, "uuid": "e6474459-9091-4455-800d-535d5966e5ab", "value": 44032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647471545, "uuid": "1d69696d-3e60-4113-9c07-f485ad95a67a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647471545, "uuid": "b499cc65-0287-4454-a180-d33826bd13fa", "value": "arm-20220316-2259", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37d09321-a54f-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647452019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647452019, "uuid": "3b5363a0-2c8d-4062-8a6a-ee23e7a7bf23", "comment": "Malware payload (Heodo)", "value": "9315f7f47c7f4020134799d6089bdd7e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647452019, "uuid": "97c984f8-c73f-41cd-81e4-ed5d34039586", "comment": "Malware payload (Heodo)", "value": "1baa209e2a4686bf6494aa3283102ae691679fd60d260db76f7f9f30e52c1b48", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647452019, "uuid": "89e6de18-cb08-4e89-95d6-ec19ba52e200", "comment": "Malware payload (Heodo)", "value": "337d821e2389417af53bd681de9873e59c4c2a0a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647452019, "uuid": "99fad795-7163-4aa9-aa42-4f36df159b7e", "comment": "Malware payload (Heodo)", "value": "68f984a57745bb7b49d4a134b63b2fad9dedc4344c00cc51f1f8c6e1ee008a0964f9d15e02bf2dfcb7cb96963ce03457", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647452019, "uuid": "d30e3636-fa8c-4152-bd35-94282b45ccdd", "value": "T11EE47C12F461B2B9D04B04741F1723A86EEF5E518629CA13AFA8ED5E1F31251FC3FA16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647452019, "uuid": "bb0d405c-3d63-48aa-b9f1-b55109489713", "value": "066d4e2c6288c042d958ddc93cfa07f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647452019, "uuid": "361b622a-5259-4db5-aed8-810e9c2e6017", "value": "12288:DtAanana8Meee0GBGu3qI+3DNJ3vE6v5eAxS332d7t5hT/hexLx:Kanana8qGBGuoNxE+xCM7o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647452019, "uuid": "f0fc4df1-65eb-4421-9410-4f0ec5923774", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647452019, "uuid": "764baebb-a03f-4e81-b89a-d35cb4003c78", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647452019, "uuid": "13afb10d-a5c8-4122-939e-220d50ed14ff", "value": "9315f7f47c7f4020134799d6089bdd7e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2b64c5d-a53b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647443663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647443663, "uuid": "33cf6323-bb7f-4853-822d-5ade9f62e221", "comment": "Malware payload (Heodo)", "value": "330f97165afa5ff4edfdf45cdeaf5034", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647443663, "uuid": "ed39c020-1f91-4b3a-b4ba-3ae6d89267c4", "comment": "Malware payload (Heodo)", "value": "1ca3f11e95f36f83a3b12e8e355de3ae41ab841b9fc1874df2068842095397e3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647443663, "uuid": "2a4aca3e-c407-453b-9307-758eb179f0fc", "comment": "Malware payload (Heodo)", "value": "b52a323ad0726bc508568bb8e96dd9b1a2a1a023", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647443663, "uuid": "b745946e-94bc-45c1-9c60-7c7d6abf3c7d", "comment": "Malware payload (Heodo)", "value": "b68d0c5f152234b0aa0a950d5c2c2f74cba43d7cb081ea5b23e0b5a6956f07bc0f3ed26569061c3228dba9772557095b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647443663, "uuid": "330d26ec-a5d0-48de-9cdf-38c4beb4447a", "value": "T18CE47C12F461B2B9D04B04741F1723A86EEF5E518629CA13AFA8ED5E1F31251FC3FA16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647443663, "uuid": "a677c2df-6758-4b8e-89c4-f698ddb6ca97", "value": "066d4e2c6288c042d958ddc93cfa07f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647443663, "uuid": "dd243693-37c1-4dd7-bdda-5cdeb7290e46", "value": "12288:DtAanana8Meee0GBGu3qI+3DNJ3vE6v5eIxS332d7t5hT/hexLx:Kanana8qGBGuoNxE6xCM7o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647443663, "uuid": "31a77a18-109f-4fd2-8bf4-43b174fd6d35", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647443663, "uuid": "f827fcb7-264c-48ba-b430-af648f4ab925", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647443663, "uuid": "1da71eea-6bfb-4225-a22d-324fef2581bd", "value": "330f97165afa5ff4edfdf45cdeaf5034", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d603425-a579-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647470175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647470175, "uuid": "b9ce2114-a34f-4b96-b9f8-bf78ca71149b", "comment": "Malware payload (Heodo)", "value": "0317e281af45604879e964c3ac6ab1fc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647470175, "uuid": "c2446ab4-cd4e-42ae-bd5d-5ddb88614750", "comment": "Malware payload (Heodo)", "value": "1cf176111a9443648a37e34910fc07aad86f3242dc13c1765a1f212b11cae020", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647470175, "uuid": "4281764d-d161-44f0-ad14-e66467e1a946", "comment": "Malware payload (Heodo)", "value": "36716012d66f10a66085e47aba7d9b470c30bef4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647470175, "uuid": "30726c52-48eb-4076-9fae-aaadb72fb532", "comment": "Malware payload (Heodo)", "value": "327c17c5cae382c8b0e17f33e84cf00d151d6539e73381ecac336de2ed1147d6b2c9f3c5a90444ea6c1ddeae799f5ecc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647470175, "uuid": "4f72cbe9-a174-4465-9f7b-808afedafa66", "value": "T11EF4DF1176E1C076C1BF12304956A38D23FAFD509FB986976FD02A6E3EB41828E34767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647470175, "uuid": "02d22303-3bb5-4855-976d-af81c39a718d", "value": "66a21a1bcb4077b3ed89c00ee693486b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647470175, "uuid": "aa62972c-4a12-4eec-8c01-dbb7f7bad22e", "value": "12288:g6O4TpP0XjxCCFJuf07j+Xk7hE8rLneTfABCJoWRWwfpW:BeCCF88j+Xh8OTYA7pW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647470175, "uuid": "166caad7-8114-45de-9030-4c7c07bc964e", "value": 749568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647470175, "uuid": "6a507f12-49d6-474a-a904-4bed8930249e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647470175, "uuid": "f6021caa-b164-46f0-95ed-1a0f7ebc09d8", "value": "0317e281af45604879e964c3ac6ab1fc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cdf005d-a532-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647439492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647439492, "uuid": "3ae9314f-76ab-4255-b486-48671fb71ed6", "comment": "Malware payload", "value": "c99db0e8c3ecab4dd7f13f3946374720", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647439492, "uuid": "a2d5dd15-e90e-42c8-9b85-6f84aa73c90e", "comment": "Malware payload", "value": "1d4b878f58d2576fc06be0bb6403bee99a675d6bdb2bd90bb8d0635803d278ae", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647439492, "uuid": "a7e75056-febe-4610-b7c5-d64e460c50fb", "comment": "Malware payload", "value": "d7d58756c404287c6bc99e74c506b74873e1d2ce", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647439492, "uuid": "6afbe7c8-6a0a-437f-af04-c5f4eaba9bf4", "comment": "Malware payload", "value": "3623ff79fdf0db5e4dd8aa80f520eb32d213833268711461dda738ce203f4a9e7c65fe06e36a3745a426c9baa2e43795", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647439492, "uuid": "5114ed2d-af48-4465-a67c-ccb7780ccd22", "value": "T1FA633949FD81AF10D4E522BAFF5E518A33131BA8E3EF7211DD216B2167CA91B0F7A501", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647439492, "uuid": "d8e51300-8bd9-40ae-b2d6-53185edec508", "value": "1536:MQnkMfTpfbEu+dHzHpc1Lsy9sYF94DPNlu9ihZCv2zM:dfTpfKmLsy9sYJWZCez", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647439492, "uuid": "46ed1f8f-54f3-4b29-9f6c-129bedd8f660", "value": 68280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647439492, "uuid": "2ac4f23e-e852-42c5-abd3-8d6b03d160aa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647439492, "uuid": "b0ae7959-46ff-4542-a09e-39384b80980b", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d02ce60-a4fd-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647416944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416944, "uuid": "16edd47f-83b3-4044-8791-094216d3b1cd", "comment": "Malware payload (AgentTesla)", "value": "5ecab0e4c377e27de5171a835544001b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416944, "uuid": "c7f043f7-7ade-448e-b2a1-f37ba75ef8f9", "comment": "Malware payload (AgentTesla)", "value": "1d7357578da421a09c23a0fe457b6e128ba52e5b825664e83576144d88e462a4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416944, "uuid": "31e37b72-0567-4d6f-9708-51d7edc4842b", "comment": "Malware payload (AgentTesla)", "value": "fdf17d4379f212d3f13ca906a5da5b37913d1fd0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416944, "uuid": "db6cb4e4-974a-4581-b120-75417083ce11", "comment": "Malware payload (AgentTesla)", "value": "c91a37242f65d214657d4dbf710f2322d9b5ee140383bfbd53e9ed10a1df177186fd3f84054d83ed5dad2f24c8b339f7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416944, "uuid": "d5b2b86b-b6ec-4b0d-a9d6-4de5b07b758c", "value": "T18A05238633748B65D3FF6E36E8B415064772F971B962E3046EE5ADE628E370005207EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416944, "uuid": "c5d96b46-e11b-4a52-a20a-05774cc14023", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416944, "uuid": "99ed2101-1618-419b-bbd2-432a40c64927", "value": "12288:8FIwOEjOQ7O621C84XaUbR/pBO+3q74w/Bq5IcEct+dIQqkiZVD+X4:SIwOOOcO6tL/pBRO4cKIYjdZVD+X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647416944, "uuid": "672b4dd0-a178-4f58-a5bc-d62ad9bbe50e", "value": 820736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647416944, "uuid": "6f49d8be-aadf-4c28-9474-d807216e27e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416944, "uuid": "c8bd80ce-b821-48b1-bc93-d93a413bb60f", "value": "AWB.invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db5391b1-a500-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647418363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647418363, "uuid": "75d9aa8b-d9e7-4d39-8d1c-9d409ed066e9", "comment": "Malware payload (Mirai)", "value": "7d2284a3ce786abb5f8ffa73c95f6c78", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647418363, "uuid": "c977f869-0dd5-4238-ab2c-262af71cf66a", "comment": "Malware payload (Mirai)", "value": "1d9f40dfbb378214c9252b9a82023693ba782facab775be921d2e3435646ed56", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647418363, "uuid": "e0d30893-dbc7-48cf-beab-b69df3ee31c8", "comment": "Malware payload (Mirai)", "value": "37ff9d386c8b00a1348e9607788655eb2315a58c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647418363, "uuid": "779d161d-9ca1-43a4-86d9-41445e49bca6", "comment": "Malware payload (Mirai)", "value": "dbe9cf69a589345b27a69a3eb150af795c0e933c276357e1b0062407c76118431b8e5d397a3db12201c64d8867d7354a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647418363, "uuid": "75eef955-9894-4aba-8cf7-9b634472cfaf", "value": "T1D0E2F1E58A9C68F6D9B13D34F79895D3B3691128CFF171D0F21401A8A8B306A9A7CB53", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647418363, "uuid": "cd948ac5-0dd9-40ac-b0ce-bf9e7bdab7fc", "value": "768:hU6ZFgluJqQ1nhWlkf7Xv6QflpgEAw1rYznon4pu4Fk3UomN:hpZFg01hWl+/7lpgXwNkoP4FN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647418363, "uuid": "45cb8e2a-250e-4469-bcaa-e6b0ac684630", "value": 31316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647418363, "uuid": "e6f0290a-c3cb-4b2f-af0a-5e8ea57ccf49", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647418363, "uuid": "a402fee5-d7f8-4590-9d75-ac4f99cb55cf", "value": "7d2284a3ce786abb5f8ffa73c95f6c78", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4839b87-a541-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647446269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647446269, "uuid": "d199dbcc-9a0a-47fe-9a7b-5fb310b02569", "comment": "Malware payload (Heodo)", "value": "303957a6f6941fba46ab9f128e06d0c9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647446269, "uuid": "0c9e82e2-1413-4cea-bb4c-a64f65062bd9", "comment": "Malware payload (Heodo)", "value": "1e030c837f819b2b54dc047524c5a94c66170afa4ad202d291e75a79ebe39f4c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647446269, "uuid": "ae52410d-a5a5-4e02-b376-f3e0916f1394", "comment": "Malware payload (Heodo)", "value": "82738d9d44805dd71127acdc89ae9b3cd46dec43", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647446269, "uuid": "a5cbb7b4-46ea-4f9e-994d-73ae6bbb23b0", "comment": "Malware payload (Heodo)", "value": "5634f356eba47a7000b9a98678e355e51ca954fadd84289687081e6c813535064e016fba1775e91be388321cb597dd8e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647446269, "uuid": "2e3a999d-b6e7-417c-bd61-66bf5dddb94d", "value": "T169E47C12F461B2B9D04B04741F1723A86EEF5E518629CA13AFA8ED5E1F31251FC3FA16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647446269, "uuid": "392c18ae-8b47-4b56-b326-d2db75a3b59b", "value": "066d4e2c6288c042d958ddc93cfa07f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647446269, "uuid": "f60e4192-9102-45a4-9d35-2e061e303b01", "value": "12288:DtAanana8Meee0GBGu3qI+3DNJ3vE6v5eMxS332d7t5hT/hexLx:Kanana8qGBGuoNxE+xCM7o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647446269, "uuid": "e1fdf5f5-2d2e-4504-b1ee-d6288326ed2b", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647446269, "uuid": "7e656ce8-b1a5-4e75-8b44-4083e785d742", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647446269, "uuid": "2a44d951-6fdd-4f8e-93ca-b3391f55c24e", "value": "303957a6f6941fba46ab9f128e06d0c9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cd8e516-a51b-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647429640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647429640, "uuid": "93dca301-6db5-4157-9228-2efd49818270", "comment": "Malware payload", "value": "42e2b6e4fba51ec71235e28ddff27a76", "object_relation": "md5", "Tag": [ { "name": "CaddyWiper", "colour": "#AC43C6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Wiper", "colour": "#614E92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647429640, "uuid": "6951607d-d680-4d1f-8341-816cd04d39f2", "comment": "Malware payload", "value": "1e87e9b5ee7597bdce796490f3ee09211df48ba1d11f6e2f5b255f05cc0ba176", "object_relation": "sha256", "Tag": [ { "name": "CaddyWiper", "colour": "#AC43C6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Wiper", "colour": "#614E92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647429640, "uuid": "8590a1ba-0bd3-40c4-be12-3af345f7b485", "comment": "Malware payload", "value": "4f3362ebac2503906179bd7c002f573886fa85a5", "object_relation": "sha1", "Tag": [ { "name": "CaddyWiper", "colour": "#AC43C6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Wiper", "colour": "#614E92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647429640, "uuid": "545cbb6f-8d68-47ac-8648-8733a48d8806", "comment": "Malware payload", "value": "cd552e936a36fbfd7f16bf1e8cdd882a32a626f59983fc2a021772f90e064d17fb41ba950ea42871169a9cf8c795dc7f", "object_relation": "sha3-384", "Tag": [ { "name": "CaddyWiper", "colour": "#AC43C6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Wiper", "colour": "#614E92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647429640, "uuid": "bbf24f7d-adce-4e8f-b7af-b2c5af296429", "value": "T11AA2F8718618A891EC55987031C4DE2B6DB03370A68F806BB3DA89905E807F776BDF5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647429640, "uuid": "f49334d1-bdae-4ac3-bfc4-7f3edb8ee500", "value": "ea8609d4dad999f73ec4b6f8e7b28e55", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647429640, "uuid": "1118cb4a-d22a-43ca-81e0-67f89d9efef2", "value": "384:B6fPWl24evFrT2ZR5Cn7UR0VJoNVPB0FhKs9wMPB0YdVhiL:B6fQ24ArTUR5C7Tc8hT1VhiL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647429640, "uuid": "909696d1-437e-4454-99e1-19a7772c8bf9", "value": 22040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647429640, "uuid": "5291df4f-02f9-4628-9d39-7f94b20127c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647429640, "uuid": "2d643d16-6d79-45b6-8730-55e38f414302", "value": "1e87e9b5ee7597bdce796490f3ee09211df48ba1d11f6e2f5b255f05cc0ba176", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d27f1fb-a582-11ec-9275-42010a9c0029", "comment": "Malware payload (CoinMiner)", "timestamp": 1647473960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647473960, "uuid": "964d6c84-962f-448c-bd3b-2a8b14805b34", "comment": "Malware payload (CoinMiner)", "value": "4efd64539b32974def95fea519bbd18f", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647473960, "uuid": "8eb94bad-1445-444f-b7bf-b17bbc557b52", "comment": "Malware payload (CoinMiner)", "value": "1f35b5b7b538b2e4bd0200711d81cddf2a7f60a52e449e7fbe2c8fa313cdcf58", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647473960, "uuid": "0857f6f9-d03b-4174-a938-57c216ed66ae", "comment": "Malware payload (CoinMiner)", "value": "8b0020a64006ccf4588d85ec8523493475b814f0", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647473960, "uuid": "774ec00b-70ca-4515-a2ad-ede4cb9b4f33", "comment": "Malware payload (CoinMiner)", "value": "d67e4656e99a1b3cfa14bb105ccc179670d0a6c3582f21a5432a8b3b7534c281f27f37bfa9581d7a69a538e4ac2def53", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647473960, "uuid": "86241945-523a-45b5-81c8-91d27cfdcdf7", "value": "T1C6E63330E485EDB2E93164B419B5E242556F7EB00A35859F934CB0BD1AF3B81A2F0FD6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647473960, "uuid": "65596333-1910-4106-bcc0-a4096372a5e0", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647473960, "uuid": "2f18f69a-823d-4392-8e6a-c4cbbff3b712", "value": "393216:jmZLQUHlNyVbC2FSaBI24d3//vb1pbwKH+Jqqae0BFLMZNUT9zCV:jyUUHlgVbCbS4d3//JpMKHwqq27LMZNx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647473960, "uuid": "b0036691-0c1d-4cae-8507-07a7c9cc591a", "value": 13971612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647473960, "uuid": "82ca567d-3d51-45ca-994c-68f0a1e456b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647473960, "uuid": "c4e41f77-9d61-4cef-ba19-1b000906b4bf", "value": "47258856.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "daffe171-a50b-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1647423087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647423087, "uuid": "b0404f8e-0d91-483a-9a68-a9e67e1875e5", "comment": "Malware payload (Loki)", "value": "f3db1c767d46cf6eddf8409134a0d5a9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647423087, "uuid": "a5e4e135-73dd-444c-b582-98396764d283", "comment": "Malware payload (Loki)", "value": "1f7de270de983863bc7d6da4b44ef251cee61011150fafcea84212ba169d03e9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647423087, "uuid": "39d2f392-4525-4b52-8aa5-9ebfb3b4ae16", "comment": "Malware payload (Loki)", "value": "fcb7d42d323ec9a5567e6be05b9f25e90a12136f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647423087, "uuid": "b5fe8668-8e95-43e0-9f71-24b5fb60fc1d", "comment": "Malware payload (Loki)", "value": "a1bfcc4bea7f1732b8898e72548b07f3c820c8a3a6bb30432e7190914cb25edc1432b63e165605f55257f8f8c9cd6765", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647423087, "uuid": "461f0856-c8ac-435c-8729-b9bf8dfb4127", "value": "T15DC40296F990CA63D3E8417858FBFF3C473435C44E11450773982E6D7EA27AE21B126A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647423087, "uuid": "f41f0882-fdf5-4d38-9d44-8f4fbfdf2ae6", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647423087, "uuid": "90dbd66c-e0d2-4eb2-80d7-f54dbac16dd6", "value": "12288:yYUggf6UgLMo80gLHV0SUmxg+Aikk80Y4S:i9gLMo80gbVpUmetkP/S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647423087, "uuid": "18e80dcf-fbb8-4c83-8907-3f6fcdce8373", "value": 543320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647423087, "uuid": "b40205f3-6cb9-4f18-a915-07175d65635e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647423087, "uuid": "367f4eeb-c2ed-488f-aab7-2793d26b87b2", "value": "f3db1c767d46cf6eddf8409134a0d5a9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b96693a8-a4f4-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1647413153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647413153, "uuid": "7b1b7d02-6ebb-43e5-a060-b1e8c729fa45", "comment": "Malware payload (SnakeKeylogger)", "value": "6c966492a8dc530fc5147aea44782ba9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647413153, "uuid": "7b86db0a-5a8b-4adb-bad3-c3fb470d647c", "comment": "Malware payload (SnakeKeylogger)", "value": "2154b72f46d276ed71a7661cffe311ce5623bfb52602be7a400f2ec25ac230a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647413153, "uuid": "00c613bf-6b0b-4633-b071-13e7ca5ec7b3", "comment": "Malware payload (SnakeKeylogger)", "value": "45ce42182f24cdbfc4c66da6566ec7fc8fb84613", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647413153, "uuid": "e75a932a-89a2-43f6-9097-0dcea6253efe", "comment": "Malware payload (SnakeKeylogger)", "value": "d758753e858f705bf3454feeba6483e9dc19ceb6621db4170cd82e80ab11b7353a3d6e43aaeb386eac7dd04be9b9f51e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647413153, "uuid": "0c9e21a6-d225-4ec8-9620-76db753a3bad", "value": "T1F415DFAC32D07D9FC523CE76CA652C20AA3174BA6707D2039107159C9A5DBEBEE117E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647413153, "uuid": "787bb3a4-9c32-4dd3-9cfc-61058a358431", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647413153, "uuid": "c0b16ed5-56bc-4f8f-8830-fb6c7a3d85f4", "value": "24576:iEoJwOJU/BJhEB74hmuiUhveFvnds3SB2:iEYfJUSB74hmshuG3SB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647413153, "uuid": "593776cd-72c0-4382-bee1-c55b27930390", "value": 930816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647413153, "uuid": "b93d8301-7336-4ae1-a520-010b163ede55", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647413153, "uuid": "3f70aca5-a9f5-49bc-8392-73d90c4173af", "value": "Product List.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe531d3f-a527-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647435173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647435173, "uuid": "ecf5f3c2-b788-4193-9ac5-1f22de731c37", "comment": "Malware payload", "value": "72b9aef6be3d349c8e1c3918c628e943", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647435173, "uuid": "85097a94-3dac-4907-93cb-f0b734d3e160", "comment": "Malware payload", "value": "221ceb6f282dc7194ee4afb1cc6f2286c2e3f621970903646a90217137eae20c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647435173, "uuid": "7a48beb0-1cc5-4997-a11c-afde34e88806", "comment": "Malware payload", "value": "bc3deea63d8cd37e8b4dedfc183559e048426d21", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647435173, "uuid": "d55407cc-a28a-4302-94c5-36314f232cb3", "comment": "Malware payload", "value": "8d1e7ac4eda888c3e3b2e64a0100eb8f996b516d8c3206ddbc959d5aa04a526dd525faa369d28a56e0114189dc4cccd9", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647435173, "uuid": "274e783e-bb2d-4746-b31d-b4c27ffa2b1f", "value": "TNULL", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647435173, "uuid": "eb9a573a-5c07-462b-a2f1-1966808091ef", "value": "3:HOPTCIIc:H8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647435173, "uuid": "0557c316-e951-47d7-a695-a0b5d54e8ea9", "value": 31, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647435173, "uuid": "1c5236eb-84de-48da-9cfe-e09e4fcd8ba4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647435173, "uuid": "63d0e6dd-c1ae-4f8f-8638-e98220fdc706", "value": "asd.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1aa79c10-a518-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647428348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647428348, "uuid": "8dde9768-e4c2-4f16-b89e-9b4f9d95ece1", "comment": "Malware payload (Heodo)", "value": "7ceaac2752dc8d2af4bff28cd6545844", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647428348, "uuid": "1b65558c-4b9b-4f2b-ae82-7333e22a3b76", "comment": "Malware payload (Heodo)", "value": "2247c901fb8fa444a30b20a2d1fbac923b47c46a898f57b047e466344f97bced", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647428348, "uuid": "f9f3fbb6-08a0-4cff-be8d-5e8a0f0221ec", "comment": "Malware payload (Heodo)", "value": "47f41e35e21354bf420fe86f4a62efcb428afb4d", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647428348, "uuid": "3d26313b-f4c8-44c9-8eb8-ed8205e9097d", "comment": "Malware payload (Heodo)", "value": "91c441f2f0c43983d02fbba91b73930213266e6427774969363eefc9d4ae578c1f4a83eff570ba52ba52adca44eed140", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647428348, "uuid": "7e9110db-47cb-4cf8-a0fd-2bfcf5e59b14", "value": "T10CF2CF2DA3A0EF5ED61DED38849881EA421579154506EB4FA85CEB0D6F493C33B1F0DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647428348, "uuid": "6914dd0e-d45c-45f8-91b0-ed7370923f7e", "value": "768:sjFhNKbeXizXT2LxdFfPdkqstJ1goE6vS:sBTGeXgXUndkqegoE6vS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647428348, "uuid": "8e201e92-25e0-436d-93d7-90fc0fb3a949", "value": 34391, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647428348, "uuid": "1fd1795c-cdfd-40d1-840d-314c8cede758", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647428348, "uuid": "c5f939bd-926d-4d4c-877d-609696b46bed", "value": "Dat_JC5H6NURP.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1105902-a4f7-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647414427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647414427, "uuid": "34e2952e-96ca-410d-88a1-e0d4dfc424c1", "comment": "Malware payload (AgentTesla)", "value": "ce78eed4e3a4eb1eae1488e739f858ba", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647414427, "uuid": "05b147ff-9af3-4327-b32a-0e30e4f75e17", "comment": "Malware payload (AgentTesla)", "value": "224bbbc912c40294811c705b9fc49e3a9b88b766d04b46665e40fe0b3ec8cfca", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647414427, "uuid": "3ff8d2df-1193-4d90-a4df-d397358d59ae", "comment": "Malware payload (AgentTesla)", "value": "c8eec6df7fb2ece00ed6f5930b063db10778388d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647414427, "uuid": "edf2e120-a32f-48ab-9e61-a23701f18689", "comment": "Malware payload (AgentTesla)", "value": "275d4e81204fb096a26a8b3d40b98c55810d388d8a17ee8c4f50f3189dce8b94ffc488859f1505935d0cef31870b1029", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647414427, "uuid": "a9afc8c8-21be-453f-8cbd-2af148d76ba4", "value": "T1FE05220233C4DF26C7BF877AE4A401150B76EB663212E70E4FCAA4EE4DA7F5549112A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647414427, "uuid": "e2bce083-b008-4a00-b5f9-3bf4eb8f082b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647414427, "uuid": "d99ff926-488a-42e0-9540-0cf64293ce81", "value": "12288:aAMVwOEDIq1emG5ZHun+YQF2K9gldkTiG1J6EbNfm5HHnMkEbIISEjtlB0y:xMVwOdRAwl9g/8/NsnnMNI4z1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647414427, "uuid": "1894b9b2-55d6-4e87-8377-ed62f003ad9f", "value": 800768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647414427, "uuid": "c9fc0b94-1f90-4c80-980f-195658111ec6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647414427, "uuid": "b06ce680-b933-4a38-8683-326d43d2152b", "value": "NEW RFQ CS895.....exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25ef7ec6-a560-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1647459291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647459291, "uuid": "d00ebd04-e7b8-4e55-ae67-1ea522978723", "comment": "Malware payload (SnakeKeylogger)", "value": "bf7b212165983b6aa5ccdb9a9a80560d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647459291, "uuid": "7214680b-5300-4764-951e-18f79e0877ab", "comment": "Malware payload (SnakeKeylogger)", "value": "2261294bda005d6082bd1c80564f33e4fa0547012d6a246df15ba88bb99d3d8f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647459291, "uuid": "334dbc20-91d9-4c85-ae94-1c4529d93320", "comment": "Malware payload (SnakeKeylogger)", "value": "ecb42d9beaff4839bd9cd2620a9f2b32702810c6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647459291, "uuid": "22a24e9c-7276-4ddf-862f-bee9e80412fb", "comment": "Malware payload (SnakeKeylogger)", "value": "4b603ce7f68378051a9bc6cbf152c3c7220ea8467ab1076313e9a2cef27c8f6bd7e18b1c384bae7cc7d7c59427866038", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647459291, "uuid": "0df06fc7-e710-48a6-a0ed-c90100eec579", "value": "T1064308D37B88478AD8144D3A6E7B4E204E37BF25AD06BA1D6584F35F0FB72C06A13654", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647459291, "uuid": "14a2846b-8c78-4d57-8356-4c4d672537d4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647459291, "uuid": "32568adf-e60f-4003-bca4-ffb386d68f2c", "value": "768:7HZlCL1a9M3Rx7hHqfR1D22Hk3L46v5F77AOAy1B:75kNhx9ER1tKMeF77iy1B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647459291, "uuid": "d8944f6e-dac2-4bf8-b4f9-da56f5fe79e8", "value": 58880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647459291, "uuid": "f5698f9d-cfe6-4e6b-8b93-c23c47bb6b7c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647459291, "uuid": "d3e3fa8b-e9ef-4d04-8a2c-3f8907a7fe7d", "value": "PO_212326.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9658cbd8-a50d-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1647423831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647423831, "uuid": "808e2e50-2150-4006-970a-e4ee1ca0490e", "comment": "Malware payload (Loki)", "value": "d48904eb00999116e0bd2e687c7cfd50", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647423831, "uuid": "eb42aa0c-8aa5-4c12-a276-b2dab936cd3c", "comment": "Malware payload (Loki)", "value": "22ff7c3a4636b829c6abca1918887cd944c9f723db86a530b4fa903d4e834105", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647423831, "uuid": "f7d21acf-6009-4812-a57d-6c7c7133c1a7", "comment": "Malware payload (Loki)", "value": "0093b4ef7dbb4e88af4e41cccb97f37b3f5eceb3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647423831, "uuid": "47bd594c-b1f8-4d68-a2e8-a6151d8a7875", "comment": "Malware payload (Loki)", "value": "d84959b871b799b78a8cd9d731ab8e0fbe017f2e09911f3ec75f396ad13e07ab1c978fa73f07b184833b29b9fbd14bc1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647423831, "uuid": "974e8b89-2a97-4863-a798-2b803fddf588", "value": "T12254130E61D1EEF7E4E4517115B3EB2AE9FAFF88061C3469833C4BEAADD158B14008B1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647423831, "uuid": "177ff156-8b20-443f-8f3b-2f9c4f14fbfb", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647423831, "uuid": "00034904-bbc0-48eb-8529-030f6017f9b5", "value": "6144:rGiX5YCcXvj354l/oUOwn7ma8LcB4FZCDp8LTksFxTDefth9SqcO4I:CZ7pez75RObqp80sr3GqwX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647423831, "uuid": "813b4188-d37f-4808-b716-bc0170aebe05", "value": 300121, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647423831, "uuid": "07a479a2-ead7-486a-af12-bf45bf1ea2be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647423831, "uuid": "019a367b-27b3-4285-bfd2-4c054332a055", "value": "d48904eb00999116e0bd2e687c7cfd50", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f6f97b8-a4bc-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647389057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647389057, "uuid": "c2cc3794-f81a-4c39-99f1-8b24890e964d", "comment": "Malware payload (Heodo)", "value": "6b0ef8488596641c8ed5c43869632305", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647389057, "uuid": "2edd9551-20fb-484e-851f-b9eaf9ce591a", "comment": "Malware payload (Heodo)", "value": "22ffa04e482a37b9f753341cc8a60785ae7aa1f84a8288bf8782d992237d66c5", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647389057, "uuid": "194cb5cf-2e31-4664-b401-56d366426524", "comment": "Malware payload (Heodo)", "value": "736dcccf6db2a762390dd904873d741f6760ebb8", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647389057, "uuid": "be1fc2a8-39f3-4995-bc6e-32505de638cd", "comment": "Malware payload (Heodo)", "value": "e8d23348673f149a32e2ee0c19a7d6e27bfef3a75297473a8ca065ee8ef3e2e72a6072f629292e7e1cb8dc979fb17300", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647389057, "uuid": "f8d4b18f-6b8a-42b0-b9ac-a9ab6c1ac0cb", "value": "T1B2E46B0124A29C71C3E7C9756BD91E1539EAEA92CFF7800BBAE06B7CD874942C337516", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647389057, "uuid": "568a0b22-8ec5-436d-9d3f-ab7bb799cba9", "value": "a38617efee413c2d5919637769ddb6a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647389057, "uuid": "ffd03516-7522-4f1a-9c03-a3b12e7e3954", "value": "12288:KFxGsTPy4BHT4Sj1zfnf7ABqDLkWynCsZ:obPy44Y17f7VDLkNnh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647389057, "uuid": "4a1a0162-08ea-48cb-bb68-f724d13a998b", "value": 704512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647389057, "uuid": "cfcec82c-1da2-4e06-a3f8-0bc27a3118bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647389057, "uuid": "cddb192b-51a5-43e2-8c19-0e29ba78d20a", "value": "emotet_exe_e4_22ffa04e482a37b9f753341cc8a60785ae7aa1f84a8288bf8782d992237d66c5_2022-03-16__000412.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e13ad385-a4fe-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1647417514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417514, "uuid": "19133138-0feb-4306-ad2e-6926e60227d3", "comment": "Malware payload (SnakeKeylogger)", "value": "cc4b4add6776473ab921a38b47dffa09", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417514, "uuid": "83f28c8c-c28b-489e-8a56-2a28ca590166", "comment": "Malware payload (SnakeKeylogger)", "value": "233723303c07f6d326408f0ed8c14a43bed577e65f1a05dffb537c253ce03383", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417514, "uuid": "885ea655-9a30-4aa6-8201-eb878067f394", "comment": "Malware payload (SnakeKeylogger)", "value": "a5f25cceb631d49523b88c18ec44afabef40000b", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417514, "uuid": "c1d3eae5-acd2-475f-9200-d633fc3db61f", "comment": "Malware payload (SnakeKeylogger)", "value": "a04dbae46fb5eb2a21e9f7c8492eaa1cc2160eb702935a47783da3234e4336509a84210c32db2b10ba7ca107aa396d52", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417514, "uuid": "8d2a1a77-a4a4-4bee-898b-819bd26b8373", "value": "T11D44127E5B567E33CC5EC6F200552755BBF09390D932F7259F8621E6133BBE06888A02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417514, "uuid": "78415226-dfe3-4106-a64e-bc3766b7ec71", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417514, "uuid": "75bb1523-9a9b-4b7b-a8f8-5d74aca5295e", "value": "6144:G+j6G1MYICxnVHvBjf7WV5pRzM+KKoEKnY2l:G+jSYPxNvBj7IpKq8Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647417514, "uuid": "4fb20d37-c205-4ca0-aabb-50e8821028df", "value": 271872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647417514, "uuid": "f2f6c02e-9430-4cd2-b0eb-c032299c750e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417514, "uuid": "31ed0484-ca3f-4a07-9766-3b27c28bc0d6", "value": "DHL shipping documents -pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0aef80de-a532-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647439489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647439489, "uuid": "0be144dd-4f11-40e8-af1a-7f2fbeedb51c", "comment": "Malware payload (Mirai)", "value": "45508b486c1af4e7c11a753632715ea4", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647439489, "uuid": "94595d3a-4011-4814-bb9f-1b83a43a9d3a", "comment": "Malware payload (Mirai)", "value": "23a170cbf567895e81feeddfc9ce427879e7162173f4d8c58ec1e752be0b68f0", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647439489, "uuid": "5c8abde6-6c52-4936-b585-6838b4f38f34", "comment": "Malware payload (Mirai)", "value": "e3d455e3ae6ad91ac64ed787315a5a8943bd7049", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647439489, "uuid": "0f2bc508-9748-4c1a-b02c-7c8bf7917235", "comment": "Malware payload (Mirai)", "value": "5833d9ca0367294e59b74232a8baded288cc52114256fda92bf013e0f88fdbb31ba05ecbbcf5c7b0d333866a62ace897", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647439489, "uuid": "2dfed41a-5bbf-4e91-9283-8a4e6ba344ef", "value": "T1E4F24AC9D683F4F5FC1216B85873F7395F72F13B0068E957C719D971A892A22A20B25C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647439489, "uuid": "612e2ac3-5c60-45b9-a756-908d5d769393", "value": "768:NqKY1xhbg1LAAjh535jy2fDs4r7nByIP11oYo2tHoRM:NqHxoLJ5pjy2fIsByM16Yp9oR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647439489, "uuid": "1c3199fc-76a0-4fcf-a3fa-924dd67d3174", "value": 37644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647439489, "uuid": "220902f9-e441-4ba1-898b-c5ad95bc58c4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647439489, "uuid": "af5554e6-e268-4596-91d3-7ac2c14182a6", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a711756-a4fe-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647417342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417342, "uuid": "c4a0ac4c-dfae-4936-838b-5df16cfed6e7", "comment": "Malware payload (AgentTesla)", "value": "95c6aeafe5fd3b3284553c5917525d2d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417342, "uuid": "d82efa30-9132-4b60-9f45-8396ec87d181", "comment": "Malware payload (AgentTesla)", "value": "23ee531d89062ae174e9c01e5d06b10ced49c7e126bbe5c811941196c92a7b6c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417342, "uuid": "48adad42-6b87-4a12-b790-4d622a4625fa", "comment": "Malware payload (AgentTesla)", "value": "e0f759dedf1f25263ef356d5836b7fe99547ea27", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417342, "uuid": "7dfd6872-70c8-42c2-b32d-5c850c87d8f5", "comment": "Malware payload (AgentTesla)", "value": "a62ff2d69ffe720e9b599201ed2ec4bb9f2ca8f0016017b041551aa45faa5558b00083b488ff274daffc091f3ebd904a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417342, "uuid": "722d8be6-6973-49f3-95f9-57d3ca19146b", "value": "T16F0512D931894BA3EE35C3BD99B9A45407B0B836E130F5096CC626CB90E6FDD2510FA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417342, "uuid": "ed1cbece-4bed-46c4-ac4a-e055bad62a41", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417342, "uuid": "8badf95c-0320-4d38-b565-070dae8392e5", "value": "12288:QIuwOEAYS0WOU6o0YIF4xK/4UeyxiamZ84ElydwZEjceTBpsgZMA:BuwOqyOU6VYIFH4Uec4CyiZApsg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647417342, "uuid": "614b83da-37aa-455a-be7c-17a65a4a3ad7", "value": 814080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647417342, "uuid": "9fe5e43b-efed-4b70-9364-88d600a0cc39", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417342, "uuid": "3ada582e-0053-4957-a561-0054628bdb06", "value": "AWB INVOICE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86f9f999-a4fb-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647416074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416074, "uuid": "8d498db7-e6cd-47fe-ae0a-f536cfbeab0b", "comment": "Malware payload (Heodo)", "value": "2e37f8f63ef618a86ee6a9a761cf674e", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416074, "uuid": "d6b81d2b-5a61-422e-a663-e0c5d8eee745", "comment": "Malware payload (Heodo)", "value": "23fe0ade01e8a49896afbd8068c5c644d5c71d31c636fc2be01a07f749db22de", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416074, "uuid": "e44de974-df1f-4594-bbd7-96054925386a", "comment": "Malware payload (Heodo)", "value": "dbe119b751f461e8de099183028391e278152348", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416074, "uuid": "7cf51380-9076-4a58-bbe9-be04fab1634b", "comment": "Malware payload (Heodo)", "value": "6a424f09f75a20f771a2712b01a2012076f2f2341287529835786d3f4be00efbd3195f52359914168c556ac99a8ac89e", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416074, "uuid": "b7c1d979-2457-4205-bc72-085ebec7b405", "value": "T1B933D00F9A22B5ACC3136C3CCA8C55F9650E5592A0C9F72B08857B9C7B1B1E7179F282", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416074, "uuid": "3008fa93-f2a7-4063-a526-eac78477abfa", "value": "1536:AkcEEt24xZdRBzH9hJBrdEwwNXekVIcog:xcEe2Kd3zdtdEwo/z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647416074, "uuid": "2955bb45-c664-41bb-964c-839d30f0fd2c", "value": 50643, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647416074, "uuid": "f425ccd4-b341-4359-8d7c-9d1a6e65ab0c", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416074, "uuid": "af3098fe-5a6b-4842-b202-a0ca13a088c4", "value": "Omics Journal_2.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f202170f-a4fc-11ec-9275-42010a9c0029", "comment": "Malware payload (RemcosRAT)", "timestamp": 1647416684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416684, "uuid": "5e0b7f3c-c8a8-43e8-9f57-882590621816", "comment": "Malware payload (RemcosRAT)", "value": "a053339f4b86a5b3a2767ef3757f8392", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416684, "uuid": "3d001ee6-ced7-4e0f-9ab7-53009bd5ca9e", "comment": "Malware payload (RemcosRAT)", "value": "24194efcd8b9b35ec9a9fd3cefe93f9286b84a586382b9d894c8f69ed8ad3f95", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416684, "uuid": "6106588d-4f3e-42cc-b348-a278d42d8aeb", "comment": "Malware payload (RemcosRAT)", "value": "5cc54f6dd7cf44f76b4184235a74b9196d82690d", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416684, "uuid": "7a1af5a6-02d4-48c3-9a83-bc3ca3ab3926", "comment": "Malware payload (RemcosRAT)", "value": "1bdc778a0cc02b133ba510284978f6132e4eaa7eb5033c6710b3404a01b0f00c1a0d5cdabfcd79df27935458eb7ab9aa", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416684, "uuid": "836b2655-52cc-40e7-b587-48d4f56da0d5", "value": "T1131412A33E269ED4D3B02AFCCD71F49190A5FC49A90ADDC624BE732765390E6413253D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416684, "uuid": "7324e143-86d6-456f-b7ac-b7a490aae0c5", "value": "3072:sBSeq9crz3WGWt6/r9wEA4xaERDZ/0kcpKC1tERyW4eV1JqdKNPR6jZEsxktznHM:iFqyItqy/caEbDcPyRXNNP4j7xOjHQ7T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647416684, "uuid": "abda5e05-5b30-4bff-9352-745a782b41f3", "value": 191048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647416684, "uuid": "ad1fd1b7-2f15-4bcc-a526-3078d6d4d2aa", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416684, "uuid": "31e0de88-ebd6-4267-9dfb-3d3137e2776c", "value": "Remittance Details.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf2831e0-a516-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647427792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647427792, "uuid": "0dca60f4-e732-420e-aa9a-107a533ea769", "comment": "Malware payload (AgentTesla)", "value": "0930cb8d39d2833a95bcc9b465786ef7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647427792, "uuid": "26f4f15b-390d-49fb-81eb-f5e26ba63328", "comment": "Malware payload (AgentTesla)", "value": "243a1822c8c9ed9649fd4718558225cecef5fd1ff34dd6a823d0691a6f12990a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647427792, "uuid": "c6a183a5-42bd-475b-843b-429d9299848f", "comment": "Malware payload (AgentTesla)", "value": "d3cce787e6d946a04029ffd8d975a85403efd2a0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647427792, "uuid": "fb6e6a40-3332-4f62-b8d4-25286aa6a948", "comment": "Malware payload (AgentTesla)", "value": "1ba2e9743eb65ef7ad22971ac2c55b0688386188c8068fc0a4a84b87e9e4021d0b89a98ec5c5765a0483bf9d066b567e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647427792, "uuid": "96028f9d-b39b-4256-81ce-239cd2291a09", "value": "T1F615ADC2DAE52D3FF2D521F874C6E098A7775933F6B1A814ECE162CF570AA43198260D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647427792, "uuid": "c1b5a7ce-35c6-4828-96b2-f719371ebd6b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647427792, "uuid": "ed218bf2-0fac-4638-8299-511f05251a73", "value": "24576:ILblYG0cVlEcitGOcYbqVyGi37f7Czpxki:MYgVVVOxdLf7U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647427792, "uuid": "d5277843-e92c-4f7a-9156-0b93f40ca02f", "value": 886272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647427792, "uuid": "ba73b076-56c2-4d0d-9ac3-1215e97b6f5c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647427792, "uuid": "724cdafc-5158-493e-a3a4-559af7307cc1", "value": "fattura 002948775786886868799787878779979779.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "553450f3-a578-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647469678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647469678, "uuid": "5548aec3-a883-48a0-9080-99c8ba9ded81", "comment": "Malware payload (Heodo)", "value": "6dfeebbba20626903258b47c24bb208a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647469678, "uuid": "0ef6bd19-3a24-4547-8c5f-4f99a4c9b68d", "comment": "Malware payload (Heodo)", "value": "243b94bce1a65263f9e8d8e701ae9494807025a4d0016700c0f1433bd02d51a5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647469678, "uuid": "556931ff-3421-4dd8-9cef-355bf95fbae3", "comment": "Malware payload (Heodo)", "value": "6788912b3e272e61ea47ee43ddb86d74b4cebb05", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647469678, "uuid": "b18b8c9f-a6b8-4a0a-8d04-2bb3563c79d4", "comment": "Malware payload (Heodo)", "value": "7b31d4a87ad31b259e43a34a7add9e16ebbda7db996b0012783c99aa29ad9413665001a1f0c3335b6edc2399a1e065ee", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647469678, "uuid": "bb63da05-8fff-4707-8421-5e3619929b5b", "value": "T132F4DF1176E1C076C1BF12304956A38D23FAFD509FB986976FD02A6E3EB41828E34767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647469678, "uuid": "e3a91cef-bd96-4e12-888f-e95ab2f5d29c", "value": "66a21a1bcb4077b3ed89c00ee693486b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647469678, "uuid": "66c449ad-d845-4c74-9f30-d2c3e890859c", "value": "12288:g6O4TpP0XjxCCFJuf07j+Xk7he8rLneTfABCJoWRWwfpW:BeCCF88j+X78OTYA7pW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647469678, "uuid": "c9cb61cf-9e9a-4aa8-a4b0-3db0f7b09d49", "value": 749568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647469678, "uuid": "9f04d86b-5b0f-41ea-8d98-bc9ba4ab3bb4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647469678, "uuid": "7cb4f757-e091-457a-b8fd-5d32fb070efc", "value": "6dfeebbba20626903258b47c24bb208a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f22c0542-a4ed-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647410241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647410241, "uuid": "ef4a358e-4905-41c3-bc32-b938bc954928", "comment": "Malware payload (AgentTesla)", "value": "3c4a5787b4aff3e463904014f26fa5f6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647410241, "uuid": "a2bb1d81-fbc9-4ad4-99a7-1fcfbea30ed4", "comment": "Malware payload (AgentTesla)", "value": "248c9abb7f19e8fecf87d8185de60fa044932a0479ba6b6eac295922359a60e9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647410241, "uuid": "791264d8-1746-4938-8ff5-8e0dc682816a", "comment": "Malware payload (AgentTesla)", "value": "8c69dd2eae6b2e92702acfcf5f2c47e1b868dd32", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647410241, "uuid": "40401931-e566-4b76-a0d5-2d79ecbf7820", "comment": "Malware payload (AgentTesla)", "value": "a30fbb04ec32d8c4db829b1f7f2c181e8cf9ef3b075209c4b151b8aef4ec42b38e2305f488d7d2b6aea9145ddcaddfcd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647410241, "uuid": "d5dc1185-c453-4b83-bc91-db5708c0706f", "value": "T1A005221533F4CB66F4FF4D75E974840913B2F7A670A2F20D4F8975AF1AA234806523AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647410241, "uuid": "9314f241-333c-49c0-ae33-80a00738e98c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647410241, "uuid": "cde058ed-f55c-4f73-8658-ec8510362986", "value": "12288:2JBXwOEfVzbFHSquMxun9GsPsjVjj+U/b/R7cr1twNU2GrJOsXx0NshnQK96T:WXwO0VzZH3cn9nkt+0Jor1cU5qsJ9y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647410241, "uuid": "a7d95542-bdda-4264-9750-b18aa91e1915", "value": 832512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647410241, "uuid": "e47b5cb0-4a47-4852-a238-3bc9928e15c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647410241, "uuid": "1102020b-88b5-47ba-bb41-8a70d8d0de0e", "value": "ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7145e625-a52f-11ec-9275-42010a9c0029", "comment": "Malware payload (Pony)", "timestamp": 1647438372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647438372, "uuid": "834265ec-bcf3-438a-840d-7bb3c4951c96", "comment": "Malware payload (Pony)", "value": "48266c00ea316f7f4f1b20c00525dd6f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647438372, "uuid": "65047e38-4a3d-4ce2-95a9-6473e669f544", "comment": "Malware payload (Pony)", "value": "24c900aca4e6635d6f7abeceeb6fc71b67fe0e601a74c3044e7487050a1ca41a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647438372, "uuid": "e7ecd6bc-067c-489b-bfb0-8a3d2c394174", "comment": "Malware payload (Pony)", "value": "ffa306b7b5b9ee673142db206de8467377500bd8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647438372, "uuid": "a1792d45-f8ac-4e5b-bef9-d9a0e0559d1e", "comment": "Malware payload (Pony)", "value": "3d1bc08e0f47a1a1ebbf73e0c5098eb14e60d4bc36d25a5cc655b47ec136a8be75bd1d7f67d5202eebe2513314592e3e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647438372, "uuid": "b4606a2f-f4e8-4a6a-baa3-5ec3d0603f94", "value": "T116F2E137D1F685D8C69BF43618EA315C386CD69C514749EB4ED0206B5C11BE92A2C9F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647438372, "uuid": "4ad4e4e9-9b24-491a-a1e6-af9dbd38cf54", "value": "8ffc880f286dd29d0b38582b9ac9395c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647438372, "uuid": "bbf11756-10df-4a3f-9672-f7c45a9b1e15", "value": "768:9pT7RgjLmDrE5pA6d6U/leud5EBJXROAjvzEUP++4u6EnbcuyD7Ug:joLQrEIc5e/hZEUWYlnouy8g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647438372, "uuid": "f3d5e1ae-773f-42b2-b2c2-4e7eee5e3f86", "value": 35840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647438372, "uuid": "673f9c44-3ace-43a2-b45f-7dfe936eb2c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647438372, "uuid": "c9c964f9-7663-4fa9-9ed2-0fc3b57a98f1", "value": "24C900ACA4E6635D6F7ABECEEB6FC71B67FE0E601A74C.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11f36fdd-a564-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647460975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647460975, "uuid": "b3dde99c-c67e-4097-acdc-7a600e6fb06e", "comment": "Malware payload (RedLineStealer)", "value": "dab77f275245f20cfa172294e6cdc580", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647460975, "uuid": "3bee02fa-4222-4d79-925f-0218ac5947b9", "comment": "Malware payload (RedLineStealer)", "value": "2584588b0ce3b0158b0e27028874a0c2db7d644e007862d24e6013090f527dad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647460975, "uuid": "bacdb8d4-29fa-4e7f-88ee-26795948c24e", "comment": "Malware payload (RedLineStealer)", "value": "b2d102ab8aff84207356a8997fca1abed19feacb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647460975, "uuid": "57521ce5-45fd-4697-ac3f-072ad334d0d6", "comment": "Malware payload (RedLineStealer)", "value": "47f15930ea883f8c6aa8c1df2dce9c556dfd58bd5aa0f5ece0c3fa608a3f258c007ab888ff62f454624ec92514688198", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647460975, "uuid": "8c4fa23b-50cf-4cf4-a579-13b72475e18f", "value": "T1F9663300B382C5B3C23749351A177BA1517A3A693E18CFDE638C49A4DA760D0AB65BF7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647460975, "uuid": "bf6bfbd1-53b3-42f0-ad8d-989323f527cf", "value": "00be6e6c4f9e287672c8301b72bdabf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647460975, "uuid": "42597fa6-4b9e-4ad7-a95a-8dffce30c5f3", "value": "196608:Vaq5Swl3+GosjLCUs982Qbhu0RBegJaRVBRY0RfU/Dw:Vas7i8zb4m5QVLjU/U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647460975, "uuid": "72cba671-0341-48a5-b213-8b00a6b08fef", "value": 6881200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647460975, "uuid": "c0151b85-e08f-443d-8f39-707c4c6fae08", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647460975, "uuid": "d44e7d50-1c08-42d8-b16b-7d3d0b717b11", "value": "10184739.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d5a6691-a4bc-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647389054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647389054, "uuid": "1409cebc-0479-4cbe-b8a0-0b6f9a09555e", "comment": "Malware payload (Heodo)", "value": "fe406e36cffc6e667bf005bc3842a1d8", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647389054, "uuid": "40acfa06-0ece-40ce-aedf-6f66e7075fb9", "comment": "Malware payload (Heodo)", "value": "258edf3b85a0ce609cb9d7abd8c8c751f0d92999100e61cb75557031513c0d15", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647389054, "uuid": "add2ae6c-eac2-4683-bef8-64b1e2c5adef", "comment": "Malware payload (Heodo)", "value": "546827c511db33098cbe956928e61d8690a9bb8a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647389054, "uuid": "ed10e879-144e-48db-b52e-2b97f619bf19", "comment": "Malware payload (Heodo)", "value": "4a34539082e5c49958f0a8b7908862d56b5b51f98ddd64c70d55cad6bc922262fff936e8c4f7fe2dd184892fc78f88d4", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647389054, "uuid": "713e92e2-c4a6-4a07-84e2-d85726ca936c", "value": "T1C5E46B0124A29C71C3E7C9756BD91E1539EAEA92CFF7800BBAE06B7CD874942C337516", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647389054, "uuid": "80735502-6446-4136-8b95-a868bb7af10a", "value": "a38617efee413c2d5919637769ddb6a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647389054, "uuid": "2cd2b1c3-efa8-4924-84d9-0de7c770d606", "value": "12288:KFxGsTPy4BHT4Sj1zfsf7ABqDLkWynCsZ:obPy44Y14f7VDLkNnh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647389054, "uuid": "4bfeed50-1453-485b-a613-ad7e5c8211bc", "value": 704512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647389054, "uuid": "43b7ceb7-6d50-4f21-8b3d-a7986dcefb15", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647389054, "uuid": "f36f2a4f-580e-485e-92d2-d34b548812b1", "value": "emotet_exe_e4_258edf3b85a0ce609cb9d7abd8c8c751f0d92999100e61cb75557031513c0d15_2022-03-16__000408.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16d3b2d2-a566-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647461842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647461842, "uuid": "78d1f2cc-d22f-410b-b9ab-716dd1717805", "comment": "Malware payload", "value": "9a6b0a23f2cb91849f800724acc21647", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647461842, "uuid": "77c81b68-64ec-4493-be29-7988d4d838df", "comment": "Malware payload", "value": "259623eb247a6097428b12638fff930d83f00698bb155141256efffd1e7f9f71", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647461842, "uuid": "84c0e1d8-246c-4735-921c-b07face00940", "comment": "Malware payload", "value": "fb5b9af96f8341fd6858b395b42c4582f976e406", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647461842, "uuid": "72923d70-f1aa-4be6-8e75-196aed611d4f", "comment": "Malware payload", "value": "e6488aaea8a3e31c0c6ab1155338960fd9daac675650f8da433b7866fcd6a8b0673ede61137e57852c04198709cc95da", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647461842, "uuid": "17c2fc1d-19c5-499e-b927-439a92278d07", "value": "T16734F7A6C6FC1C07D94BB37854262D1391CE4E7280D5929A0B98BC3AF3FE9E7A4141D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647461842, "uuid": "21cc02de-08e5-448b-8ffd-90816176e4b9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647461842, "uuid": "e13a508d-7123-46e8-9a6e-2c4ce6ecb5b0", "value": "3072:MPtpZAXMZUFpTU+wSZZPSj/j+LWrny2QXea9VSsumMMcZW:Og9wAVSjCLWLy2QXea9smMr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647461842, "uuid": "f72bc465-8ee4-481b-aafc-c33d336e9cac", "value": 230400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647461842, "uuid": "94143119-8e08-42ff-9f08-154a6a1e3b88", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647461842, "uuid": "587fe307-bb6b-4904-9c3e-f5f66e84d866", "value": "11286208.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b938998-a532-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647439624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647439624, "uuid": "2744c2f1-21f3-4cbc-bb3f-d06d6d746ac6", "comment": "Malware payload (Mirai)", "value": "3db84070bdb1b7914cf532121e3d1a56", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647439624, "uuid": "0a3acf7d-1980-4975-9e4b-c4a353352ae8", "comment": "Malware payload (Mirai)", "value": "25d4e9fcdc3affb1c0fcf3718e2d7294c0e17dcd14fe3d4dc81f6a0d3cbe2869", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647439624, "uuid": "9ad9b8fd-64ca-4c04-8048-938b3d3e5b5c", "comment": "Malware payload (Mirai)", "value": "2594a8fa65edd49a3581ee504a5c9b9cc28849d1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647439624, "uuid": "cf93f57d-9dc4-46d4-932d-428dcd008aec", "comment": "Malware payload (Mirai)", "value": "fef1af704b7b681325eecfdcd2029aa8baee0669a7bf88a94acf12cfd3ed2e8e9ae11ab61cde343dbc8ca858a3049d9d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647439624, "uuid": "c63bed48-8539-464f-891e-b9d6fd44dca9", "value": "T14563091AFE419F00D09520BAFE0F1649B357C7A8E3FEB3529E24575056DB8178F2B829", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647439624, "uuid": "990bb065-41a9-429f-93ef-4e8fd64b7132", "value": "1536:NHnChadmK8b3IpbXD1X9lb2irPXs0YflUA0FqBVd:chah8TIpbXdDP8dflUAzVd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647439624, "uuid": "ca773179-fff6-4956-9d33-b12cc6c71550", "value": 70068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647439624, "uuid": "12fbf583-0db9-4998-a47d-ec9df7cd7325", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647439624, "uuid": "97ae6fd4-8269-4652-8d10-550ac7218924", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da869da1-a573-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647467754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647467754, "uuid": "b6b56882-9b74-4b84-8751-a21fc329bc0c", "comment": "Malware payload (Heodo)", "value": "853db5b5919398b55529ed433c372e17", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647467754, "uuid": "69418156-1fc8-4e3e-bda4-99b5d354d00f", "comment": "Malware payload (Heodo)", "value": "260f75713eb92ee0afe15d6a1d3f14d4dd82b243159e79317d18663b4fafa28a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647467754, "uuid": "e62d66d1-df25-4c32-85ca-8329cf3cbec8", "comment": "Malware payload (Heodo)", "value": "893e11290f86b38e63b4da5d2f4e279b24f11f72", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647467754, "uuid": "e5e1a753-3bde-4ee8-8194-1b919a0b24d4", "comment": "Malware payload (Heodo)", "value": "387657e14dc06603fbf4878d9ecbf28b10066b8333591eb99e80be7246360b367ccce72bf7d816437d8d49fd5cbb34b4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647467754, "uuid": "3278d7cd-e17b-4a03-a302-c43b00830b3a", "value": "T13AF4DF1176E1C076C1BF12304956A38D23FAFD509FB986976FD02A6E3EB41828E34767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647467754, "uuid": "e4d18b76-bde2-485d-bf5e-05682b44e8bb", "value": "66a21a1bcb4077b3ed89c00ee693486b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647467754, "uuid": "e6b32b7d-9d29-4991-a995-ad9be78ac291", "value": "12288:g6O4TpP0XjxCCFJuf07j+Xk7h38rLneTfABCJoWRWwfpW:BeCCF88j+X28OTYA7pW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647467754, "uuid": "4987d9c4-3044-41f0-94b7-0c8c2c456ed8", "value": 749568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647467754, "uuid": "3c411e02-fdde-411a-b7df-e251f8cdf151", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647467754, "uuid": "ab2fd97b-6a45-4026-86da-2ed48707c6ed", "value": "853db5b5919398b55529ed433c372e17", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df4cf4a6-a506-11ec-9275-42010a9c0029", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1647420947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647420947, "uuid": "1b75d556-7dec-47f3-8543-4c2f4bfb7c1e", "comment": "Malware payload (RaccoonStealer)", "value": "21259c7b0f1376f1624043bd4af3ade2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647420947, "uuid": "4e7308e4-d5be-440d-afac-108241044cdc", "comment": "Malware payload (RaccoonStealer)", "value": "27493ca87c0d633bb9b3aace9664110c1a54cb56fd11d9fceae21f2b370de9cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647420947, "uuid": "bb2c3a58-db47-4faf-9804-83ddce21a7b8", "comment": "Malware payload (RaccoonStealer)", "value": "57d41716cd5dd368324e48688799509235dfba0a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647420947, "uuid": "23209b43-0edd-44ca-9654-01f817b56c33", "comment": "Malware payload (RaccoonStealer)", "value": "c12dc5bc644da551a0c1e1cdbec3f296c0458a6e1fc1904c21ae8b5fa7d662467b1d7555ed2507ef42c4a273a61e56ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647420947, "uuid": "e1d405be-766a-48bb-84f3-1a57ec41ee61", "value": "T101B4E000BAA0C035F1B716F88975D368B83EBDE19B2061CB63D566EE46752E4EC32717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647420947, "uuid": "8338a1aa-3850-46d0-adf2-020ccdce96ab", "value": "ddd4504dfae4a1c918f514bef93af10e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647420947, "uuid": "b06174b2-8617-42d1-b8a2-3d0a886899a6", "value": "12288:GwHXYdu9ZGTKeyQJrbQIq8YuvTpr0yetxO5lEioxrVVyO:5mu9YVrU4Y6Tdm/O7EiKVcO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647420947, "uuid": "d3026497-1603-472d-b808-cd5cd04af568", "value": 518656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647420947, "uuid": "3a693afe-ce01-45f7-9762-e8627abfb1cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647420947, "uuid": "b93954e9-32d9-4bfa-9ee9-5d69ca59af29", "value": "21259c7b0f1376f1624043bd4af3ade2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0b7109f-a568-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647463067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647463067, "uuid": "ffa55a18-e095-47b8-a16e-7d75eccf6647", "comment": "Malware payload (Heodo)", "value": "88a43cdf370682be4b0d148579a57c6a", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647463067, "uuid": "211c277e-a08d-4a68-bbf5-e8882035246f", "comment": "Malware payload (Heodo)", "value": "2778c1b66f38bdd6527f12e8e2c14d6d8e2c0ccabe4c846bdbb214712843e4f0", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647463067, "uuid": "d788d31a-c7f5-4eac-8ffa-30a500ed652e", "comment": "Malware payload (Heodo)", "value": "777d82f338705f289d529c32ef2656b2f51e0a52", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647463067, "uuid": "01fcde25-00a9-4369-9108-64089a907ee8", "comment": "Malware payload (Heodo)", "value": "d1b65b8fd23f606b779193c0ca615b32323ac80bff9373434a513472cf9c2cee48d9fbb111eb67bc9199a44408a161fb", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647463067, "uuid": "a446efb9-ff0a-43b8-b7f6-5a350af594e7", "value": "T12FA29E1DD4216849E37B643CD20A50EE918F1D166243B49D7494BB6CAF337A7038FAEE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647463067, "uuid": "2b77bf80-da96-4079-b8c9-735394dda474", "value": "384:LPmxuAi/Nj7z3S8EibbwB37gSYrLb5CzgObff9kC+xbXy/8y6jk:LqsN3z3zXa2FCBn9kC+xbi0y1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647463067, "uuid": "d36838a2-9da2-498b-b8eb-0b0c321b449d", "value": 22810, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647463067, "uuid": "b193dd4f-9eb8-4792-9f7b-25b8bdc17d1f", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647463067, "uuid": "a9bd04a7-d63b-4ffa-b3cd-29b9bb6c0844", "value": "16032022.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a709e7d5-a566-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647462084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647462084, "uuid": "04d8f7fc-37f6-4e63-af13-d28308b7ff1f", "comment": "Malware payload (Heodo)", "value": "cc78fc992514627a9072bd67f8f2e516", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647462084, "uuid": "dfb033b4-f4d3-4767-a9df-063e9f240439", "comment": "Malware payload (Heodo)", "value": "277b462c0357f92b040d33a13e7025f4d8f645cfff99d53b7fe3b0d3ac539601", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647462084, "uuid": "530df51d-eb73-48c3-9b8a-48aa727a9a2d", "comment": "Malware payload (Heodo)", "value": "4c9ccf822ff3b07f940754bb593820b4d518905f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647462084, "uuid": "e0d0962c-9b04-4461-9927-1480d7d1343f", "comment": "Malware payload (Heodo)", "value": "f5b4f537e05bf050acf34d62a52aa6115b6821e594c2e82fd2742c49da31042c494eb6a61a7b1e8a3230b53a55b48120", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647462084, "uuid": "1b254f8c-d820-4438-85fb-721089d0a320", "value": "T13AF4DF1176E1C076C1BF12304956A38D23FAFD509FB986976FD02A6E3EB41828E34767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647462084, "uuid": "9b7e455a-ff3e-4e8a-9a29-1950e955fac3", "value": "66a21a1bcb4077b3ed89c00ee693486b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647462084, "uuid": "0b82cc4a-ccc6-44b0-ab8e-651753221828", "value": "12288:g6O4TpP0XjxCCFJuf07j+Xk7hU8rLneTfABCJoWRWwfpW:BeCCF88j+Xp8OTYA7pW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647462084, "uuid": "298f8a93-0267-408b-95d3-44e436c46af7", "value": 749568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647462084, "uuid": "2938ac23-60e6-4e45-9330-f6bb683105d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647462084, "uuid": "9f6be130-2ec7-4b37-88f1-9b25c7b43af4", "value": "cc78fc992514627a9072bd67f8f2e516", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c7ddc0e-a580-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647473153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647473153, "uuid": "e9337b1f-9867-479e-aed2-e6e1ccb228c3", "comment": "Malware payload (Heodo)", "value": "c27ce088bd1a8861df0efbcaa134cc7c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647473153, "uuid": "ca2db091-c072-48b1-9333-5e606f3fb3a6", "comment": "Malware payload (Heodo)", "value": "27b5bc9c426c958e414aa27bd508632971d4f505c3266478b5b2fc7a904154d4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647473153, "uuid": "1ff47192-7d8f-4fa1-8694-c61ee723661b", "comment": "Malware payload (Heodo)", "value": "016eac0136bc6099a993d7664fcc8352b6c83315", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647473153, "uuid": "a2ff351a-acf4-4b42-92fa-0274e96b4d48", "comment": "Malware payload (Heodo)", "value": "a7214335badf7e2aec1612ce39b4d87746a935545545daede64a64f1058aaa50b6ed25a288b5d2ddffa3b1208e131e59", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647473153, "uuid": "8c5d1d85-5371-4e01-b27e-43efa9b180ae", "value": "T19CF4CF11B2D1C076C1BF06741916A35D63F6FD608BB9878B6FD02FAE3EB45828A34356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647473153, "uuid": "d7d35a2c-2730-4401-83db-62c514e8ff59", "value": "66a21a1bcb4077b3ed89c00ee693486b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647473153, "uuid": "430a4fa6-9778-4c89-a5cb-fcf6d6311eb3", "value": "12288:WZjb8BOPxue5dKV9M/98f0koPZXvkgKtuBdfMAofD:WCBAdKV9Xf0kG3KMBdkAofD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647473153, "uuid": "097ed045-99c6-4fed-a832-be2327e96dee", "value": 753664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647473153, "uuid": "ee9c32b2-088e-42af-a886-edd42797d4ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647473153, "uuid": "4738dc21-b812-4b3f-b9b5-6f8dc3c1ea9c", "value": "c27ce088bd1a8861df0efbcaa134cc7c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "669b597e-a4fb-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647416020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416020, "uuid": "df28e5a9-e6f7-4706-a5b7-eefaa0a4a30c", "comment": "Malware payload (Heodo)", "value": "c53fd80b66625698be7fbbb680dbc1f5", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416020, "uuid": "9ae4556c-0f97-4de4-8a30-c64e257f84a0", "comment": "Malware payload (Heodo)", "value": "2827aece5769f21fd749b14e8fee58067ba1ff2c6cc57bf1f43e26ab729bf11c", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416020, "uuid": "0bedfa2a-e2a2-4aeb-9a56-1e04fd47acc9", "comment": "Malware payload (Heodo)", "value": "4bec4a27c67c578af47cb8d13f799465c3d8d4d2", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416020, "uuid": "aac53510-b732-4959-8c49-7835ea34d39b", "comment": "Malware payload (Heodo)", "value": "8a8047e52435b3d65317041e6bd793835d5b6dae8b68b50f8f7c16c36a8d06931d8d9aff4adf243700461756aee10ec4", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416020, "uuid": "82e75c7e-9a98-4d0e-a8d5-9f0d8f4c8d76", "value": "T1B9F2CF2DA3A0EF5ED61DED38849881EA421579154506EB4FA85CEB0D6F493C33B1F0DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416020, "uuid": "b5227142-193f-4a78-86b4-b6bec2092625", "value": "768:YjFhNKbeXizXT2LxdFfPdkqstJ1goE6vS:YBTGeXgXUndkqegoE6vS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647416020, "uuid": "191e2ac4-3413-41c7-9ba7-5cd0f6c50e31", "value": 34391, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647416020, "uuid": "523fe474-6654-4ea3-976f-d87b53f5196b", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416020, "uuid": "27ab86c5-9b1c-4892-80ed-1356c89d2091", "value": "10080114793855687106975.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dffa3517-a531-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647439417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647439417, "uuid": "d8e8f4ef-b1bc-4154-b377-49e28b586dc6", "comment": "Malware payload (Formbook)", "value": "4918e8b75a545dfa06784334874ee4d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647439417, "uuid": "e0652ac1-1dff-4e49-89ad-70d5d8d0eeb6", "comment": "Malware payload (Formbook)", "value": "28303936352f8612246badf90b3a8c270bb005a0292efa935bbed5b8442341b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647439417, "uuid": "c986573b-9c84-4fc6-b609-e26f86169dc2", "comment": "Malware payload (Formbook)", "value": "73c76c50951d3dae098b48cf3c4f6b1e5248a258", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647439417, "uuid": "74ea4d38-ca30-43a3-9946-8b80566ed0c2", "comment": "Malware payload (Formbook)", "value": "eb4eb6864b5e2099d0b15702cac5cfbba5fb7b71771cb81643f3a6586d4361e65d0af914cce95579ddaeeb715e17e1c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647439417, "uuid": "a959c2c9-8d10-418c-ac8a-8fdcb7c04d22", "value": "T18B72C782F7A44D60D82B8E7245521A21073FEF519C36A69E7C8D321B5FB33920A96FD1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647439417, "uuid": "d0322a68-7124-40ff-b0af-22f98c4153dd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647439417, "uuid": "01ca8edd-fb05-4181-86d4-fe3a42423483", "value": "192:4cEIrrlruRcKuRuLlL1Tn1zzgJsRqo8uuusNoLk0B5fz6QhX4d:ZuRcKuRuL31zkqRy0B5fp4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647439417, "uuid": "f159750f-800f-4a7d-95bc-c900e4cbcabb", "value": 16896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647439417, "uuid": "fdc6f4a8-9dc3-4f94-a6df-c3b5f8882822", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647439417, "uuid": "1c76d817-38e4-410f-be00-d9950052de4b", "value": "Outstanding Details.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eaa695f3-a580-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647473365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647473365, "uuid": "92c44096-a7d3-4813-9667-29f29311211d", "comment": "Malware payload (RedLineStealer)", "value": "b776a1f25229cd9ec10ef74d42531c3b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647473365, "uuid": "19ff9e23-2b10-4615-8caa-865eff436c8c", "comment": "Malware payload (RedLineStealer)", "value": "28555b2370e42a252653a3bd9952cc14a973743a03812896346823f745514786", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647473365, "uuid": "50259d16-9b57-4e93-bca8-91e803b59563", "comment": "Malware payload (RedLineStealer)", "value": "a5b59513a336a8dac248128d89e6c7a530b272b4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647473365, "uuid": "123142c5-11b8-4d54-95fa-af018850267e", "comment": "Malware payload (RedLineStealer)", "value": "b23d58fe2a64f237ffbfafedbd3cbc7671750fe765646ba18a14304bb4092c2fe115abf5a4eb918d3fc5d620ddae90e2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647473365, "uuid": "b9dd6e07-7a8f-45b0-a224-06a361f4ad54", "value": "T15026338FF7D05534D0A376B59F68D41A020289C877EEE027773825A2EC79BE4A518CF9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647473365, "uuid": "7fd9620a-ee06-4907-8292-af9e84b7db3d", "value": "7dc28ef949f54ad98c715895ecc34cff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647473365, "uuid": "def5c9c9-3212-410e-96db-f99c639d833f", "value": "98304:q8YFBnVAEaX3lmWXKpBBc7/N2/ez+9fUgoNN9mB/2S9aPk:q8gnGz3lmWXKVg+1SPmt0k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647473365, "uuid": "93bfeafb-a918-43e2-9582-ea7fc0002c8d", "value": 4436480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647473365, "uuid": "6fae9913-397d-4318-b2cb-e4605de8e789", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647473365, "uuid": "ec62730f-dd05-447b-9f12-1eac50d5ead2", "value": "11349162.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88f2241b-a533-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647440130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647440130, "uuid": "3c1115c5-6bae-4148-8d19-77ea5aabaf85", "comment": "Malware payload (Heodo)", "value": "15954803fd423d84f4302d2121116ae7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647440130, "uuid": "3304904b-7b61-4aee-9b03-9c2e906a4ba6", "comment": "Malware payload (Heodo)", "value": "2908abdef97bff8c65c26dd5ace8c91da2d450d443fac0ad6d53d2286db63605", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647440130, "uuid": "135af61c-5494-4b2b-a635-6a15a720ba3a", "comment": "Malware payload (Heodo)", "value": "f2d3cfde62184d850a187405040ffa8df6db1167", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647440130, "uuid": "5bcdf2d5-3d48-4f4b-8689-0555101af5b7", "comment": "Malware payload (Heodo)", "value": "e2d7b3d9fbcf53e2b277faad2be5099d1d4d0f5e8975bc5967c8e0cd197bc3b428b796b60b71e2442de947918a1003f1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647440130, "uuid": "1b2e0f99-acc0-45e1-af32-12b748943fc4", "value": "T18DE47C12F461B2B9D04B04741F1723A86EEF5E518629CA13AFA8ED5E1F31251FC3FA16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647440130, "uuid": "c74f6456-feea-49f5-8a9c-c76eb3c87ad4", "value": "066d4e2c6288c042d958ddc93cfa07f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647440130, "uuid": "82718765-3b7a-4653-931e-f26d489e9dd1", "value": "12288:DtAanana8Meee0GBGu3qI+3DNJ3vE6v5eDxS332d7t5hT/hexLx:Kanana8qGBGuoNxExxCM7o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647440130, "uuid": "010e2dec-a328-4b41-83aa-6ecd0b872fa1", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647440130, "uuid": "2c470f1c-d032-405f-904a-572d5128fa65", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647440130, "uuid": "5ce00dc4-702e-4b72-8afd-4fde5ef3b340", "value": "15954803fd423d84f4302d2121116ae7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3d063a6-a50b-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647423075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647423075, "uuid": "b42f3415-cbac-4e42-8764-34e1ceb7d0fa", "comment": "Malware payload (Mirai)", "value": "b5beabd2d5a3e466bc2242ea13aad1fd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647423075, "uuid": "a099ceca-574a-449d-88ff-c9016fe811ce", "comment": "Malware payload (Mirai)", "value": "2a2945354b99fface64e9af91dda5b1d7b4bef4744c623ac471de766ceb69255", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647423075, "uuid": "456b4d2a-e646-4525-a6eb-79dd4d397848", "comment": "Malware payload (Mirai)", "value": "1ba37a96356dd8b1cb959fb234f1e116ea50f7b2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647423075, "uuid": "aa002978-cdee-4085-83ee-9d275db5ab09", "comment": "Malware payload (Mirai)", "value": "ef3a595e76f2abf6326a2edd968135ea6863aab35dd4b4b4371a146e7a3649c1cbcb0ec13f36112c0819093aca793655", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647423075, "uuid": "ed2a9f9b-2b09-4353-97a9-4ade93d94837", "value": "T1D3D2E0B18389EE64E670ADF1EBEE3683A3110538508D3A04315D671ED3D916EFAAD743", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647423075, "uuid": "a377d2bd-4754-4dc3-8e4c-2585342fa381", "value": "768:/f88Dfuu6Pk4aFq7e3DXh8ZkKYvcq3UIfK:X8ifN6PkNq7eTXO5YLi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647423075, "uuid": "12fb1115-ff69-4f42-aa7b-13250bf26a27", "value": 29880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647423075, "uuid": "56763da6-8bfe-48d9-8f0f-8453199a2fda", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647423075, "uuid": "9848f367-090c-4c61-9b62-a06bcf1defc1", "value": "b5beabd2d5a3e466bc2242ea13aad1fd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccc87d44-a516-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647427788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647427788, "uuid": "6679bcc3-7a51-4801-ac48-95a79b2d71cf", "comment": "Malware payload (AgentTesla)", "value": "870cddc28b61f5a015a18634bd3ce7fd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647427788, "uuid": "3be12db2-9b84-4f7f-a64b-a13ebc078212", "comment": "Malware payload (AgentTesla)", "value": "2a363938eca2558d32141bc57bdbb7f16786d4d09455749e49fe494a727e47bc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647427788, "uuid": "d7b74932-f612-484f-9da0-fd2773c17e6e", "comment": "Malware payload (AgentTesla)", "value": "93be8b29106c9081d9f24b53bd5953014b53a66c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647427788, "uuid": "04edefcb-53ef-4179-b2b3-981c4c91d3cc", "comment": "Malware payload (AgentTesla)", "value": "e36449511e95668a9003847e39f121da35ab9ebf9c877d6d2ed6f4bc3b137b3a8648d12515babbcfac87d828d8ef5cd6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647427788, "uuid": "47e5b695-b5fd-48a4-aaea-ce429f6bb261", "value": "T1F8C4237887E930FA6B61A494E2162EE4BEF6DE87603F0D4E7D3495A2B311C5850E1F42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647427788, "uuid": "543e577e-63fc-4fd6-bf5e-69485e16956c", "value": "12288:q2LYHvOfatU8ZNpUsDiD83W6iLFuqF+KF3RoSa1WVi/tu/WvVxn:CHWitU8ZNni/3QKF3Re14i/tu2Vxn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647427788, "uuid": "23cb0f26-1c6f-4ec7-a6b2-f74eb4bace69", "value": 561131, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647427788, "uuid": "a70356c1-0da7-420e-8593-0c97f37504c4", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647427788, "uuid": "cb5e94d4-8663-4ca6-b79f-a48f6dd69ca0", "value": "fattura 002948775786886868799787878779979779.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "befd584d-a573-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647467708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647467708, "uuid": "dcffe7ed-a345-48db-a748-c8487a41e0a4", "comment": "Malware payload (Mirai)", "value": "1e194b5b114e7d7bd400a8ef9639bdd8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647467708, "uuid": "4046e9f3-69fd-4071-81fa-7779c5a14434", "comment": "Malware payload (Mirai)", "value": "2a94901f7535e80e2e80448425629c89a0c1a6ee0bf64f43af23a8a35690c952", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647467708, "uuid": "7daccddc-8b44-4b4f-aeb3-f5a0c8a47596", "comment": "Malware payload (Mirai)", "value": "86a1d21ec4a11575ff21d35b075d31562d1108b8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647467708, "uuid": "7eb610d6-0f05-4796-a6e0-0c79ef93b8a6", "comment": "Malware payload (Mirai)", "value": "c3121e090b1c973212fd88f83b0db1e1a962cb438266783800ae53dc9d6a7a7b9b8e3e8d41e556d114819cd7603519d4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647467708, "uuid": "6e1c8c6e-0779-4f8e-b560-8b96b6251b69", "value": "T15353E781BC41A669C7D01777FD9F559E3700A3C9E1E932138C240BA07A8F94B0D5BF9A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647467708, "uuid": "d9481d7b-8d29-4cbc-84d6-eef9b5da509a", "value": "1536:GogI5uRJ7lshCKotdsVKQkd2y33eZtQqQot3:GogI5uRJCQsqwy3w33", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647467708, "uuid": "1b1469d3-a89c-4ec3-b3b1-232c225521a3", "value": 62900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647467708, "uuid": "0d650ebd-c5e6-40e1-bb2e-e051c9738e73", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647467708, "uuid": "7fa92cae-ec2d-4c78-9a5d-c00da3b2bdee", "value": "1e194b5b114e7d7bd400a8ef9639bdd8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cebcc3d0-a541-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647446260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647446260, "uuid": "86d4e2be-55aa-41ee-80b4-86137bd2647b", "comment": "Malware payload (Heodo)", "value": "4aa1e8362cccfa315428fb3f559233df", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647446260, "uuid": "13476e0b-401b-40c4-9aba-512d34c812da", "comment": "Malware payload (Heodo)", "value": "2aae6a87f121347a3bbb5de0e54611ffb57395ca2d3fb4057ef4a534205b86c2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647446260, "uuid": "1f9f2838-54c3-4149-b672-899cfa999fd5", "comment": "Malware payload (Heodo)", "value": "a5a7a383a8d0913a331a0ce29f074ba8f24f4c0c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647446260, "uuid": "e5953cdf-a854-4aa5-850a-6b06b16778ce", "comment": "Malware payload (Heodo)", "value": "809fff111c265101ce37dd4945fa89c950ca68b8372a6c3f1d254c3be803bc4cb9cb5271873206e38ffe399ed4e46acb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647446260, "uuid": "81ed7663-1d9b-4445-9723-817697fbb2ae", "value": "T143E47C12F461B2B9D04B04741F1723A86EEF5E518629CA13AFA8ED5E1F31251FC3FA16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647446260, "uuid": "c9e1fb22-5101-4dd6-8510-570c2c726442", "value": "066d4e2c6288c042d958ddc93cfa07f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647446260, "uuid": "9987b2a2-dff8-40bf-a765-52c9af2cb5c5", "value": "12288:DtAanana8Meee0GBGu3qI+3DNJ3vE6v5eJxS332d7t5hT/hexLx:Kanana8qGBGuoNxErxCM7o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647446260, "uuid": "fe77296a-1d99-402f-a350-af28e69cde7d", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647446260, "uuid": "d6c0ab97-79df-44cb-9095-47a75960afe2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647446260, "uuid": "7e270721-a009-48d2-807a-29dfa2c20204", "value": "4aa1e8362cccfa315428fb3f559233df", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef717366-a4fc-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1647416679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416679, "uuid": "4fa16791-f207-4cb5-b5c4-2238b14a3797", "comment": "Malware payload (Loki)", "value": "a21b39c107d7aa094a4b17ef699fcde2", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416679, "uuid": "fcb60b3a-4ed5-4eb8-9b9e-375370c23347", "comment": "Malware payload (Loki)", "value": "2afdefd8d9bc58d8b9b6cdf0410eed154f2c127a546dbd1bd5640d94eec45ebe", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416679, "uuid": "c76fd471-4b4a-40aa-97f0-c849694eefb9", "comment": "Malware payload (Loki)", "value": "fba82c646775187c1d1b839ef49363433e577b0f", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416679, "uuid": "ace15cec-63ab-493d-9122-e16cec65a6de", "comment": "Malware payload (Loki)", "value": "1666a10841a14d0227850f97198c31898c22577c23dd3feb7d9f430790c1051269a0d0adbf4a6e6ddd2df6d50319cbaa", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416679, "uuid": "8019c028-df8f-4e6c-a241-621442e7dc6c", "value": "T17B140210A7081F8DE2EB5B757F72CFC0F624EC125ACA616AB2413B1DDF71858D8E9942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416679, "uuid": "615c66b3-0adf-4b6c-8276-61cb7cc11f79", "value": "3072:/JgD83n3qBhdZ6xDABukGhhzgLc6UI7M0QXs68582BJyDVLArpu3YQMCeP8oQfcj:Bo/F4ABukm9I7MrB8BYVUrp+YYArQfA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647416679, "uuid": "9bd358b0-d53f-4e91-a9ac-62789e8318a4", "value": 190904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647416679, "uuid": "727b415d-a07c-44f4-a4ff-47224c408687", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416679, "uuid": "d2adece5-2d9e-4877-899e-5161251730f6", "value": "202107620- USD.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "867d0671-a53c-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647443991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647443991, "uuid": "38bb2549-3011-447d-a4f3-3a2d57dd5c3b", "comment": "Malware payload", "value": "92f97f0f16305d3314fe38d9f449fc21", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647443991, "uuid": "6d0ea549-46e9-48c6-82e1-0be4f6b0368b", "comment": "Malware payload", "value": "2b8c8b279dfe9ec85d065c0c76ec6278d1f12055b11e6d38e274d60fcfabeba5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647443991, "uuid": "1a2574cc-65d8-41f6-bbbc-e732036428a8", "comment": "Malware payload", "value": "daf3c704c868464b31d58e3e59e72e2d5482ec0c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647443991, "uuid": "51e262b3-0110-4fd6-8f29-bc5de617448d", "comment": "Malware payload", "value": "85b5c335176290db553869506b0fb9ea85cb738a57ff20634522ae9d45d62b28d25f6dd89907b0f37fc04b7d46e1c7b3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647443991, "uuid": "8be81501-b9f7-433e-9f50-74b3f99a1a33", "value": "T1DF041C80DD18C52CEE6AFAB10833D275CE2AFF8ABA4C1A55E440FBD6397527146CD934", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647443991, "uuid": "5615000c-1176-40c4-b1de-f8e9932f12fb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647443991, "uuid": "acdcc577-2995-428f-a479-94d7d064fc71", "value": "384:I653cvIex+3SfoBpkn6dMafm7omN59/jME:I69tknZafmLO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647443991, "uuid": "33fcd230-bd43-49b1-8d92-34f2bc9c01fd", "value": 176128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647443991, "uuid": "af3ceda7-7be9-4349-8049-e8f485493666", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647443991, "uuid": "f0d9a0d0-ff9c-4dc5-bdcf-131dcb7240f4", "value": "852000362.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e24c27e-a502-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647419012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647419012, "uuid": "b0fd3108-5083-4989-b845-aa1dfb8e43aa", "comment": "Malware payload", "value": "58075adf11d881ff7cb3812cab0cae25", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647419012, "uuid": "3bfa9bb1-3502-4717-9c4d-a65abf1c3854", "comment": "Malware payload", "value": "2bee5eca6869473e28b4d22220b7b9921e33fdf73c9382e84a947dce4ca358a9", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647419012, "uuid": "fa063af5-b52b-4fb2-8ead-b1de2d815d98", "comment": "Malware payload", "value": "c776f628a2fc9fde23da51a13052f548fd9296c1", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647419012, "uuid": "9d9a47b3-bfa8-4acd-8037-ef9ddff3197c", "comment": "Malware payload", "value": "c21c59528fbf4b814ada3ab50505c3e5860a49d0abc04be183959c3313623412942d27c4e9b07d6d447bb19280b91f0c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647419012, "uuid": "f17b6415-33dd-4c53-b815-516eea229585", "value": "T128940906EF22B1F0C06B03B00555415AD2EB7BD0A72EE693825DEB3FDD239977A34625", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647419012, "uuid": "ffc23945-281c-48f2-b6bc-76215712149a", "value": "066d4e2c6288c042d958ddc93cfa07f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647419012, "uuid": "bbf02f9d-dc3d-4c15-ae3b-02b4459f3f87", "value": "6144:Ymckn99Xki2PXVKB0G6XjMqMM2stJKEOfkifOAorw6PeDArPxgM:jc899XKPmN4WMkosO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647419012, "uuid": "01099e22-6425-4633-9485-1c38339637be", "value": 409251, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647419012, "uuid": "17510c46-41cf-499b-927a-a45ce95e862c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647419012, "uuid": "6c2e4e96-e94f-40ee-8c91-38505be98b84", "value": "emotet_exe_e4_2bee5eca6869473e28b4d22220b7b9921e33fdf73c9382e84a947dce4ca358a9_2022-03-16__082328.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a406b450-a51c-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647430297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647430297, "uuid": "a218eae8-91f4-49a3-b820-bb6b18606532", "comment": "Malware payload (Heodo)", "value": "854c6f86662e95546d943093ed019523", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647430297, "uuid": "8886f815-1100-45be-9673-2c6b8ed79ea7", "comment": "Malware payload (Heodo)", "value": "2c1e22168bf02ba0a6228ce750e66274532d827a72e983fc08df7e24f93887ab", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647430297, "uuid": "3e8f034e-9a95-4668-83fd-1d97fc2a8c12", "comment": "Malware payload (Heodo)", "value": "b257737c3721a44b23ebc2cf2fa3cf38a99f30eb", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647430297, "uuid": "b6af030c-647f-4360-9588-b5936295b532", "comment": "Malware payload (Heodo)", "value": "54b52e8e4566c28e60e8d450edde0ed9c609ba7a6bf1ffc54429ed72fb4bc1cf9a7f87a330e53c7c1106d72007105e55", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647430297, "uuid": "3238ab52-900b-49b0-8a7f-31fb129cf0f4", "value": "T129E2C02DF2A0EE1DC21EE939446895DA421DB4558502EB4FB95CFB1D2F0A5C23B1F0DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647430297, "uuid": "9b34962e-cef3-4098-82c6-34843c903ef3", "value": "384:8jzZPFhNjqEBOA7iEibbwBLg0SCdiVXUKgUrNU/qWhZOdBNPJM+kqr9eCgh0k5lY:8jpFhNNlizXT28dFfPdkqstJmE6/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647430297, "uuid": "6d45cca7-8a3b-4fe3-a666-ff51d5b0b68c", "value": 33750, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647430297, "uuid": "012dd1df-84d6-4c56-a6df-f8d36cd2f3e9", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647430297, "uuid": "5358573e-755d-4d84-8f11-3ff6f00171fb", "value": "Angebot-IVPB-632682747.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abfb4765-a57c-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647471542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647471542, "uuid": "775756d6-5fd1-494d-8707-911687cc8c8d", "comment": "Malware payload (Mirai)", "value": "5180ebbfc978f50bb1acd1703b4823df", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647471542, "uuid": "a0408dce-3b09-4dfb-96a1-6237b9b750e1", "comment": "Malware payload (Mirai)", "value": "2c6496289f6b65f688534b8e2ceaffc18447363091e2da4005ae89880eb13019", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647471542, "uuid": "26cf12f8-3c3d-420f-9599-9e4ecf723c2e", "comment": "Malware payload (Mirai)", "value": "982dbf3995d9485d5f44eadcfa894719a36434c4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647471542, "uuid": "217fcaa5-02f3-44c1-808e-21fb4392c4a2", "comment": "Malware payload (Mirai)", "value": "e788db6b4479fac99fa95e2ea0856cbf8745d573f13b0a5915b41b911a342afac07c232e5bd9da0237a8d4e383acdd46", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647471542, "uuid": "6a6da6fb-c095-4f7a-9460-28e728616591", "value": "T18F1316057C9FE7A1E850107E606A5FB1667EC2DE2448DFEAC31CD235AD42181A60F7BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647471542, "uuid": "bda0996c-f73e-4557-bb3e-5c63c259512b", "value": "384:fKZU4YCd8SGPsX81K0GLfMf8vKMZ1w39JTOBtCr9HbroCEUGzjfUWnTWZ75vBUyD:CAC0GLcAZynetCJ7rFGfcWDsmyhzDu0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647471542, "uuid": "74d4c99d-16ca-460c-907e-96587391bfd7", "value": 43308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647471542, "uuid": "379951f6-d0a7-4c3b-8ee6-deb147fb2075", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647471542, "uuid": "ba2b3a17-d03b-4d9e-b76a-0502d0ef3a75", "value": "x86-20220316-2259", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1ccca2a-a50d-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1647423850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647423850, "uuid": "d0b7fd38-48d9-4ea5-8372-4ecea876d7cd", "comment": "Malware payload (Loki)", "value": "e4600233fa067f6e84b595cdd4b12583", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647423850, "uuid": "53c71374-0052-4d07-9310-8099ea6721cc", "comment": "Malware payload (Loki)", "value": "2c9433ffb0833101bc86a2fa7bdfb21c864307921b85da0b74de06cd551d38fc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647423850, "uuid": "641eaff3-0fff-4b1a-88a6-08c5324a1a77", "comment": "Malware payload (Loki)", "value": "5d8f19c2e6aba28917371de00b896a126c15316a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647423850, "uuid": "09b4a6c2-40e7-450e-b858-0d18b5cd5a24", "comment": "Malware payload (Loki)", "value": "978ec319c164325af76e17d7236eaf123d85c4543a0598896741ed9c758a4b2359022d9fc0ce703cf2016477137a5789", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647423850, "uuid": "809e623d-2d45-4b0e-a248-6184eb144278", "value": "T15554121EB8E08CA3DAF42DB468B7E767ABFA80D80091355B5FE53F6D1C915E7042C660", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647423850, "uuid": "aab229e9-283c-43ef-9c96-9870e9aa032f", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647423850, "uuid": "b65be996-f4c5-4636-b7ff-d08f321435ca", "value": "6144:rGiu+q+v8Y84Pouef7s5BGGm2NI2NZL7A+cPXhQNJCkDeJ0Z:C+qy8j5ueoX8cH7AxPxWlKg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647423850, "uuid": "613ef284-580f-4f04-ad44-dfa874e65917", "value": 302532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647423850, "uuid": "e0efd4bc-a7a6-4c1e-812c-021117b06617", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647423850, "uuid": "74be114b-c843-4a80-b869-ca56a3187f07", "value": "e4600233fa067f6e84b595cdd4b12583", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "947de08a-a4fb-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647416097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416097, "uuid": "ae24f028-38ed-45c6-9da9-45b344b8bb91", "comment": "Malware payload (AgentTesla)", "value": "ea995b969b0731be0cd09d32eb154cc9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416097, "uuid": "07f59f4a-922a-418e-b04c-8360de04a909", "comment": "Malware payload (AgentTesla)", "value": "2cb04eecfa244cba67a5bb51021c39605e37a75cd8231be675944c50443cc85e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416097, "uuid": "fddfc587-57a6-4364-a3b3-0eca5e7c46af", "comment": "Malware payload (AgentTesla)", "value": "8608eb52418485aa6cc3c19871599e17c09d4b6a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416097, "uuid": "96adad4b-1f2f-4a2a-85ea-d12183a5a689", "comment": "Malware payload (AgentTesla)", "value": "a81325ed705c280633964396a697e75b3d732711e8d04cf7d7f363be8b61b14e9a326cfc3d869948ea909a3783b9eb94", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416097, "uuid": "373069dd-339b-4885-8793-0eb91a970e17", "value": "T18074225216D0E8FBD505053039F7F7B9EB7C86D8911B0A834B724DEA7DF619A840E2E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416097, "uuid": "0ae6c69d-6d36-4002-a924-78b2fb7d97e0", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416097, "uuid": "4db0e0d5-736a-4910-be04-8918d2f7d8e1", "value": "6144:rGiJnIlZF9AXOSA5Gll70ds2Fnr//fH3eCKeAcRUxmKiM/HBVRH4m:NnIlZlSDlCdFFnzu0AXA8/BVR9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647416097, "uuid": "4909e05f-4a9f-4686-8c99-1bff496c2089", "value": 351632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647416097, "uuid": "552efdbc-4f3c-4374-ab5a-f664496ab316", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416097, "uuid": "bc014589-24cb-4de7-a7fb-5d72972ee90c", "value": "PO DRAFT-Mt ch.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b9679d6-a500-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1647418042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647418042, "uuid": "b711aa11-b529-4dcb-97bf-1ad6753187dd", "comment": "Malware payload (Loki)", "value": "c7c68aff9d0983d7629d13a52cf59f99", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647418042, "uuid": "746c9200-c9b3-4903-a209-2fc6302fc187", "comment": "Malware payload (Loki)", "value": "2d5d2f4a593032be2281c2d6af0b0394cef9e83ac99a01c1246e68a8a8735b05", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647418042, "uuid": "6de8160f-1a4c-4676-b655-0a3a4c9ebe1b", "comment": "Malware payload (Loki)", "value": "4885e014068e4b2cc5149f2a846b81f636f877f8", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647418042, "uuid": "41797095-5961-4455-a952-32a5d99e7f68", "comment": "Malware payload (Loki)", "value": "c74d89595fbef457fa6cd08dfd07ac91ff979e5e25cffc59065a175c31142710bce13ae0e0ab21f0cf8d2d47ad6a7045", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647418042, "uuid": "52981952-1f12-486c-ab47-51d7dc6dac43", "value": "T1090412CC745F631CE89CA63FAB6160F433B9FDE04250458F0AC4BA4EC8BA6C19597A65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647418042, "uuid": "bf198872-fd5f-45ea-9e0e-7764483775e3", "value": "3072:OxDfoopWuAa7cvOdePqN2NWhq9e7fJ5q2sKD2tYEAKOsdLW6ugrZmi:eDdWa7cGeScNWhq9eJ5q29+AK3dLW67l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647418042, "uuid": "2606ced9-b4f0-4e82-8ea3-777b3af8be9e", "value": 190120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647418042, "uuid": "8221945a-c76e-43cb-8663-8cf0680e5777", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647418042, "uuid": "246c2478-f633-48b1-91eb-cf9aa18d2f53", "value": "Paymentslip315.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ffd8eab-a507-11ec-9275-42010a9c0029", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1647421244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647421244, "uuid": "02bb7904-321e-40c5-9374-a31083a13165", "comment": "Malware payload (RaccoonStealer)", "value": "347ef9297bcbb7a6bb58653f3954ddae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647421244, "uuid": "a5072b45-dc82-4deb-9a73-bac36fd31184", "comment": "Malware payload (RaccoonStealer)", "value": "2eef8577617e660b457890db4c6c8b914508725fd7dba90a47708ae9629fd51c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647421244, "uuid": "4d19e11d-926a-4618-9546-7d843137dd4e", "comment": "Malware payload (RaccoonStealer)", "value": "cf97de9f4aa0416be11d81cdfe745457b2a8db42", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647421244, "uuid": "3de2cc5a-0e1a-4d94-909b-66ab56b4644c", "comment": "Malware payload (RaccoonStealer)", "value": "2cdc1144cc58327c0efeeb10dce1dad5c9986f5d874122fa952ab57e157f36c40febdc1df21e98d0ec8eece3cb9ccec7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647421244, "uuid": "3058bf0d-ab4b-439b-9bd0-df6549825972", "value": "T12BB41281B260C137C5E268B01955C7F26B3BB4319A76C58BB7550B7A2F703C2A67B31B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647421244, "uuid": "d28aa52e-8089-4a82-b395-ee91818f1a7d", "value": "6f7f7795d0111d5087004eeee90a01d8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647421244, "uuid": "ad961db2-7b8b-4be2-b58d-f8e2298e3082", "value": "6144:/ikk1E+EalUz9WfBgLL6mP5BmubTrYMvRIfcxU9wLWTfG6Qr8:/LkC+Ea++BgNxgjY6wLqfG6Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647421244, "uuid": "719a2475-257e-4ed4-afc9-e1869758c7f6", "value": 536064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647421244, "uuid": "138125fa-4309-4ac4-a8ee-7ed6cae68037", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647421244, "uuid": "8be08ec0-790f-4912-8cc7-d963419de0b3", "value": "347ef9297bcbb7a6bb58653f3954ddae.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72955bfb-a4d6-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647400149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647400149, "uuid": "2fae7219-6bed-4a33-9a93-9ab17940114c", "comment": "Malware payload (Mirai)", "value": "853b6607f2760bdf99da11d396d99f5f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647400149, "uuid": "6996ca2f-a230-4fad-ac4b-97d2c17a4260", "comment": "Malware payload (Mirai)", "value": "2f23c4fa60434b470ff4869e3e72f76f9d2924e1f0e6b6aa22d152474f4111d6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647400149, "uuid": "854b8351-599c-4eb0-8b9e-3b47aceb892f", "comment": "Malware payload (Mirai)", "value": "95181d6b96914e8261ba3b65765e72fb1591a5ee", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647400149, "uuid": "2fdfd061-f963-4b4b-9279-7025fdd94fd5", "comment": "Malware payload (Mirai)", "value": "b7c209c19672b3fb4caf429d3a303590cfe4373fcaccd41e496c72688e7b59956a2ffcb5eddbfc3e77e1b61b5b8bf5ee", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647400149, "uuid": "cebf4054-82b8-4c0a-82b7-17d9045d7491", "value": "T15E93E615BF610FB7DC6BCC3709AA1B01288D915B22F57B36B934D828B64B25F19E3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647400149, "uuid": "61ed0ddb-cc7b-44bf-b58c-d4cf1577cb42", "value": "1536:1MRJKiESq2A7h+3wUVFESO9Gw9fdndIZp2qViJa10mu:1MRJKixqF7hUwEFEHdIG43u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647400149, "uuid": "35269cca-d10b-4e2d-8f33-9b178dc982de", "value": 89604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647400149, "uuid": "191328f8-6779-4fe2-80c9-d42534f0a342", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647400149, "uuid": "b2b4a562-8a51-4970-a3a9-8995aabdd106", "value": "853b6607f2760bdf99da11d396d99f5f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9df96273-a4bc-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647389055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647389055, "uuid": "51b8c243-2e75-4a98-8152-c2146439a0ea", "comment": "Malware payload (Heodo)", "value": "74d91e02a34cc29de11b714cc43395d0", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647389055, "uuid": "31265144-12df-4308-8367-7e2361897a69", "comment": "Malware payload (Heodo)", "value": "301fed74eb5425bf0ca2e4cb58f4455ff2deb1fc38779a325d452fef5bd87bf8", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647389055, "uuid": "cbfa32d8-8ef5-469c-bf32-4317e6b52110", "comment": "Malware payload (Heodo)", "value": "c13ce87bd651101ac38046ab8109d0f7fbaf79f1", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647389055, "uuid": "f244eecf-7c48-4f05-aff1-d70b69ca85b0", "comment": "Malware payload (Heodo)", "value": "5f415ae3e7b8b3feaf27b2eea46b0a70c5249853d961e51dedfc84fe6187d0730a0c947fd74b843375fe220ef0a511d2", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647389055, "uuid": "960f1874-a154-4792-8d81-ed30e562d688", "value": "T155E46B0124A29C71C3E7C9756BD91E1539EAEA92CFF7800BBAE06B7CD874942C337516", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647389055, "uuid": "c52ed210-88d2-41f5-80cc-3352f6b5f213", "value": "a38617efee413c2d5919637769ddb6a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647389055, "uuid": "0ee5a690-9ba1-4079-88e0-d96a339c4f2b", "value": "12288:KFxGsTPy4BHT4Sj1zfFf7ABqDLkWynCsZ:obPy44Y1hf7VDLkNnh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647389055, "uuid": "88909246-b58f-4758-a32d-a03d6d155412", "value": 704512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647389055, "uuid": "ba6788d8-d4d0-4700-aefe-e73c62a44d49", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647389055, "uuid": "8ff0cee9-b65d-4271-b944-0c27283d0ff4", "value": "emotet_exe_e4_301fed74eb5425bf0ca2e4cb58f4455ff2deb1fc38779a325d452fef5bd87bf8_2022-03-16__000409.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc717374-a51c-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647430364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647430364, "uuid": "4813b43f-f9bc-471a-96c4-4c43187fda12", "comment": "Malware payload", "value": "8846f1c47ed23605e75e51ed93c61d41", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647430364, "uuid": "9b3db6da-7228-4e0d-a3f8-fcb74041fa1f", "comment": "Malware payload", "value": "30454c645aaadf73e1c33b2a9c179b791df8b3721d1f6f3a29c4abcdad34c575", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647430364, "uuid": "b754e937-05e5-4d34-84ce-bdba59ff96db", "comment": "Malware payload", "value": "105339363e886465ffc0f773bbfa2ea21dd0236c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647430364, "uuid": "a853a1f9-0f8b-4a4d-852b-4484bc57d2b1", "comment": "Malware payload", "value": "8a6451c3a180e55969e9ab16e9bdeeb55cca5ab69c77f833b8aeeb7c22658579d090425ab5f98b75b923ea0474ec5a7c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647430364, "uuid": "fa9f5ef6-8809-406b-ad7b-b266cd3c96b1", "value": "T1D435F19D339072EFC9A7C933DA641C64EB21B87A570BD607802716ED9A4D697CF102F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647430364, "uuid": "d9c71fc9-6a52-4acd-9315-628b974aa08a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647430364, "uuid": "6c85cc51-03c5-445b-80fc-f482d08b8157", "value": "24576:PiEwOTLu7X0A0Kdxi+5/ur0KeBxBcbuZuZdtCvUZwTyB:aEf27X0A0KvvSIVXYZWsU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647430364, "uuid": "e5374177-d23a-43a2-a03c-37600883a37b", "value": 1146880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647430364, "uuid": "e0cfcd9a-10dd-4051-b35c-a6680308a10d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647430364, "uuid": "04ae92ff-fa11-4508-a86e-fb6f85866910", "value": "Advice_018290PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14c2e577-a4f5-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647413306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647413306, "uuid": "8f7f6542-516f-484a-8ae4-3f96eca70abe", "comment": "Malware payload (Heodo)", "value": "cf75b2019903db36459c3a3e3111cd89", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647413306, "uuid": "ca6e2d28-d84f-49ef-a0ad-afb5d71ebd16", "comment": "Malware payload (Heodo)", "value": "304e27034a09abb963098f6838fff392def9fbfc3f69403145343f65cb6091cf", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647413306, "uuid": "c1cfb20c-09d5-4445-bfcb-7b82d96abb56", "comment": "Malware payload (Heodo)", "value": "9e0b667cd6dba0306b667d7759e288446406acee", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647413306, "uuid": "d76ac50a-4a92-4384-b92f-cc5bd194dc55", "comment": "Malware payload (Heodo)", "value": "b2db6a9a90e2d24fdd941b0e0b92b352ca061c3808ecf333a3fb7d84e6656384c7bb967bc2a39f0ff738b54f04627738", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647413306, "uuid": "cc78e1a8-1735-4004-8eec-457fc68b1cbd", "value": "T185E45B06AF22A1F0C06B03B40555125AC2EF7ED0A72ED657825DFB7EDD339973A30226", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647413306, "uuid": "0a35f1af-2eb2-4a7c-bec4-ad4abaf89573", "value": "066d4e2c6288c042d958ddc93cfa07f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647413306, "uuid": "c5d4c233-3b8f-4333-a038-748d4c602d2f", "value": "12288:jc899XKPmN4WMkoQ6ZPJSFTdtXlcIL9v6O8:7GP7jgFTdFL9v6F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647413306, "uuid": "28346aa7-29be-4a6a-b9ef-ab900ff7f4c6", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647413306, "uuid": "c44ac0e8-d296-4a88-ab74-ed7589cd5dff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647413306, "uuid": "fbe92c46-3993-4282-a39f-b826e82526ff", "value": "emotet_exe_e4_304e27034a09abb963098f6838fff392def9fbfc3f69403145343f65cb6091cf_2022-03-16__064821.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0efd3f6e-a4fc-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647416303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416303, "uuid": "564ade63-9098-4f59-b1cf-04124d5c68b4", "comment": "Malware payload (Mirai)", "value": "0be8530f22a343bbf1e0df5b0ef1f5d2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416303, "uuid": "1d62420f-5d61-439b-abea-b47502285c15", "comment": "Malware payload (Mirai)", "value": "30a99755d63a9d01fcdec75f92a0c921c1d6250fced5bd36bd61b7f8727fb4d9", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416303, "uuid": "fe331ab7-2166-436f-9f8c-434e7519377e", "comment": "Malware payload (Mirai)", "value": "21539c6878629eb64df961174d99fcd7e80df306", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416303, "uuid": "73bf2c49-bad3-4a00-83d0-fcf8ec6e69b9", "comment": "Malware payload (Mirai)", "value": "00eb4321748ffc578b69d6c627067d353d2cdf641c6ea8ecac2a7a61c6454b65d5d9b1676075a6fb26b2b4e4422e8c72", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416303, "uuid": "ef924d67-fddd-4e8d-a74e-42dcba0ede09", "value": "T17D430856BC818A12C6E0127AF66F85CE3B2123E8E2DF77079D211B6136CB41F0D67D96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416303, "uuid": "bb87dcbc-8959-4deb-b831-bcb4a572dd7f", "value": "1536:FH0Rv9hcS5f76tdOE1gSqwcO8rsnBXuL27PyhFBw:FH09gQ3jWBg27ahF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647416303, "uuid": "210476c9-9cb9-4ed6-8d99-b8a183639f9f", "value": 60476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647416303, "uuid": "ea3409db-2936-4cf4-b57c-be8b8425ce6c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416303, "uuid": "6149542f-3c12-4437-b85b-14445e8ce27c", "value": "mirai.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4a74b35-a55a-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647457061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647457061, "uuid": "6be3643f-6534-4e81-8518-414f31f48899", "comment": "Malware payload (Heodo)", "value": "4d351fe428b56fe2c8390d1bd929ef1d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647457061, "uuid": "74d92fa0-f1e7-4448-a626-609d1ae88950", "comment": "Malware payload (Heodo)", "value": "311055d86d16807bb9ad1515f79906e02fe7630ba531931fb1022fd80005c3b6", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647457061, "uuid": "fb273398-3faf-4601-9c36-80992c5e5499", "comment": "Malware payload (Heodo)", "value": "65ea04e758971a2262948df2e6036972216df681", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647457061, "uuid": "f348d9fb-f515-486f-8a48-f51280c0e2ec", "comment": "Malware payload (Heodo)", "value": "16218d6e19d47038f93866873d1406495b84ef21497103b550b4df82021d9778bb4ab309c49f6d4da9785f08eb10c043", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647457061, "uuid": "3ad7d99a-888c-48d8-a998-9a9567985b53", "value": "T118F4CF11B2D1C076C1BF06741916A35D63F6FD608BB9878B6FD02FAE3EB45828A34356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647457061, "uuid": "679a0de1-ddec-49ed-9d17-ba324666ee0b", "value": "66a21a1bcb4077b3ed89c00ee693486b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647457061, "uuid": "1b4e4d20-f209-46fc-a435-58cc149a00ff", "value": "12288:WZjb8BOPxue5dKV9M/98f0koPnXvkgKtuBdfMAofD:WCBAdKV9Xf0k03KMBdkAofD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647457061, "uuid": "2bedc049-d916-40cc-aa84-f467b12525e7", "value": 753664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647457061, "uuid": "b8417800-45bf-4250-87bd-ecea015563f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647457061, "uuid": "f7d5c968-cca9-4cce-b30a-eaf633c37814", "value": "WKrayLQ3psN8sFj6e96TZSN9dcpjJFwe1gK.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e65cb7f9-a50b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647423106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647423106, "uuid": "7b09239c-3093-4ca3-a9aa-5dcec3ffba6b", "comment": "Malware payload (Heodo)", "value": "e92948e9dc37d4520b5f650c45aba552", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647423106, "uuid": "2f4681b0-aeac-4681-b1a5-c3c9f680fa13", "comment": "Malware payload (Heodo)", "value": "315d6240bf34e4b0e737eaad2ae9d9605966b63adc8fc1ccddad9bb5b374431d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647423106, "uuid": "842c6613-4d89-4e0d-b05b-07af33bc2543", "comment": "Malware payload (Heodo)", "value": "9f65b189197b7eb58f5f168bd28fdff11fb92651", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647423106, "uuid": "63da6147-520f-4c6c-8006-9401310937ab", "comment": "Malware payload (Heodo)", "value": "ddcc50bdcb62111bd44789817d5d92c1be57f290c2fc6245697f6cd8148353f73a80ee9a52e4b004f4d942edbf8c2258", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647423106, "uuid": "b1138925-2250-4d2e-bfee-6103cab35f35", "value": "T1B0E47C12F461B2B9D04B04741F1723A86EEF5E518629CA13AFA8ED5E1F31251FC3FA16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647423106, "uuid": "3685f64c-9f04-4518-b0ee-0e60b14ad2f5", "value": "066d4e2c6288c042d958ddc93cfa07f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647423106, "uuid": "62d07628-ab8c-4c51-b639-de1e86d7c881", "value": "12288:DtAanana8Meee0GBGu3qI+3DNJ3vE6v5e3xS332d7t5hT/hexLx:Kanana8qGBGuoNxE1xCM7o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647423106, "uuid": "5528b768-68f3-4693-9339-a06922eb4e8e", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647423106, "uuid": "a21c5c2d-a321-450b-9983-a07ec11ed334", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647423106, "uuid": "c144d2c3-5a17-472b-9ed2-471c599f2a5e", "value": "e92948e9dc37d4520b5f650c45aba552", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07f778cf-a51d-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647430464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647430464, "uuid": "67d206fb-22ab-4962-9540-493a6cad09d8", "comment": "Malware payload (Formbook)", "value": "b98e327d3c74d34f2d24045203d6d444", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647430464, "uuid": "0bfd03e7-35a3-4fec-853b-504a2ff7861e", "comment": "Malware payload (Formbook)", "value": "3187cd1781fc325d7b92b7100ddc3c628622365cfc6cd8df9db093cd8ccb1caa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647430464, "uuid": "24de116a-06ec-496d-bde8-158a9a08547f", "comment": "Malware payload (Formbook)", "value": "b66bd546ed3ae8a43bfbd3d22f11ddad3324faca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647430464, "uuid": "bdda7bb4-133b-44c1-a724-ddce56c069cd", "comment": "Malware payload (Formbook)", "value": "79d145c3e1c8712efa1f71c0b85bf794d883c786b7b6cd70cc3ef402b30c4ae49cf80af8389d98a3161ae6a8e8201bd3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647430464, "uuid": "0fa9151c-9a05-4d6d-815b-b32663dfcdbe", "value": "T1ED6412D2A59685BBEDF515740535DB1CA1F39E8E42662F1F4384BE6B3EB3383801A843", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647430464, "uuid": "2dcb1834-f00b-485b-a65e-43ab74529985", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647430464, "uuid": "1162d679-a304-4214-90b2-3b01abb1084a", "value": "6144:LGi4zy1uJetTHmKs9okWHVpvJYfbSSpNNSdtv04qdOE/D7xxSrnnpmq:Gy1ukTGKs9o/HVBJYfbSSXYrvlq+7nMq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647430464, "uuid": "732d9647-ae76-45d1-84a2-4361bd6fb2b7", "value": 330150, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647430464, "uuid": "e8f2c441-db88-4d4f-978b-85543a687fb4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647430464, "uuid": "ed015486-23af-40c7-a2f7-4aede217d312", "value": "KGA20-AC-B6 RFQ Mancuso Nro.6315-22 6313.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d31438f-a4ff-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647417749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417749, "uuid": "63d1f686-366c-42f7-8ead-4b9eb16fd8f2", "comment": "Malware payload (Heodo)", "value": "3aeb695eca4ea10b1be75732e9112028", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417749, "uuid": "f759c245-c2db-43a8-9465-3b350f42b4cc", "comment": "Malware payload (Heodo)", "value": "31989bba9d0cd48133969f30761c345352b15417bf24de9ec8dbdedf0c787f39", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417749, "uuid": "c0c5774d-1dc1-4959-b6e8-92dfe4de66b4", "comment": "Malware payload (Heodo)", "value": "a0cadd6d0e099c7aa77529b040e2d0e2e1ffd677", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417749, "uuid": "e587b638-3a96-4336-be22-ba281bef7163", "comment": "Malware payload (Heodo)", "value": "c38f9402db2f8306c3363783a545a5f56bd284cdb473c6a2e61328f85cbd7949fd989a85edaa894a65f1824e7f6b808a", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417749, "uuid": "f134fb9c-f07c-42ff-91bd-76e898497740", "value": "T11CE2C02DF2A0EE1DC21EE939446895DA421DB4558502EB4FB95CFB1D2F0A5C23B1F0DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417749, "uuid": "3392adb1-d422-414d-8ea3-db7956286eb4", "value": "384:AjzZPFhNjqEBOA7iEibbwBLg0SCdiVXUKgUrNU/qWhZOdBNPJM+kqr9eCgh0k5lY:AjpFhNNlizXT28dFfPdkqstJmE6/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647417749, "uuid": "7d41ca1c-fb9d-4bff-b3e3-604824a0733d", "value": 33750, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647417749, "uuid": "1e90bde8-4271-4c99-87ca-67969156641e", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417749, "uuid": "084a3b37-bb6e-4360-a924-ffee86e24320", "value": "2022-16-03_0859.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66ac2b69-a535-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647440931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647440931, "uuid": "7bfa1b5a-e330-4da7-8630-4c0468048040", "comment": "Malware payload (Mirai)", "value": "13c5a8d15abf85dfb87765338a5f68e4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647440931, "uuid": "96634902-b845-40f5-b607-9a9c9fb0e477", "comment": "Malware payload (Mirai)", "value": "31992eec1a7c6ee00f4896a15f8d17f0320bcf22dc73b84248ed7cb8bf8c0bb4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647440931, "uuid": "c90e503e-1671-4c88-82ba-7cc64b0bfdd9", "comment": "Malware payload (Mirai)", "value": "7f8481bad626a26589b5bce2d7e9c40c32aee20e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647440931, "uuid": "4618467d-32b3-4bc3-9734-b065d3c2bec3", "comment": "Malware payload (Mirai)", "value": "0d032f9e8443a55bac10074de9ffaff3333b522d71596c12328996bf21cdf54af0ac78b35bd9d8ba707bc5116018a41e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647440931, "uuid": "d906f239-2de9-4a00-abfe-90f8290e348e", "value": "T129D2D0231A0224EAE24E08F68BB51FE11FE04F71A1B6CD4AAD5119479F426697CF5EC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647440931, "uuid": "a52cf126-63ef-4c29-9dd0-3f9c9dcd0084", "value": "768:329bEK8U2qqQORFnsel2noVfvYioF/NIu14XblJgGlzDpUYss:CbUqqBFnGoVfwi4r1+DVqYP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647440931, "uuid": "9c34386f-d366-44a2-a921-643f9316bd97", "value": 30872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647440931, "uuid": "74132e0d-6c54-4ce9-bb88-927300270f94", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647440931, "uuid": "c592a6fb-5e0e-4392-ad4f-6504736e0a4c", "value": "13c5a8d15abf85dfb87765338a5f68e4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d463c2e-a4bc-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647389054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647389054, "uuid": "4fee4a90-937e-4afb-86c9-27024bb9bd5b", "comment": "Malware payload (Heodo)", "value": "c0ef1a167b6bf7cff0ac86b10c513679", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647389054, "uuid": "2b5779e3-1120-408b-8a15-08c3395f3daa", "comment": "Malware payload (Heodo)", "value": "31a6acf0dc8a5de75174d4e6e083715b421a1cec469d34fd115dc76e0380b933", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647389054, "uuid": "a71e099f-77c3-49d5-b258-c0039985c667", "comment": "Malware payload (Heodo)", "value": "439c1b884fc818be110dae010f21174d616f4d27", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647389054, "uuid": "6b8abbc3-ca99-4568-b8c0-8913a4ae3914", "comment": "Malware payload (Heodo)", "value": "b337fab43332f8e71f7308874ca2ba88bdc5d068b80ace75dfb97ec71e2ad8c24762e9da4ca9dc78ce92ddbf4d2ea35d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647389054, "uuid": "637f5fc7-7589-452c-a256-69cb30f6520d", "value": "T15FE46B0124A29C71C3E7C9756BD91E1539EAEA92CFF7800BBAE06B7CD874942C337516", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647389054, "uuid": "155984fe-6697-49fb-88b2-4d3234db6ac6", "value": "a38617efee413c2d5919637769ddb6a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647389054, "uuid": "8221b8a9-3d20-418b-b341-74c015e5e565", "value": "12288:KFxGsTPy4BHT4Sj1zfJf7ABqDLkWynCsZ:obPy44Y1lf7VDLkNnh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647389054, "uuid": "e0eb7050-6ab7-42ab-8e5b-b16c201c1548", "value": 704512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647389054, "uuid": "e3d61c29-50b4-440f-b5dc-db004496fa7b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647389054, "uuid": "fb856b68-59f9-453c-8d8b-51acd6c56ef5", "value": "emotet_exe_e4_31a6acf0dc8a5de75174d4e6e083715b421a1cec469d34fd115dc76e0380b933_2022-03-16__000408.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b8ab98a-a565-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647461475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647461475, "uuid": "74d04635-3ef9-437e-9b04-a9a1f6bba03a", "comment": "Malware payload (Heodo)", "value": "e78b6b2dc7223f4f3ef8ba5eb58c77e1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647461475, "uuid": "c36e417d-256d-411f-9e0d-0b2855680a1e", "comment": "Malware payload (Heodo)", "value": "3216b13dcc2d904c9b858bc8b42717396a398872919624d164ee46fddb1bdeee", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647461475, "uuid": "1db40218-4358-4718-9325-bb5e0bb23dab", "comment": "Malware payload (Heodo)", "value": "dbe38e262fee91c0008cf0a44c78c1c7aee8aff0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647461475, "uuid": "58803840-218e-45bf-bbaa-6e29212ed5db", "comment": "Malware payload (Heodo)", "value": "e578c31ecd80454eea68a595f9da680bec18de1d8e8bc508a7ef7fbf07091babd8e27455f6193cad9089f1bc49f3cb59", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647461475, "uuid": "545cbee7-74a1-4012-9890-858f2ecf780b", "value": "T1D4F4DF1176E1C076C1BF12304956A38D23FAFD509FB986976FD02A6E3EB41828E34767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647461475, "uuid": "0cd604c0-491c-44a6-a7af-cf126b88e103", "value": "66a21a1bcb4077b3ed89c00ee693486b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647461475, "uuid": "fba104be-b565-4ffb-8477-82632d843c11", "value": "12288:g6O4TpP0XjxCCFJuf07j+Xk7hY8rLneTfABCJoWRWwfpW:BeCCF88j+Xt8OTYA7pW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647461475, "uuid": "198bab38-3059-414c-bda8-4783d99130dc", "value": 749568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647461475, "uuid": "1df1f6cd-aeff-4f32-98db-b329d80ef63c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647461475, "uuid": "53555ab5-c109-4616-88ff-6a7fa62f3e14", "value": "e78b6b2dc7223f4f3ef8ba5eb58c77e1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5784bd1f-a532-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647439617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647439617, "uuid": "2c2d13ad-49a5-45f7-9cb7-b16ebfd516eb", "comment": "Malware payload (Mirai)", "value": "fbe74fa03e32421f27cca0d70e41be85", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647439617, "uuid": "86d2404b-ab5d-4815-be66-4ef1fb817561", "comment": "Malware payload (Mirai)", "value": "3246d70705bad9bce0aab90b245643f51e8c6e0c1d8151a0e93f78831509e12c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647439617, "uuid": "e55cb7b8-985a-4090-b099-01f0df09b17f", "comment": "Malware payload (Mirai)", "value": "e1820552482c277eac60e91222d4284b8a7f9204", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647439617, "uuid": "3cfde985-5772-45f7-a225-19b5e34b18a9", "comment": "Malware payload (Mirai)", "value": "61d6e4c7fc714dfcd2954a7e3c36fb1b7a1f98f66433df419f5fe2abe99cd8f0d22fb415139f6ffb60fb16c25c6e1083", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647439617, "uuid": "f7328f17-6a26-4bae-97c1-74baffee9de7", "value": "T1DA33B8492F21ABEDF21C82348BB30B34E7B816E156E0D7E5A15CE4084E61A1D647FBDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647439617, "uuid": "1c008ed7-4006-4583-b2cd-163465e7f57d", "value": "1536:PX4AO1TpH3NH3Vk3aqfUVfNLf77jzyNulUAhYn:SAUVfNLf77jzUulUAhQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647439617, "uuid": "7209d2b6-ed8c-4026-9e61-29a16dcc8451", "value": 52872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647439617, "uuid": "dddc151b-ab83-4164-9123-14ada44df3a4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647439617, "uuid": "a56223d6-8cf1-4834-bb88-99c2ab884093", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e58b9f40-a4fe-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647417522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417522, "uuid": "4bba9eef-0d69-4825-9cdb-c0e9fa7718de", "comment": "Malware payload (AgentTesla)", "value": "26cc2d6c935094c331e1a65675627f09", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417522, "uuid": "c69d4e8b-b0e0-47bc-99e0-7292c3f0569f", "comment": "Malware payload (AgentTesla)", "value": "32929bdd82dfbefae92503fe2c5d4569905ab265ecc7eed5b5da87dd8a5f2ede", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417522, "uuid": "1a9c8b70-10ad-4a9b-967a-4a3a8c4e4603", "comment": "Malware payload (AgentTesla)", "value": "1233a0204c3e382804fe7771a53b56bf61fcaa10", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417522, "uuid": "123f631a-6fe1-468c-b8f5-8f058ba5e8fe", "comment": "Malware payload (AgentTesla)", "value": "85375838ea6b2b27c022c552172a640256ad850f476f40d1fd148a84c293a5f93f6ce04c71458b657e0f6c14d60e6f22", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417522, "uuid": "ce2bb483-e562-425b-b09a-7600e23559b7", "value": "T1570512DD32994B83ED34C3FD92FA941943B5BAB0A165E6088C8670CB56E2FCD2524F17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417522, "uuid": "c43a841b-c297-4bee-8c43-769d0586d916", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417522, "uuid": "c2f4474a-6852-4f24-a26d-29f589e34d4f", "value": "24576:8uwOb2ZxEdh5d+hRZ/P4L/JzF5eKFBhsJwjtDi:8ufQChLYZa/d77jKmjtDi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647417522, "uuid": "0f689943-313a-48a5-9fe0-fca7fe221c3a", "value": 826368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647417522, "uuid": "0f223792-0971-4a62-86b1-5a338713973f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417522, "uuid": "e671fa66-0d61-4e16-bc22-ca5f2f4906af", "value": "documentos de env\ufffdo..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0646f3b7-a4ea-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647408557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647408557, "uuid": "36b44a76-444d-4f95-a37a-b654940e6b0f", "comment": "Malware payload (Heodo)", "value": "16d6324c58bdeb875f3102bcc55a87e6", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647408557, "uuid": "33f12b03-b01a-439b-abc9-a116be75f9ea", "comment": "Malware payload (Heodo)", "value": "32e843c35f0b39a4ff9d669a80da88322cdd4206caa24710e7fbe60db710597f", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647408557, "uuid": "ac833593-cb09-45c4-a147-185fbd02e857", "comment": "Malware payload (Heodo)", "value": "049c03597aa88654de8672990fc02a1b8c23d24b", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647408557, "uuid": "d4f88308-7b78-4432-b81d-53a0cbc6caea", "comment": "Malware payload (Heodo)", "value": "c1f90e5978199c709376fce049b16eba0f92f941914b52d5654f4a6f3aecda61c2fd759f2f5b117271587347498c5a52", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647408557, "uuid": "cb8c3f99-ac9d-4a55-bf25-03364384e721", "value": "T164E36C0361459F86C84883B86FD74690DF12ED3DDA922BCF21867B173B79EA14D0A53E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647408557, "uuid": "57ebd697-f2dc-43d6-ba35-76443b8a4a05", "value": "3072:4Rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAlhEvN8B/W6X1yxYovrepMUdQ6gSz4iq:Qk3hbdlylKsgqopeJBWhZFVE+W2NdAli", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647408557, "uuid": "954c9b6f-a476-4fb9-a304-6c59f4b1a3b3", "value": 144403, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647408557, "uuid": "8d3b27b1-ad2c-4d49-91cd-b97fb459caa0", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647408557, "uuid": "bf4fab9d-8e1d-4ea1-a3f8-3821dcc35d1a", "value": "Blood Pressure.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "addbfeb3-a52e-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647438044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647438044, "uuid": "60bd4c0b-e236-4876-a02d-e335ce726cfb", "comment": "Malware payload (Heodo)", "value": "b79605c98a4a24595500aee4065be752", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647438044, "uuid": "69b0e241-a130-486e-8814-eab14f3762da", "comment": "Malware payload (Heodo)", "value": "33430e189bcb2e489be30aa859bca8c14dcc975d599a6b1f1bb4eeb9f61f7630", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647438044, "uuid": "54c8c829-6655-429b-9b2c-ede6d3a18216", "comment": "Malware payload (Heodo)", "value": "cff678bf2ad5e3ee555930fb2c956aa75cdc5948", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647438044, "uuid": "71e9cdab-efc1-421e-b763-3c217939b299", "comment": "Malware payload (Heodo)", "value": "3c50a530ebfff44d3371601fdaf5d02962a5e00e0d8e5d16b0bd18f7246c09ebe0b96f041b3bdb94a9e496482c177a1f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647438044, "uuid": "08583e15-a2c3-413d-8625-3480c036b766", "value": "T19115BF133A91C47EC2AE10761A0BBB3B77F9DE204B368AC3A7457B6D4E725C24237255", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647438044, "uuid": "df2ccd68-6cb8-4f27-a66c-735ffc8b3fce", "value": "9a354c1fc39e5f7aac20532ec12588d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647438044, "uuid": "8b223954-5654-4c04-8498-0aaa1e391da2", "value": "12288:6Tkv3QgK8FedvC9JwY/3XAN2Wt/t6sQvI9qtCOOROPXKmb4M:eM48e09yY4N2w/tFQQHOOozb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647438044, "uuid": "87e6f118-e1c9-4dd3-a8b2-752e08fcc640", "value": 946176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647438044, "uuid": "3a6e69b8-f5d7-4cfa-b32f-3cb4a3964344", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647438044, "uuid": "cbc84c6f-664d-41e6-8e60-590bfc41604e", "value": "emotet_exe_e5_33430e189bcb2e489be30aa859bca8c14dcc975d599a6b1f1bb4eeb9f61f7630_2022-03-16__134038.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f189c923-a56c-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1647464786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647464786, "uuid": "ce32c79e-d524-4588-a082-940383f42c0a", "comment": "Malware payload (Loki)", "value": "92c99e831a15c990bd7f63947f257879", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647464786, "uuid": "20c950d7-8220-4276-a804-b559e8a4c9ac", "comment": "Malware payload (Loki)", "value": "3354670cc3f8d6566e0008f071253d52f9303a1e4d037ed19e92e8983c804f19", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647464786, "uuid": "c4942288-668e-43c7-a619-838cc0e177fb", "comment": "Malware payload (Loki)", "value": "b603534d8d1f55be846fbaeb9e5b54be77c35856", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647464786, "uuid": "999589a3-2e31-403a-a414-e20016f347b7", "comment": "Malware payload (Loki)", "value": "d880f8f19c4562fa41d2cea130f23393ebc8f43fd94d18c235fdd5da08129ebdba48ea6aa908e86f40bbe6839a2b1e99", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647464786, "uuid": "966441dd-f757-48dc-94d6-89bd3e7fba74", "value": "T19E64130D35C150BBEB47A03246B2EB69FFBFACD441E6034B9FD80E5A1E535BA450CA61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647464786, "uuid": "ac9971b7-5bfe-468c-a152-4acd762b59b8", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647464786, "uuid": "1bf1dff2-decb-4396-bd3b-11d89c324539", "value": "6144:rGiQpGyjP3gE57W2W2sXeOrXGfUH1kIX7XGNhAtHl7+p3HjX:URj/fwWYeOKf+72NhgHl7+1Hr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647464786, "uuid": "1c690a2d-9756-454b-9595-3243ad4116eb", "value": 309612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647464786, "uuid": "f0033193-21c3-48c7-a08c-b74b3057c7ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647464786, "uuid": "ca7f84f1-1805-4311-9acc-c2c12b201efe", "value": "vbc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01724e14-a556-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647454935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647454935, "uuid": "23b51337-8c03-4652-a752-7ae386005678", "comment": "Malware payload (Heodo)", "value": "6a54b11ee3bb41d10c0ea2dca6ec2aec", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647454935, "uuid": "e147280d-cfa2-40b3-a72f-fa85f73b711d", "comment": "Malware payload (Heodo)", "value": "3365d75f848905b5f5d0f598a1600759a8aa70e439e2cc8b204e3c68a797a5fc", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647454935, "uuid": "ba1d2451-a573-4e08-848b-292017531c5f", "comment": "Malware payload (Heodo)", "value": "e581b59d637532546e74568616c6018e2f7e57cf", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647454935, "uuid": "b4aeb0b0-3a3b-46cb-ace7-823388f44955", "comment": "Malware payload (Heodo)", "value": "092b8cdaec3da1b140e89aa29320dfafde90d43ababecdd5341f1c02b2d418e6b229ed83182144a8c83f76b523e17d7e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647454935, "uuid": "890a01c1-f409-4c86-a5ef-06be540211bb", "value": "T145F4DF1176E1C076C1BF12304956A38D23FAFD509FB986976FD02A6E3EB41828E34767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647454935, "uuid": "dcfb580c-5ec8-476f-899f-ab62dc0adb7f", "value": "66a21a1bcb4077b3ed89c00ee693486b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647454935, "uuid": "c3e47c07-7fee-4f46-8be1-099c79a44751", "value": "12288:g6O4TpP0XjxCCFJuf07j+Xk7hC8rLneTfABCJoWRWwfpW:BeCCF88j+XX8OTYA7pW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647454935, "uuid": "ab4b385c-03e0-43d2-aa23-4551713ee730", "value": 749568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647454935, "uuid": "593734bd-7713-4bd1-8570-fe94464bcaa7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647454935, "uuid": "e8577601-05a7-4315-a0c4-8d9821f366cb", "value": "emotet_exe_e5_3365d75f848905b5f5d0f598a1600759a8aa70e439e2cc8b204e3c68a797a5fc_2022-03-16__182209.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "880f1e92-a55c-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647457737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647457737, "uuid": "13c425ef-09dc-47b0-a152-887b0cebc225", "comment": "Malware payload (Formbook)", "value": "f2adcbe54ab2b9e288c2864117f70019", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647457737, "uuid": "77372cc7-e6a1-4940-ab18-8def8ef3eb37", "comment": "Malware payload (Formbook)", "value": "33a3c033ee1670aa88bd3853922c8ad9307c7700c36fa231414f5c96b5937546", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647457737, "uuid": "55277cec-f8be-44b0-8863-b3d86d98a126", "comment": "Malware payload (Formbook)", "value": "38d0894b7d92a6a2a19787677b1ae47ce4043deb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647457737, "uuid": "a1f874de-275b-4379-9dce-47a1aa7a3628", "comment": "Malware payload (Formbook)", "value": "d6148fe554903342eb7d5321b9862ae1f8db3334100f0de4a3b87d7037e84e15939914448eabd1ef575ecc881bbce4e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647457737, "uuid": "c868cdda-cc29-4b1b-8a0c-d2d27ec19129", "value": "T1E5C4BF59312035DEC82BCF3189619C78DFD16D76931FE22B58C335EEA67CA5B8E04862", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647457737, "uuid": "cb1b0764-4520-4483-abef-d1d6455f47fb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647457737, "uuid": "54f1187e-b887-431b-a8fd-4a83cdc63de9", "value": "12288:XU7IbqJzs2WUb5TC+fa2P1fd43FxSLAFXiuo9ZxlDvJ07lAKR6lKeRUcZ64TQlRT:HqJL1b5NS2NqF+9XxlTJBU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647457737, "uuid": "905262ee-5c77-4f37-86df-6bab09640615", "value": 546304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647457737, "uuid": "59e3643d-601d-4d80-a036-a071cde14104", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647457737, "uuid": "83dc3eb9-ed07-42ce-9c58-71f743fd4a51", "value": "vto.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "faf57435-a568-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647463084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647463084, "uuid": "e7d46431-d53a-4135-8c54-89dcbea064f0", "comment": "Malware payload (Heodo)", "value": "5e813581c10522bc2248885a724e3e5c", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647463084, "uuid": "9f24624e-10a2-4134-87e1-766a3a622ddf", "comment": "Malware payload (Heodo)", "value": "342d1c26cc30012cba957d4d110f6cdaf8cd0960a5726cbdaff4607b31c84f10", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647463084, "uuid": "8618c23f-3685-4f10-a1c0-fc1326d34dd4", "comment": "Malware payload (Heodo)", "value": "9f76ebd2fa91660002a7c271877c599441689936", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647463084, "uuid": "feb52a88-8ec6-4a64-b1a2-251229dff7fb", "comment": "Malware payload (Heodo)", "value": "dc98290de23ed26e8653f3f1c53cce13fe739a15b882d6c0640a9d213b4307a29b73c8ae29d4359174d74f455b3d91af", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647463084, "uuid": "96297563-88f2-4781-be63-bfb285315d9e", "value": "T14CA2AF2CA521B80DE37A683C830640FAD64F5D023147B59D38A0BB6D5B7769706CFAAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647463084, "uuid": "c7f4ff13-da2c-4c99-bc1e-1238a41bd7d5", "value": "384:uyuAi/NjwS8EibbwBlwHSYrLb5CzgObff9kC+xbX7o1vfD:lsNyzXTFCBn9kC+xbLoN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647463084, "uuid": "35506343-2568-4461-95ab-ffab0592b429", "value": 21628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647463084, "uuid": "3e660872-0b56-4ab7-b81c-82030052d1c7", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647463084, "uuid": "322cf32a-402d-4636-a180-b096f44d6403", "value": "Invoice 6010415990 D3728331.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15ddaf5c-a4fd-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1647416744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416744, "uuid": "ccf9559e-5f1c-491b-bfeb-ba80e3dfa1ab", "comment": "Malware payload (Loki)", "value": "0e474c36e58bdedd81222f17904cece2", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416744, "uuid": "407eef96-0351-44f5-9e43-6883cd88bcfb", "comment": "Malware payload (Loki)", "value": "34469b5d36e41d79148ff7a742ad91c723f3a5e06a13734d91ea243f47890ab7", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416744, "uuid": "0cc4fcf6-ae61-41a5-b483-162602ab11b9", "comment": "Malware payload (Loki)", "value": "abefc27b383d428a7cf3362c74db718c9eaee205", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416744, "uuid": "9268f973-e2d0-43de-a5ef-3ad8c43c49a5", "comment": "Malware payload (Loki)", "value": "c6ab75374a463ae4fc67874f6bad03238bc248d0c32185bf26272d6f81b9699d6adaaf8ddde77dd4e3c6b740f4af7a28", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416744, "uuid": "e3f49ae8-b5a5-4f11-9096-8c114aca1995", "value": "T1940412B0776A621DEF25367B32A9CDB074DAFC16A930A42BC4813B60AB75080C57DFD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416744, "uuid": "e408ff3c-3385-456e-91f7-1c1c6c91d4d6", "value": "3072:Dfx0xCcdvTudEPwDxv5cLOmYy1sf4Mc1kMAuprzpuflwxoeN+Nth:7x0x+GwDJ5cLOaMkFSlwxGth", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647416744, "uuid": "0ae2b590-b723-41bc-9463-b4c95b7dd30b", "value": 190216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647416744, "uuid": "ce080234-e881-4658-a801-d6a8f8a8114a", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416744, "uuid": "0925d060-5fdb-442f-9049-6646af878ef8", "value": "Purchase order.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c079990-a505-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647420351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647420351, "uuid": "b2cf1407-57b1-4758-98e5-c93d0fb35cbf", "comment": "Malware payload (Heodo)", "value": "1deafa437551f0ebccfe630739f90924", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647420351, "uuid": "2f4db0d8-da9d-4e55-8ecc-278a30c3698b", "comment": "Malware payload (Heodo)", "value": "348ec2c5339a193f9a6e90cdad13bc54be902756b5edbbfa7bae35eb70c1774d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647420351, "uuid": "02cdf819-f662-4858-92f1-8a82d913516e", "comment": "Malware payload (Heodo)", "value": "01114c539fc2df9aec51aa1de3671ad51323210a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647420351, "uuid": "765d474a-a6c1-4072-9956-a8f97db92e2c", "comment": "Malware payload (Heodo)", "value": "ac89b96ea37deb7fe32d72cf7c02ee4ecf264423057d2a16d558a2dfc1d96d1bf0854280fa62f0e9969bb3b243c8e0f9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647420351, "uuid": "e98ed6cf-0118-4a30-990c-6bec847b311c", "value": "T1FDE47C12F461B2B9D04B04741F1723A86EEF5E518629CA13AFA8ED5E1F31251FC3FA16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647420351, "uuid": "07cf8555-541a-4c41-8986-863514c5eb48", "value": "066d4e2c6288c042d958ddc93cfa07f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647420351, "uuid": "1888ddc2-f903-43cf-9f13-649903192d52", "value": "12288:DtAanana8Meee0GBGu3qI+3DNJ3vE6v5egxS332d7t5hT/hexLx:Kanana8qGBGuoNxEKxCM7o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647420351, "uuid": "c2dc73c7-6148-4a91-b5d0-8f36a2d4088d", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647420351, "uuid": "fa5d3124-1d36-4c97-922e-48add23bfb25", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647420351, "uuid": "eaab9e05-3f71-4328-a831-88e40be92ba8", "value": "1deafa437551f0ebccfe630739f90924", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0e50e2a-a543-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647447149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647447149, "uuid": "1efb09f7-2504-4e72-89ae-b30116055922", "comment": "Malware payload (Heodo)", "value": "f1d6f1878326d6af54c2c7b5fd76404f", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647447149, "uuid": "78f361af-d70c-49c8-8356-ac3829316912", "comment": "Malware payload (Heodo)", "value": "34b29abec4b8da1a50cda61f01439ad2869f09b278568c908e0fb00a8859d72c", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647447149, "uuid": "ac1e6957-9c31-471c-ae58-7d3ffe47136a", "comment": "Malware payload (Heodo)", "value": "152efea7973f63542b027e34aabd0820e699be9c", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647447149, "uuid": "c8b2bb6d-73fd-4d65-a5cf-64d5df596c8b", "comment": "Malware payload (Heodo)", "value": "1f2d1fa0cc5c87266d869886a20dbb95f1f882f17a490db2e3859a6ee66716f1278d88afa64e7304708c25f3c6b4966c", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647447149, "uuid": "01f5a7e4-ae42-427b-9562-babd03e21b23", "value": "T1EAA2AF2CA521B80DE37A683C830640FAD64F5D023147B59D38A0BB6D5B7769706CFAAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647447149, "uuid": "057c6933-df36-4ea4-8c7a-0923b8134aad", "value": "384:uyuAi/NjwS8EibbwBlwHSYrLb5CzgObff9kC+xbX7o1vfD:lsNyzXTFCBn9kC+xbLoN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647447149, "uuid": "f7872b89-1927-48d5-9b13-de3a72d0db53", "value": 21628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647447149, "uuid": "0d987ac9-782b-48f8-9b4d-2f078373d77b", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647447149, "uuid": "6b8e10b1-2390-4820-89f4-ba9711909b2e", "value": "Rechnung 2022.16.03_1651.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "322b060c-a530-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647438696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647438696, "uuid": "021f8eff-41b4-4cd0-aef5-26a3a9ab6b8d", "comment": "Malware payload (AgentTesla)", "value": "2b938371f4e8c04e8d2ac9e03c7e69e0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647438696, "uuid": "4f883e2c-ce0d-4396-9a5c-359477849a7e", "comment": "Malware payload (AgentTesla)", "value": "34cc604b02051636fbc8395d520b86547300d127fb4610db61a72875073bca77", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647438696, "uuid": "2293b517-0fbd-4759-91ed-bdb02b5aed9c", "comment": "Malware payload (AgentTesla)", "value": "3eda7fdf9589e4a7b560010b60350b1013b35031", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647438696, "uuid": "74f4046b-13d5-4be1-832f-86d7d0e73969", "comment": "Malware payload (AgentTesla)", "value": "7dfeb240bdadf40d04385507b58a6038f88a14ddc43ebbec420ca1392bb66228ac5d223fc27abb5cf23cadde6ae2f476", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647438696, "uuid": "9e609ca4-f9d5-4152-83f8-a068d08aac45", "value": "T1CAB4F192F1C1C49ADDE44A719C6AD8B80163BC9CBDB07A0F7292B75D66731E3030EA57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647438696, "uuid": "4570aa20-a721-498a-a2db-fdf876e4aa01", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647438696, "uuid": "00c26365-7597-4f0d-a9ec-f99691415a5a", "value": "6144:yGipvpWYikTX7l1B3Docs9yXFsHamTnAMSkup+t0ykrVNRQ8vshfhe/jG:MccrlXDocsIXFCAeqyMZrvl/jG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647438696, "uuid": "e14ed966-624a-44eb-bd1f-c696d0b759e3", "value": 519207, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647438696, "uuid": "52909fbb-6b0f-49c4-87d9-bafc00878351", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647438696, "uuid": "8bebad65-d8d7-4501-827c-6bf34bfc8a14", "value": "grace.jpg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e9e7bee-a572-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647467063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647467063, "uuid": "52da3d6a-67da-4601-8f6a-c9478179c33d", "comment": "Malware payload (Mirai)", "value": "f08cd159582e68ad6d0c43303f8cee77", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647467063, "uuid": "cb29a77e-44a3-4cc3-b1a5-d22840a4f587", "comment": "Malware payload (Mirai)", "value": "357831231d280850b81e9d1a43b8edd2c7839e6adc108ac57ec08227e9cfee38", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647467063, "uuid": "5faa0d08-09f7-4cc3-aa30-3c80bce8623b", "comment": "Malware payload (Mirai)", "value": "691c28c6d1c68856a2187686aeff63389a2571fe", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647467063, "uuid": "43c11a86-ab9a-483a-86f8-4d24a5363b69", "comment": "Malware payload (Mirai)", "value": "2025d1e6147cf677c78d574091493ac1d52995630fcea5fee5048b9205d01adf742b881253ff9c908ed69be7a77f1f51", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647467063, "uuid": "5090686b-70db-42f7-954e-38d95323055f", "value": "T130735A01B3584A47E5A61EF4393F1FE197BEEAC022E0F5856A1ED7465172E33484AFC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647467063, "uuid": "0cd8beb3-98a6-46e2-befb-65d951360513", "value": "1536:DNpp9RXI1vgi0uvM8zomz4KRyxOReqpNiSejOjNfXM:Xp9djCTomz4E2Se6jFXM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647467063, "uuid": "1dc536cc-3726-4fca-a564-566e6f756a47", "value": 79080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647467063, "uuid": "d158026c-f487-42fd-9a5a-694cca2f0fd5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647467063, "uuid": "4f6f32d2-e689-4331-a75a-77e1f4f9207a", "value": "f08cd159582e68ad6d0c43303f8cee77", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29861e7f-a518-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647428373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647428373, "uuid": "60596947-8d1c-4d29-a0b2-d39069fbe7a9", "comment": "Malware payload (Heodo)", "value": "acd801ef5161661ccb5c438b05cd9fac", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647428373, "uuid": "4fab6584-4269-482b-949f-735205c99cea", "comment": "Malware payload (Heodo)", "value": "361603637e4acdcc94696a68e453ede4a1d79ecd5cebc67361e7643781d39b52", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647428373, "uuid": "9af6a93e-9d5c-4454-a64c-7a3afd500ae7", "comment": "Malware payload (Heodo)", "value": "c391510e81e75bd2299b61b66fb12171cad6da05", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647428373, "uuid": "c8fd7b2e-8fb3-4e1e-a3d2-b188ca2ed1be", "comment": "Malware payload (Heodo)", "value": "6f6717e0c36152dd260f2c3a35f991005c2147c7aebf972a7c36047402d097bfed8606e81a02de25894df3bee5018025", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647428373, "uuid": "5c0ff378-50cd-4cd0-a2b4-8d8944ecf976", "value": "T1B9F2CF2DA3A0EF5ED61DED38849881EA421579154506EB4FA85CEB0D6F493C33B1F0DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647428373, "uuid": "5f976f31-9754-4fa7-b8c4-c427989e913b", "value": "768:cjFhNKbeXizXT2LxdFfPdkqstJ1goE6vS:cBTGeXgXUndkqegoE6vS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647428373, "uuid": "5ef13be0-b700-4669-a733-3d05857b0dfd", "value": 34391, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647428373, "uuid": "d9cec22f-f979-47d1-8f65-fe10165463b6", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647428373, "uuid": "c623face-8b8c-4771-a66d-5b59ea868cfa", "value": "FILE_PO_03162022EX.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "320a860e-a530-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647438695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647438695, "uuid": "ca60f236-1d59-4316-939d-97ea73728e41", "comment": "Malware payload (AgentTesla)", "value": "5dfeb5cc9fd600a6ac4063efca6af62a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647438695, "uuid": "81c7e723-f27a-46b8-b0df-249d731a7095", "comment": "Malware payload (AgentTesla)", "value": "362bd5db55a49c89fea1f000ad3a4ec351053338a2526de444829150765a46ea", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647438695, "uuid": "4838a346-9fe7-498f-a740-6ccd664ad8cc", "comment": "Malware payload (AgentTesla)", "value": "7a6de4ae91fa135f7e55ebc159a94e837394d13c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647438695, "uuid": "38b97ee4-f474-4f8b-8e97-ee6915c880b9", "comment": "Malware payload (AgentTesla)", "value": "aa05f397c8f0951f3b6e37ee0c64c959f899e53d3d7a2c9c1b862323c216ed10c1dcbcf5c7f89c49b1304ee083527fad", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647438695, "uuid": "e00f68c3-3c13-45db-8b51-d865e1e31427", "value": "T142C45B0A851491EFF94D8F389C66E22E517C8CC42E2B4601FDDC7DEE993CE887ACA151", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647438695, "uuid": "6c5f6d8e-3863-45f2-8c19-38ccb4dc3f8b", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647438695, "uuid": "776545db-6928-4f46-b18a-2560a676cdf9", "value": "6144:DYa6Q3xGeX7rXfxuSxtUAqhrzUWj2/x4jxYtJdV2Ogc57w04JA7MPIqWGN:DYCV7rPxFEtx+V2Ogc2k7MPAK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647438695, "uuid": "dd00ff7b-a510-4bc0-a11d-1093c9faa6ff", "value": 575152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647438695, "uuid": "b1a9240f-8168-4a97-86aa-caf6b7f7afa4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647438695, "uuid": "a175503d-8c52-4b89-9774-d05447a60e26", "value": "SecuriteInfo.com.Trojan-Downloader.Win32.GuLoader.gen.1628.13335", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1ef4239-a557-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647455687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647455687, "uuid": "84f6579f-b53a-491d-89dd-7c663f983f4f", "comment": "Malware payload (Heodo)", "value": "39453396c146b7898c15c2f8565b5bd5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647455687, "uuid": "36341394-86a3-45ec-b5b5-cf9f67e8aa01", "comment": "Malware payload (Heodo)", "value": "363f0801aaa42660d6a041e7a7b137d752aae85bd87a15ca6f4c97dabd3ff9bc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647455687, "uuid": "0f92e421-8084-4fbd-95f8-781489245e13", "comment": "Malware payload (Heodo)", "value": "d0fdcdbd5335a312d61bc92d61f14960d99fe0be", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647455687, "uuid": "558ea071-3d70-4579-9d5f-0ad79396058d", "comment": "Malware payload (Heodo)", "value": "ef0e83d189e31f0ac439f819c72299f266ac2dabe04334a429798e984436bbfd617adccc391c02d4f323a4fbc8ae19ac", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647455687, "uuid": "c6a62410-53d9-4373-91c3-5b474d5fa768", "value": "T144F4CF11B2D1C076C1BF06741916A35D63F6FD608BB9878B6FD02FAE3EB45828A34356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647455687, "uuid": "163e187c-6663-4f0a-9afd-f596316092de", "value": "66a21a1bcb4077b3ed89c00ee693486b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647455687, "uuid": "aa9c3f22-60c3-4d10-9441-bb916dc89564", "value": "12288:WZjb8BOPxue5dKV9M/98f0koP+XvkgKtuBdfMAofD:WCBAdKV9Xf0kt3KMBdkAofD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647455687, "uuid": "53ba01a9-0eb9-4077-879d-4ec2317d7019", "value": 753664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647455687, "uuid": "15e30b08-ce6b-453b-9f85-692bbc723317", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647455687, "uuid": "f8a2e07f-baf4-43a8-b17d-2d8245366bea", "value": "39453396c146b7898c15c2f8565b5bd5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "510e92cf-a534-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647440465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647440465, "uuid": "4e798436-2457-4824-92db-f55d006d449d", "comment": "Malware payload (Mirai)", "value": "d9f8a185d97d50dd3613e6c8d95ca849", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647440465, "uuid": "9b1f7e3a-e352-43ab-92d3-bc9d6b93c070", "comment": "Malware payload (Mirai)", "value": "366b1b66e94b5e86c11145a7c0fd90af3593774e36569fa4ef84d0ab5165d7a2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647440465, "uuid": "aa21cbf4-b656-48ff-8abb-020850c95bad", "comment": "Malware payload (Mirai)", "value": "a64f1c8f28f041f9db3be967ab386c6ec41831cf", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647440465, "uuid": "3703e703-e0a7-44ea-a703-6c636ba06f2d", "comment": "Malware payload (Mirai)", "value": "92bf45c65d9a24e8b071dd8f1118ce05b213455bcc4a71d58b2953c08329aa6a1cde6b70743526d2f9c15c05963f238d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647440465, "uuid": "a384762c-2339-4b42-9e3f-4e1bbd66dbb5", "value": "T130431B4DFD419B10C8800076FE1F2A4D3217D7E8E3DFE3265A24AB5067871678F6BA29", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647440465, "uuid": "9dbb6f8c-8dd7-4916-8b22-f41c21d61af2", "value": "1536:YInO66K9/zlHoQ+IIKiPk/IoLWlUAUZZMDcEK2:H6oUzk/IoLWlUAgaD5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647440465, "uuid": "e0fb5e80-f382-4e37-af42-efd7423b9734", "value": 57168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647440465, "uuid": "a28d8624-dfb3-4d87-a083-4f705b3270c5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647440465, "uuid": "d2dd9fb4-fcb2-4cb1-ac42-c85187a62b11", "value": "arm6-20220316-1421", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "770cd787-a4d6-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647400156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647400156, "uuid": "df135c2e-d236-47a4-b542-b42a7f9dd986", "comment": "Malware payload (Mirai)", "value": "ab37c0605a81403295e2a423dba8710b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647400156, "uuid": "5d9415a3-338f-4877-bbee-52ca88cf3adb", "comment": "Malware payload (Mirai)", "value": "370f72a7833d9e6ee9bcb54c19d668590ecb51ae4bca87d4d735ba751efb6526", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647400156, "uuid": "74a39100-8d30-41b6-9963-fbc68357e66b", "comment": "Malware payload (Mirai)", "value": "a0a35a60ddea469d82228f3f2d3298165264e59a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647400156, "uuid": "642b521a-89bf-40f4-b72a-4e375fe6305d", "comment": "Malware payload (Mirai)", "value": "edcfccc4b828b4603182423788e292af9dcfe6c60f3419e94af55b30d710f2709d6e3eb7207734c75b1940f348dc4434", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647400156, "uuid": "06f0218d-c975-4913-b8f4-9d5263bdc662", "value": "T17883C71D7E219F7DFBAD823487B78E219A5833D627D1C581D1ACEA005E7024E241FFA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647400156, "uuid": "d4cd55c1-ec82-4133-926c-3e40451a328a", "value": "1536:z4ZcOgp6H5tGXraVds51d3qUIXqdGB87yZJ/AAaEX6Ja10gH:zecWHP0rDXdGB8WJ/AAaU64dH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647400156, "uuid": "45bfd26d-a78e-4e50-87bf-72d6b25b6d35", "value": 85556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647400156, "uuid": "3632f14d-9063-42af-ab86-21c0e08cdb16", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647400156, "uuid": "af20d682-7abd-42e0-a0cd-b0c3ecd97039", "value": "ab37c0605a81403295e2a423dba8710b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97525ac0-a51f-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647431564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647431564, "uuid": "f97a1af8-920c-4080-9554-5cb363227c8b", "comment": "Malware payload (AgentTesla)", "value": "7e1cb553519f23b3e61ed341f1890763", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647431564, "uuid": "d66fe852-62d2-4abb-adce-7d1778143945", "comment": "Malware payload (AgentTesla)", "value": "3757e17c90a0533f757b3ab31ae4886f55a34f3af775df5eb5e14982bb7dfcfd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647431564, "uuid": "a7e49e7e-8654-47a1-b37a-3b39ac014398", "comment": "Malware payload (AgentTesla)", "value": "10e36f4053b749a884af17e3d48fad1b9f417ed1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647431564, "uuid": "f7d4c104-5c3d-484b-8c44-ed780f8c12c1", "comment": "Malware payload (AgentTesla)", "value": "5438bdefa6caced0dc72102d0b5c9e455fe86b32a4c21ea4a464c7ea0af1b1014daa9d5b66e1e5bf467b3ea64ca6a21b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647431564, "uuid": "52005980-0f24-4a67-a5f9-0430d46747cd", "value": "T14352C860B3A940EBEC7F05315D1BCB2106716DEED8D3D72D71CAB60B49B3310856A6AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647431564, "uuid": "ac17ecc8-e46d-454f-acd4-3760a55d1331", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647431564, "uuid": "c1897c39-2d4e-4b5c-a981-4d6df37bcaca", "value": "192:S90X0J5K9MIRau/stRBQJPqLYQQj+qjhee:rEfWMIRau/stCqLYbjvjhe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647431564, "uuid": "d36a1e36-fa55-4341-aba2-89e70909e009", "value": 13824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647431564, "uuid": "67a9edae-25bb-455e-b0c7-c370dd441bc3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647431564, "uuid": "f41e5d4c-4ed9-4abf-9fe4-00eded28d505", "value": "Lmnfh.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa654c83-a56a-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647463808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647463808, "uuid": "d91bdc7a-a8d1-48cf-8503-c6fee11c078b", "comment": "Malware payload (Mirai)", "value": "1e54505f5eef0a420e9dbcbd45dc5ea6", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647463808, "uuid": "a1e2b55c-4a8b-4952-b9a0-ee010746fcc6", "comment": "Malware payload (Mirai)", "value": "37967a722d4484408048937bd8e1ac905292d8c7f1152d824d43419a563cb62c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647463808, "uuid": "1e4c6558-9229-4e09-bd18-cffa5a4b9492", "comment": "Malware payload (Mirai)", "value": "275651bacb4d2168144378c48261a7754ceb2c06", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647463808, "uuid": "eedb1a92-a379-4817-a2c3-0e129d115f1b", "comment": "Malware payload (Mirai)", "value": "de1cbf453cc8038f6f705b78c7a7285b754b3aaba7bb94fddcea9354f86f3f818d114043a0cb8592ab21994879e2646e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647463808, "uuid": "2769b433-ccdc-4c4d-b833-479f52913be2", "value": "T14B832981FC41A622C7C11777FE5F018E371553D8E2EA32079C285FA03A9F95B0D6BA5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647463808, "uuid": "9fed0efc-881b-417a-97e2-f99385617547", "value": "1536:NySHwrZKkRozEsK32U33eZtU5SWmZPeTriW/SnvL:NySQ9Ko683w9ZPe31KL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647463808, "uuid": "1d9b3779-73c8-4461-84be-4c3dad165c1e", "value": 87172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647463808, "uuid": "9a44d716-32ef-4384-a41a-898e14461073", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647463808, "uuid": "dfe400bb-f2a4-4d16-ab69-93ff6b8540f6", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94adee6f-a51f-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647431559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647431559, "uuid": "e6699b9a-7271-4539-8ce6-ac2749aaf8b8", "comment": "Malware payload (Formbook)", "value": "9f5b0bf04dcad2c9bdce91aa0e302959", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647431559, "uuid": "bd8bc7ec-9d60-4f0b-ab26-d4f5c2d8a682", "comment": "Malware payload (Formbook)", "value": "394d94da4b885cffb8661b6091bca413608c36bd11e99a3c021534752cf4635f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647431559, "uuid": "eca163af-76a1-47ad-98e0-fe62847ad771", "comment": "Malware payload (Formbook)", "value": "c097e407d2d428713284a895bfd413cb805431b0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647431559, "uuid": "8ac41231-643e-421a-90dc-3772b12865cd", "comment": "Malware payload (Formbook)", "value": "5742a1bd00ca71e7a0c640935504c9ca07c317ef280af5441178467d4c1c9c90afe369c25a7de5e58473777e599703a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647431559, "uuid": "87920241-6933-4643-9557-60fd6d672062", "value": "T1FF03D61A7892961DC9D47BF869F0519766367CE10124C18FECF97F2AA933223CCC616D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647431559, "uuid": "85130ed4-6193-40aa-ba26-d897779e5a5b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647431559, "uuid": "c5e67cf4-c458-4546-ac69-6136fc640a3d", "value": "384:SdRIRauIZbQ6ulaiJMwCKTH2S3dd0hUADkadG:ZHMml7MwCKt3deVDy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647431559, "uuid": "bf9fb027-7729-4ad9-be24-cc53d13fa0f9", "value": 40448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647431559, "uuid": "ad4b2ee2-121f-458f-87b4-6fd71a4bae19", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647431559, "uuid": "aefcd082-db17-4d9c-958a-72d77e37c730", "value": "INV#1191189.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "417da98e-a50e-11ec-9275-42010a9c0029", "comment": "Malware payload (IcedID)", "timestamp": 1647424118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647424118, "uuid": "2957119b-0267-40ed-ac10-3f3fe7982be2", "comment": "Malware payload (IcedID)", "value": "e1d37315e61fea96c175225c10bfd92f", "object_relation": "md5", "Tag": [ { "name": "188-166-179-227", "colour": "#9116C8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "Maya logistika d.o.o.", "colour": "#5D3DF8", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647424118, "uuid": "50148d50-e025-464a-aa4f-8098b3094211", "comment": "Malware payload (IcedID)", "value": "395615f7064993715dae6e0aba8dc87e307d2bc342b58de53af3881174032ebc", "object_relation": "sha256", "Tag": [ { "name": "188-166-179-227", "colour": "#9116C8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "Maya logistika d.o.o.", "colour": "#5D3DF8", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647424118, "uuid": "c9f10842-0adc-47d2-997b-f6b4807208f5", "comment": "Malware payload (IcedID)", "value": "f552e20ada60023d2e3cfa4ebbc24cd2e9a40fe3", "object_relation": "sha1", "Tag": [ { "name": "188-166-179-227", "colour": "#9116C8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "Maya logistika d.o.o.", "colour": "#5D3DF8", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647424118, "uuid": "00bae7c1-3538-4dc2-90ff-3d4ede2e74eb", "comment": "Malware payload (IcedID)", "value": "c48652b7e1487b1e16576d9def0198a106a1ca939ac870c963c76fa424bc991b896465f20086b1f4164d677c57552d71", "object_relation": "sha3-384", "Tag": [ { "name": "188-166-179-227", "colour": "#9116C8", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "Maya logistika d.o.o.", "colour": "#5D3DF8", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647424118, "uuid": "38e3e61e-e68e-456f-b789-cbf29ce9e36f", "value": "T193048C1B73A474FAE0B78534C9A22217F77338341760DAAF0BA046791F17291AD2B772", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647424118, "uuid": "f375d660-c53a-44ff-9453-1eeff279e0b1", "value": "3afa50b5f36641c4aa5cdd508a8fbcc3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647424118, "uuid": "b84a5db5-82be-48f4-91ff-67530411287e", "value": "3072:Ze80LojayX8MB+LF4OixMh+35WQv1jXPY3RfjkcBCzLfnpFJ:Zd0kjX8MAL+xM435WQvKwcozLRH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647424118, "uuid": "e210ce84-cfa6-40ce-981b-cb53ee2cb5eb", "value": 187376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647424118, "uuid": "7558fa2b-2edc-42ef-aea5-94547d96bd25", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647424118, "uuid": "5014d152-8022-4555-bac4-7026d85643e8", "value": "Thunderbird_install.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57c46bec-a519-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647428880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647428880, "uuid": "a25daf31-1081-4f42-8935-345292b4de7f", "comment": "Malware payload", "value": "f2273dd57ddb4051f6b2cdd0ebbe3b2f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647428880, "uuid": "6983ff5c-4783-4280-ae57-33ea9fe8839d", "comment": "Malware payload", "value": "3a06a8781b68f99e5b8e9c6130f28692bc2ed2e260404521c525b2fb5bd449e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647428880, "uuid": "51ed4e46-c27a-47da-a6fc-4d0ae2be8262", "comment": "Malware payload", "value": "c80a1e1aea5e4e89a59b33296c9432bdfc9f4a63", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647428880, "uuid": "f79d84a4-c075-454f-98ff-38ff39a4dd45", "comment": "Malware payload", "value": "e264f8494ab01c5ad0125aca80a7b2ea50841966c62e2bed346f9fbd6c80f14621144aa903015c58524cf21b5dcc8859", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647428880, "uuid": "8df1e521-a2ac-46b7-b231-bfb3aa698c7f", "value": "T12945E0593FD1699FC8F3C436CEA41C30EB24B5E7032B821BA05B42AD9A4D957DE181F6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647428880, "uuid": "06445594-2099-4040-a916-0c1f3daa35d6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647428880, "uuid": "d21a18a1-d523-472c-968b-3dde243c05ec", "value": "24576:ElwOuPmexoSRCfT8hsbD7qoi3t9+5x3C:ElfsfxoSRCfgybioC7+S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647428880, "uuid": "9a587d51-2540-47ba-b016-15552fcba3dd", "value": 1170432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647428880, "uuid": "cee1ddb6-56f0-4c5b-8c45-bf68ca6c1fa6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647428880, "uuid": "715c8739-73e2-48cd-9328-b65b9ccea648", "value": "Remittance Advice slip.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cae90b6-a4fc-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1647416406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416406, "uuid": "d9e1f4b0-4808-4ab3-b18a-5614e3d06f5d", "comment": "Malware payload (SnakeKeylogger)", "value": "291fd8e9a0def943b6425cdc3eb5596e", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416406, "uuid": "f8f894df-f809-4c9a-8f2f-5f668a4174ec", "comment": "Malware payload (SnakeKeylogger)", "value": "3a23408a6f8cd5dafa396ef1a51ca0fa214684b7be2290df4e7b05293e9d9ffb", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416406, "uuid": "7a7ff11d-4a04-4277-b2d0-b00c0a5f59bd", "comment": "Malware payload (SnakeKeylogger)", "value": "7197148a43079f187a944d4edef9e692d274bc25", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416406, "uuid": "dc3d16e4-174c-404d-a78e-c8f08d849865", "comment": "Malware payload (SnakeKeylogger)", "value": "2fc6104024b0cd637826e36ab8ddb4acdccbdd7e10d0162558e7efd33395a2f34c97f26290e8babfeb49932b5f41d162", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416406, "uuid": "0f126d6d-3977-4520-8b9b-2b1010a619ec", "value": "T1C7F4122533D89F53D6AE4E75EC7045052BB6F32BA022E70D0AD918FE2ED7B054A503A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416406, "uuid": "245fbe29-11a6-4af7-a0b3-bb95c03382a4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416406, "uuid": "7cb2f1b4-5719-45c3-a080-0dceb3429216", "value": "12288:m5q+e++++++++++++++M+fWwOEAIntbQS3eEcDThOmXfUNJJ6Zp7YW9xtLVYdeqz:m4WwOhtSuEcDTh9vUxelYWft+xoLZt0M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647416406, "uuid": "63e1dfe0-f7ea-4b7b-a71f-abc504f398f3", "value": 734208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647416406, "uuid": "60c168d2-6db5-4eda-a20e-1d1a9ea8e077", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416406, "uuid": "59c83137-99f4-44c7-9b9a-8ca1c2178c99", "value": "QUOTATION.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9686410-a55a-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647457042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647457042, "uuid": "12fb18cb-10bd-4ba5-911b-0a0997e476f6", "comment": "Malware payload (Heodo)", "value": "4fef7c6b50b635dd0823a1e4aa0abafd", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647457042, "uuid": "b30e5d7e-fc6f-4f36-993e-596815c9aca9", "comment": "Malware payload (Heodo)", "value": "3a3ddc0c2f850b7ad301f4187acfc80101d8c8c4d3397753d14cc9bc649ec2d3", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647457042, "uuid": "4acfec25-e8d1-4ad7-afdb-9d9507dbd38c", "comment": "Malware payload (Heodo)", "value": "d014d9f9fab46a00e9c506a8e4f0d15a2eac4b37", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647457042, "uuid": "f51320e0-1559-4b57-b977-1c99b5c171b0", "comment": "Malware payload (Heodo)", "value": "30a2b2e85b3a796345fc8cc6989779200cecedd46f3a4d5138f4bafa54882f689962994aa810d9857a154106689cc4fd", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647457042, "uuid": "b4957f58-054b-42a9-a46a-21670c311d09", "value": "T1EEA29E2DD620A41EE37A583C420940FED28E2C066007B5ED7491B67DA77769706CFAED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647457042, "uuid": "edc32916-2ee3-41b1-b433-2201450b26a2", "value": "384:o8c5hAuAi/NjxhS8EibbwBlwcSYrLb5CzgObff9kC+xbX7T/1SeyB:oPksNPzXSFCBn9kC+xbLTc9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647457042, "uuid": "ef62e689-b261-48a5-a380-96d7dbe5de01", "value": 21659, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647457042, "uuid": "8336656d-3cd9-49c2-b139-7c94e6d025f2", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647457042, "uuid": "57e4cff3-f98a-4432-b8b6-c2cd711c138d", "value": "Payment Status.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5eea71e-a568-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647463076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647463076, "uuid": "e732b534-3d85-4793-ba2c-bf1219709f63", "comment": "Malware payload (Heodo)", "value": "4a24d7f4c7fd5cdaf40488c900984da1", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647463076, "uuid": "cc7af828-48cb-4af7-b921-78a0879a4a79", "comment": "Malware payload (Heodo)", "value": "3a4e3f4223ff37eb849d07be929412533699a870e50defa04496a0d342d61e3b", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647463076, "uuid": "179e2e69-3c12-4089-87f4-8997e2119428", "comment": "Malware payload (Heodo)", "value": "cdb786618da8aece78efef73161094b5c7962db3", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647463076, "uuid": "58153feb-9e98-4c82-a984-1e63a17a7eaf", "comment": "Malware payload (Heodo)", "value": "ba8a6d954402dca7635b5ab623a56ffc878e7c71b5fc391b9acc16ad7004243f60416834980510aa7bf551ac54ed7f2c", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647463076, "uuid": "bb8e6004-5380-4c92-998c-4278438a89b0", "value": "T1EEE2C02DB370EB1DC21EEC3944A995DA825A74268106EB4E6C6CFB0D2F456C2730F1DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647463076, "uuid": "beb9f373-39f1-4ea1-b9c7-8569e8d4c673", "value": "768:8jFH4QqFhN+DizXT2RdFfPdkqstJkjE6oB:WS7TkgXendkqJE62", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647463076, "uuid": "bb4e5d88-aac7-49a6-878d-971d3534e394", "value": 33758, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647463076, "uuid": "c3ea73d7-74cb-46c3-96d5-4d5f22e3414c", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647463076, "uuid": "120450c0-ba5b-4a39-8754-b854fc5d4d4e", "value": "doc-1603.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d58c2e08-a4fd-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647417065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417065, "uuid": "ecdb91f6-efbc-45b3-bb09-bafd56842716", "comment": "Malware payload (Mirai)", "value": "bafe6e4c070d916c7d27ba059b3eea47", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417065, "uuid": "8b2069e9-7155-47fa-84ee-8ace0fda2f94", "comment": "Malware payload (Mirai)", "value": "3b004cd26ba28c02e9ed9e996f06e3e26105f32219c10138720dfb3611fe2d6d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417065, "uuid": "da4d3bda-1164-446c-a06a-0f9a46063216", "comment": "Malware payload (Mirai)", "value": "fc50cf09e94f4d83907844d7a16ee5bff2bc1848", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417065, "uuid": "5a7e18c3-d886-427b-93c6-e02f93c5a05b", "comment": "Malware payload (Mirai)", "value": "7f0501b566cf4a344201b1df6569384d05304c61b3c39dac25481a079203c6dd45a649ed3fa0cea2d8351f39b604dee0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417065, "uuid": "4e3ea03c-e133-483a-8e2b-7c8218e4762b", "value": "T15603E15EA8685ED0D5FD6A3DAA5F0376FC206AC3340FCD0A531458026AAA94B37D48FD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417065, "uuid": "5f5ce332-8396-4289-90c9-8bcabf7bf28b", "value": "768:7aRBc/7DClgXjejCbxiaJwtN+QLkNl/dM88XeWMM:ayClgzeIxLAw+Ud2d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647417065, "uuid": "b053151a-bda8-4069-872d-a41c60d6bca3", "value": 38064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647417065, "uuid": "9ed10881-3191-447e-a401-531bd061d450", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417065, "uuid": "fc41c237-cffb-405c-8e25-f701528d8de9", "value": "bafe6e4c070d916c7d27ba059b3eea47", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d047b86a-a557-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647455711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647455711, "uuid": "06f24e28-aa68-4a7b-aeed-c80efad66ffb", "comment": "Malware payload (Heodo)", "value": "f6a2a174a679d66c2aa6cc6fddee1cff", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647455711, "uuid": "42ce285d-dbe0-4a02-b45c-2502b993134b", "comment": "Malware payload (Heodo)", "value": "3bb2f78609b8a6f151f22b76f4e000c2f7f7dccad99e369d1c4e5caba445b66e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647455711, "uuid": "e69a514d-73e5-4889-bf70-43b343c685be", "comment": "Malware payload (Heodo)", "value": "d171200b1a980089e09e33fa03cb902d2bbaf155", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647455711, "uuid": "83736f92-66ce-4f1d-a306-b2b0e3d3215f", "comment": "Malware payload (Heodo)", "value": "4ca7f1411dc6d5ee9958641adcb3ed692abe3c1cd64368f9b09f8fdbcf26059a2c62da6c9f12c842d943dab24f949435", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647455711, "uuid": "c7fe3674-40d2-40ce-aac8-cb698785856f", "value": "T160F4CF11B2D1C076C1BF06741916A35D63F6FD608BB9878B6FD02FAE3EB45828A34356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647455711, "uuid": "8f7a5143-8d25-4f01-804a-6612d153d2df", "value": "66a21a1bcb4077b3ed89c00ee693486b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647455711, "uuid": "b888a31e-1a3f-4101-aa8e-58f7d9cc90c8", "value": "12288:WZjb8BOPxue5dKV9M/98f0koPNXvkgKtuBdfMAofD:WCBAdKV9Xf0kW3KMBdkAofD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647455711, "uuid": "d9ff0dff-3b45-45fc-8f0c-84eb5fa1c62f", "value": 753664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647455711, "uuid": "c8209577-40b5-42e9-83f2-0c20db71e54e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647455711, "uuid": "30d31b34-ce0b-4248-9470-1d82835220d1", "value": "f6a2a174a679d66c2aa6cc6fddee1cff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2377ddbc-a54e-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647451556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647451556, "uuid": "98738cb7-960f-4507-877f-0af32ab16fb7", "comment": "Malware payload (Formbook)", "value": "0c7f79c6909e5a20740beee21d492a25", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647451556, "uuid": "abd510bf-4f73-4aad-ba76-c17d2a35465b", "comment": "Malware payload (Formbook)", "value": "3c3154ca515c60811f10c0df3b919c65700f0c8dbde6ddbcf7a91634e1480b9b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647451556, "uuid": "0f40280d-c31c-4da7-be91-324ee6d975e7", "comment": "Malware payload (Formbook)", "value": "c76fca24c0f727c62b5d6ebb3acd55893fe6bcd6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647451556, "uuid": "abbc5ee1-390d-469b-a08f-a8c1de213e0d", "comment": "Malware payload (Formbook)", "value": "48acea5698df73bb782a9efcfca045523ccca64528fc9afb8b3c4e589b936fc9c02a7236d091611b1253bf16da9f5553", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647451556, "uuid": "88165441-852f-42b9-a67c-087b1082c908", "value": "T12E15AE0D7B505FD3D5AA877C1C8386A292FEA1C6AB15EF0AED4C4ACBC44E26501DFB44", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647451556, "uuid": "aa7e314c-7395-4585-b7c8-5a84cb4003f4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647451556, "uuid": "96074e8f-59cf-452b-a299-61063c43c504", "value": "24576:cpqe8FCBz6tHlFJaYWJKsRQuUDWIqQNxvqupxki:gAF3HLBIK3ueHNcu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647451556, "uuid": "47d4d83b-9488-410f-aab4-622945241ec3", "value": 903680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647451556, "uuid": "43766a7a-a1e6-43e5-a17a-6320eac22359", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647451556, "uuid": "bacf266d-371e-4c93-80d3-d28f39b9598c", "value": "0c7f79c6909e5a20740beee21d492a25", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "371feda3-a53e-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647444717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647444717, "uuid": "5a27862a-7b19-4f38-a2c1-0663158cd68e", "comment": "Malware payload", "value": "e4aeb7b9e6d5574195065a147e120d1d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647444717, "uuid": "39fd80f8-121c-435d-a7c6-88256a5caf99", "comment": "Malware payload", "value": "3c92fcb34225d860ef707c297e04808c0a6806cf1fed48c88e634ead940f49c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647444717, "uuid": "e805ac91-868a-47d4-9cc5-9bbc53c469df", "comment": "Malware payload", "value": "fcf7be20948c29aab1218fa86872a4c6f039b302", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647444717, "uuid": "b2a7caaf-f639-4a56-9d18-4a34e0aaab3d", "comment": "Malware payload", "value": "728aa1590d6e507fecc52c0dc8151911ecdb4dc884e73ddf471507256ac9a606dd40a9b6cfc8befde626114ba7de2f65", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647444717, "uuid": "784f8062-351a-4993-91a2-edfdc9155d98", "value": "T17E35AE63A3D442A6D36B4635CF38C96DB3315003AE716F4A24F0B6FB66573668B01B4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647444717, "uuid": "0b2b6870-ee9d-467b-96e1-6969791a1fee", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647444717, "uuid": "d41455b3-4a3d-4283-9a9b-dd4a061d0d67", "value": "24576:OjW2j5druZPY1ipNtRNRXXSKmn0RLwWNbIxpxkivm:OaI4pNtRbHTmyLExo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647444717, "uuid": "c78efbe0-4aba-4ae9-a77d-97d291169e40", "value": 1152352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647444717, "uuid": "84f2b399-0424-48d2-ab8b-1dfeaa12ba64", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647444717, "uuid": "936f6fa3-a9c0-4b67-a680-2d3ea0645a70", "value": "0093847SwiftCopy_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcd07fe0-a551-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647453209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647453209, "uuid": "d0c97d4e-8570-401c-bafb-6c836f413e42", "comment": "Malware payload (Mirai)", "value": "83ce425954d42f6a407dab7f7fa353b5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647453209, "uuid": "4e7afd9d-fd93-4bc3-a268-6cbce8306d22", "comment": "Malware payload (Mirai)", "value": "3d087c67c31532a83fc0146e7c9196a2bee508b0c6abfcf893db547b5d46c22a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647453209, "uuid": "c865cc06-f679-4fbf-b090-861718d9437b", "comment": "Malware payload (Mirai)", "value": "ef17d6f937ad02f0d42236425e3880b50e2ebb7f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647453209, "uuid": "9803ec51-a3e1-417f-a9bb-3cbb9b016faf", "comment": "Malware payload (Mirai)", "value": "a4942fde0527e0373545a0d24530cc39011c552bdeed371425f22c4695ceb696652bbedb3711b1c9438287f55f664154", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647453209, "uuid": "3e1e451d-917f-45a7-9cea-0dcc24362221", "value": "T160133C22BA721E27C0C059B561E34729B1F9474F28BCCA5FBDA10F9DEF54A502607AF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647453209, "uuid": "fba636df-1dd1-4a6a-8570-5e484e951131", "value": "768:uZjni5MGkH+GkGlOuWlqI+pgPM5UN3o63X+O+8/ky6O:Kji+XkoOuWlqpKU5+o63XMPO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647453209, "uuid": "d0330264-a137-48d5-a208-91d62ab6c102", "value": 45480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647453209, "uuid": "2a38cfde-3898-4afa-828a-362d2bf93894", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647453209, "uuid": "a53ff96b-3d91-4cb4-ba58-27d034a379f0", "value": "SecuriteInfo.com.ELF.Mirai-BRDTrj.5952.9778", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e84dbd1-a4fc-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1647416356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416356, "uuid": "140ba8f0-9a60-4cfa-8b69-23ecc334b33d", "comment": "Malware payload (SnakeKeylogger)", "value": "6195f186f30fe51efda2e93cfa966b8c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416356, "uuid": "15e56bea-d7a7-4a70-a3e4-1bd863969887", "comment": "Malware payload (SnakeKeylogger)", "value": "3d4acad337e002337b919d1b804bd704ad5f180a3a5ac60148574e3d734e75ef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416356, "uuid": "7484b151-a15a-42d9-ab56-bf96de00a6fc", "comment": "Malware payload (SnakeKeylogger)", "value": "d0828a65e9010e61507e0d38bfd0c6db8a8a80c3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416356, "uuid": "ae2660d4-3493-4644-9ca1-c5f6fd9995ca", "comment": "Malware payload (SnakeKeylogger)", "value": "8fe96b455e251d13eca7365b91ffedd6ab1302a4fc4c027aaa666e9026ff5fc7db749ea5e72b39f011e7b8ed1898121c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416356, "uuid": "c9fca460-2e4d-48b4-aeb4-840fc574a26b", "value": "T1C1F4125633D88B52D2EFAF7BE52111171BB1F66B2265D74E0BE424F60EC3B414A103A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416356, "uuid": "76da8c9a-00c3-4398-9617-a18e50eb5c75", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416356, "uuid": "0eb6f48e-c2ab-4965-a32e-dcc288a2613a", "value": "12288:Ha/+LwOEmVdK3l94HE97sKtiKxjpy+Owa5oL4aGg4KnAIJvctHZ8cSZX:HzLwOnVdm94H01tVjp5Oy4t5IJ0t58hZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647416356, "uuid": "9f0ab007-c659-4f30-8579-85d0f6294a36", "value": 730112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647416356, "uuid": "104efa27-95d4-4261-a4d9-d83e29cc1eb5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416356, "uuid": "97f30e28-f873-456c-9b9b-6339877a792d", "value": "HG PROMOTION TEXTILE CATALOG.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6eefdd5-a4fe-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647417443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417443, "uuid": "438624aa-0474-47de-84be-c1cf51d999e2", "comment": "Malware payload (Formbook)", "value": "d35d30f184393cacc394b8c51743348d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417443, "uuid": "a892c44e-17a9-4358-9a31-1de75a011c5f", "comment": "Malware payload (Formbook)", "value": "3d5d161635b1d409b28564bb95c9006687b720caa5bfb6ed8679b87e889baf3a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417443, "uuid": "b65f4cde-0ab6-4a2c-81bd-cb0986ef5044", "comment": "Malware payload (Formbook)", "value": "961b5905a6d86a0f98b7f14a481c2f2ebebace3b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417443, "uuid": "2d49fc19-5f43-4154-a33c-718b1ead5059", "comment": "Malware payload (Formbook)", "value": "d16deb88507c56845adb5e1ae4f1ed5368d7e3d9276b064e495b694b64bab943085fd7224e5d549505226a8babd087a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417443, "uuid": "ad65430b-e9de-48e8-82c8-47e0a6ced461", "value": "T10D158DE2B2914837D22727788C5F97745926BE11EE389D86EBF02D5C3F3D681B825183", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417443, "uuid": "1e8e86b7-5619-403e-8c9b-71406e5ae92f", "value": "869d587b689232346967aa575742427c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417443, "uuid": "b9b9b4b0-ad6a-4799-9207-8116e623c15b", "value": "12288:CPk6X2mgNKHj33jgkLjlMiUyQSwml1Eh/0+RikBa7kVJeu93IsN+qI6F3HAh:sh2NKLcklMiISdl1ENTbbFN+qTHAh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647417443, "uuid": "401ef8dd-59e7-458f-baa8-17e9ae836149", "value": 924672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647417443, "uuid": "3f4a8270-9b31-4df9-8955-b3b8704bc330", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417443, "uuid": "67a794a4-2051-418d-bab8-57bea8303835", "value": "copie de plata bancara.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "228430e4-a51c-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647430079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647430079, "uuid": "ea75dd1c-aceb-4b86-a5c6-d0c8d3e43551", "comment": "Malware payload", "value": "344c72735860082b13a521d9c39e38b0", "object_relation": "md5", "Tag": [ { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647430079, "uuid": "56e4d89b-a976-469f-847b-fa98061b27c1", "comment": "Malware payload", "value": "3d7778994dc1b84203cd6d9c42e4e22b9556fe656e1e7614aa0d4ebc75158b01", "object_relation": "sha256", "Tag": [ { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647430079, "uuid": "09ed9eb6-b48f-47c0-a85c-03c7bd5a2814", "comment": "Malware payload", "value": "9f73ca920ca2471d3c3d8159317584e20a18cf4c", "object_relation": "sha1", "Tag": [ { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647430079, "uuid": "45f84ac5-bda2-4d04-9261-636ff4c79683", "comment": "Malware payload", "value": "6982297d784258e4799549a6371db944604c51481204738983f04992a3cff299513c526277f70ff5e9c2258d6be4a1d8", "object_relation": "sha3-384", "Tag": [ { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647430079, "uuid": "d65da76b-1396-4077-a434-72285e619c34", "value": "T155C1904BA7EA3C2849FD03756D9E288790484EDB1B83D888BD1A753975AA5C621423BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647430079, "uuid": "a878e849-3a9f-4658-a92d-f2ae772ac7b7", "value": "96:yFEvr7/xfjyYvQEwfGsZDe/zt2Pyhx7Ba2yHP3e3TGJs4RVAK5+EFARK3kSgwLPF:KEHJfjyYvMusZSt3hS2yHP3yWVA2+EF1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647430079, "uuid": "33b4435b-5033-413a-a1fc-aa632e925e59", "value": 5663, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647430079, "uuid": "df575b35-33da-48f2-9159-cc67e0573a29", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647430079, "uuid": "11fefe43-e842-4e30-ad93-3c804ed0bfe3", "value": "Swift Copy.r15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84f2474a-a4fb-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647416071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416071, "uuid": "dfe09974-0b06-42de-9951-616f50ce89cd", "comment": "Malware payload (Heodo)", "value": "1881ce3e2a8fc1a92ac593d1da673fb9", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416071, "uuid": "93afea8d-a219-4380-a420-d2ebbc4bc6bf", "comment": "Malware payload (Heodo)", "value": "3d9c8b61e69d0271891ea6c0a99eea67180351e4efbb7ab003f48fc744f139ee", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416071, "uuid": "e9467e84-888b-41a9-8e22-b3c53fd612b6", "comment": "Malware payload (Heodo)", "value": "282c233921d9df4311cf30c1c63f1467d359b00f", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416071, "uuid": "b35f86c1-e75e-4fb5-a20c-9f6bf6d104e8", "comment": "Malware payload (Heodo)", "value": "dbb7363b1227ff3da27a803ca26009f1f4b736a6ddcd400ea87cb28c9b0da520e57c1fdbb2f73a4f32f1da12c1d47b17", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416071, "uuid": "2fc2d152-9291-44ce-90c6-216528b7360d", "value": "T1B633E01F9522F5ACC3136C7DCA4C59F5650D5893E089F62B08857B8CBB1B2E7178F286", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416071, "uuid": "788413da-b265-4b6e-96ea-ce544038bd0a", "value": "1536:HFmPpcEglt24xZdRBzH9hJBrdEwwNXekVIc07:l4cEk2Kd3zdtdEwoc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647416071, "uuid": "9906610c-6807-4200-a07d-748209b4d9dc", "value": 50551, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647416071, "uuid": "6a8bece2-a035-4722-9a7b-c671792b31a4", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416071, "uuid": "0b36eb77-a7c7-406f-9c3f-0dacb7341cb3", "value": "OMICS International_1.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7ca4c28-a54c-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647451026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647451026, "uuid": "a587e195-08ac-4cb5-a652-7627b2b4536a", "comment": "Malware payload (AgentTesla)", "value": "ddfc927931bd8942d6027bb8450ac871", "object_relation": "md5", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647451026, "uuid": "d770323c-1394-4b0f-9513-791dbb5ff7b2", "comment": "Malware payload (AgentTesla)", "value": "3e38e4c0ee8586966ccfa77cea35ad277ff63dfe1ef7735e9ef0ad8dceade00c", "object_relation": "sha256", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647451026, "uuid": "ee43063f-01fc-4ffb-a6b6-482c135687e4", "comment": "Malware payload (AgentTesla)", "value": "188560a5ceef8a835033afe93238fc24fe28eb93", "object_relation": "sha1", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647451026, "uuid": "27b58909-eafc-494c-9983-dbfad017f04d", "comment": "Malware payload (AgentTesla)", "value": "ae9241cf1906f245aa7c7d8d5ccc419a13202a8b69ed37d6f302e4bae3abb12ec3cd75f4e956c4bdd9051761df11761c", "object_relation": "sha3-384", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647451026, "uuid": "18df4813-b48a-4cc7-b5b1-a163b483f72d", "value": "T102059D54725070EECDAA8F729A25DC34DF917CB9D30EA16620DB3DAF75FD9A34A00092", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647451026, "uuid": "b0cedd27-21d2-46b1-b3fd-eb2025668765", "value": "24576:JlJiVZO5I0Zr4lB6plbBUUD/MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM+MMMMK:JlJiVZO5Iy4IpCUD/MMMMMMMMMMMMMM1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647451026, "uuid": "8b4ab248-b819-4db2-8802-db33c25a6594", "value": 815104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647451026, "uuid": "f7584418-4fea-4319-8d89-cd81ad47ec28", "value": "application/x-tar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647451026, "uuid": "187a0147-a1b1-4d11-b927-1de951973745", "value": "INV01562.tar.001", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05162fd7-a4fd-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647416716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416716, "uuid": "73493b6b-c206-4d40-a4d8-d208161d623f", "comment": "Malware payload", "value": "28b79d21c8ddb12b0ba03c7a61c6341c", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416716, "uuid": "5f0d0251-deeb-488b-ae18-fdb1c133bc72", "comment": "Malware payload", "value": "3e4d20648392b6f7fadfece5b0450b9240a6b50d673ca7f19790613a6a199b2e", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416716, "uuid": "15749641-8bbc-4816-b12e-838cd874362a", "comment": "Malware payload", "value": "cd846c7d9c87985a30e3242e8ca43e23216e8fbf", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416716, "uuid": "7d6269da-4f9b-427f-b1b8-dc5e160c6bd5", "comment": "Malware payload", "value": "8742da0d6d9932e2b67912b844386f68699f1276f2eddf1a88714f4ddff5ef77799e2ee635ccbda52a31de962b736fa9", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416716, "uuid": "ca2a9d44-6b7f-4581-8c4e-868f8b6821d7", "value": "T1FBA2140FABF6955BF119C53DCD57C578E07AEC809B23C9AB2423321D1633AC4B81CA26", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416716, "uuid": "a533cc63-98a7-40ab-9122-bf38a4510166", "value": "384:G9pHrslk62PDx27tJXaU9AgomzVsQN7qgdIlyupnad+0cY4OCuy3yn:GTLdbKtxaO/ohQNOeI2s0cY4OCl3y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647416716, "uuid": "8a9a0927-3acb-42be-9b5c-7a0c57111092", "value": 21512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647416716, "uuid": "4f17c3fc-cf20-4b76-a711-12ae48d7f8c1", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416716, "uuid": "fd8969cc-416c-48bd-b72e-59f672ae5821", "value": "600.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "347892ed-a546-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647448148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647448148, "uuid": "fdf12d44-116f-47c6-b652-12e596797802", "comment": "Malware payload (AgentTesla)", "value": "7838cd2374073efd352e3afa1c2747e3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647448148, "uuid": "ae9852a4-2f5f-488a-8dc9-ac836219955e", "comment": "Malware payload (AgentTesla)", "value": "3eb668ea2da7b409d195c9f88f45e2ef6292d757f633a9886f963f7b2c08f5e2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647448148, "uuid": "151ff93e-0079-4434-8f82-096eb1665236", "comment": "Malware payload (AgentTesla)", "value": "325fc79704af2980bdf63b09dd3c4b10cc0cf69f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647448148, "uuid": "f48000b1-41e6-4f78-8e57-1f1d47a72d64", "comment": "Malware payload (AgentTesla)", "value": "0d61d95350cd36d30c97a81829432ac0ea680387adec0e6967a611c2de84e8d4ed1fd7e4f6769659d94d58bfa7106140", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647448148, "uuid": "40b82d5c-1637-45c7-b3fb-6fb2a0ab1039", "value": "T1360533B54A3E3B56FCC4ACF75BED9666EAF55E05C83098150421AEAFE4B13C4B7088D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647448148, "uuid": "0ecde93a-5c36-40d1-bd2e-1ff395eb5b80", "value": "12288:1QjSYN2/ZYobaoL0IJ5sNrW8/PQvO6mmyDCSRgkRjPJVaE3s1r9VzRgAVnCxwk2X:1QOHqo7Ld5s5mk313AXR/ny25mg/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647448148, "uuid": "96f0575c-2090-4bfd-88f8-7b7b1bf3a587", "value": 868894, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647448148, "uuid": "23050754-966a-40c4-b6de-1369eb483f6d", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647448148, "uuid": "1ad79c77-f485-4294-a871-f73baf894039", "value": "20220315 Penalty Notice to Moss.(110K).xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac012eb4-a4d1-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647398098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647398098, "uuid": "74c7633c-3cbf-4d70-99e9-2982c21ba83e", "comment": "Malware payload", "value": "d88a9c4b53c6370175efd3863bb978a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647398098, "uuid": "4f31413d-5a1e-4f60-99b2-f7fa3581eb5c", "comment": "Malware payload", "value": "3ef2e98f3c0a438e1a6139c575a1d79bb45b824a5bdcb1ffab90e3d161cae73d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647398098, "uuid": "5d81af0c-c83e-4ba5-8ebd-884f8f7b0f5d", "comment": "Malware payload", "value": "49c7164c419e8595d8bfdfe01f41a0e9284bcb4e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647398098, "uuid": "67dd1a33-bb38-4cc0-9b2c-5f904ad7bb08", "comment": "Malware payload", "value": "450731bc8d70a01a24675dbf135d4cfc4460608b8faebefd3ac0a5e2fd70793707b92e728db36fddaa7d9a11edf66e4d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647398098, "uuid": "cf868882-205b-4619-a489-92696e5affa0", "value": "T169B36B9112C7136FCA54F5B1D69D8A80C5CF6E22396ACFCB850D243EDC796A603BBC19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647398098, "uuid": "8630f298-86e2-41fd-868e-06af1057d7d9", "value": "4bf38f63d465d7c9d7bd8e0f45ec07d7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647398098, "uuid": "8bed9a0d-4061-4f51-a192-2bfc5904d5db", "value": "1536:x41pb8ioaUuT+UPiQMqPNHz7Ekxqk6WMR2kCyU3lAnwkOzNrd/w0BLq8HpQ6+uJc:Nu7TNiQMen1xqKwCTVEyzj/66FJt+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647398098, "uuid": "d8577cc7-4edc-405c-af8e-20aa87568f98", "value": 110592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647398098, "uuid": "516d8266-8261-419b-a09a-af627f6e1ba5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647398098, "uuid": "f49b7eba-1211-41b9-ba78-348d5e3c764d", "value": "SecuriteInfo.com.Variant.Fragtor.66683.27290.23120", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a52d0d8f-a50d-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647423856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647423856, "uuid": "c4c7d25f-12f2-4533-9cf7-251d1048dc6d", "comment": "Malware payload (Heodo)", "value": "7513846726a36d71e1860159e4d49c60", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647423856, "uuid": "5f49b7b5-55c8-4408-960b-fbbb5ff2f251", "comment": "Malware payload (Heodo)", "value": "3f373fbc825a780f06da41be6e3c9384c13ab3a591888f0b8fcf47e08dd7c126", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647423856, "uuid": "9245cdd5-9cd6-46ab-a81a-fd85015d1afa", "comment": "Malware payload (Heodo)", "value": "8e56a37050ffdefed6781307ef1c9c15e541b013", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647423856, "uuid": "afcacb45-4429-44da-8c15-b421460ee28f", "comment": "Malware payload (Heodo)", "value": "c8a7ae95b19b4b339f7599ed75d7e8738c89b0887dd1c0cd693229d0a3570f6ecb70935b0524609fdf0935472f60fd37", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647423856, "uuid": "a8516d44-9a42-4fd1-9d25-80fe4adfcd86", "value": "T1CCE47C12F461B2B9D04B04741F1723A86EEF5E518629CA13AFA8ED5E1F31251FC3FA16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647423856, "uuid": "2bccee43-78bf-4145-a817-3520574a494e", "value": "066d4e2c6288c042d958ddc93cfa07f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647423856, "uuid": "7864a162-a9e4-40fe-ae8c-0b7ce46c642b", "value": "12288:DtAanana8Meee0GBGu3qI+3DNJ3vE6v5eJxS332d7t5hT/hexLx:Kanana8qGBGuoNxEjxCM7o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647423856, "uuid": "d4766486-f78e-4b17-b31f-d303dbf3a8cc", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647423856, "uuid": "6769f502-30cf-47bf-9439-ba7c15a70128", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647423856, "uuid": "9b8cd5c5-87e3-4fb4-aabe-f627affc1b8a", "value": "7513846726a36d71e1860159e4d49c60", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4e68429-a4c1-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647391268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647391268, "uuid": "3072471d-22dd-4a5b-9e8c-a7e31720d4bc", "comment": "Malware payload (Heodo)", "value": "faa3d8a766bde3357608bf1970a66f8c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647391268, "uuid": "bcf19f96-e4be-4743-a1bd-331d5f1cfeff", "comment": "Malware payload (Heodo)", "value": "3f3b548bc10850ecdf460953716dbbfd277b27c369f5ba4eb23807208c0ad465", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647391268, "uuid": "400968db-c94d-438b-a76e-7d113ee48576", "comment": "Malware payload (Heodo)", "value": "c953a02919fb1b452c6ff9ae156c8fb4bc7b1456", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647391268, "uuid": "5f72a346-a385-40f1-8c59-c00894d206fb", "comment": "Malware payload (Heodo)", "value": "ea9cba418993ef1e80226270b38844ec4d452c872b93c0e5911c921e737a912062c6393f3e43deaa74dc92d5b7340a8d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647391268, "uuid": "4417e01f-b255-4a2f-a9fa-14b87e80eccc", "value": "T13DE45B3071F74031C3AA1D3905D2DE64DAF5AD4B87B2F0D32F99AB4E99F5AC12B20616", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647391268, "uuid": "44136385-0f25-4423-aaeb-ed4a345db1b2", "value": "a38617efee413c2d5919637769ddb6a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647391268, "uuid": "9c9c0805-5ecd-423a-9499-2e5664b44c86", "value": "12288:E94YBCR2xP7guDo463OP4eLsiSOZjb2woE+MhJT:2kRAguDogPfddb2woEBJT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647391268, "uuid": "64bd4fa3-42cc-40bb-b3bf-0f33619519ad", "value": 684032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647391268, "uuid": "83ba346f-9f0a-40b4-a096-c185a50d7591", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647391268, "uuid": "36b7cf60-d897-4b68-9f61-7b5ed3fd49d4", "value": "faa3d8a766bde3357608bf1970a66f8c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b8853da-a518-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647428511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647428511, "uuid": "a570f743-89c2-4d35-92f4-e892e008a0ee", "comment": "Malware payload", "value": "63fcd68ea703d3f21d6ee2fea11f4a8a", "object_relation": "md5", "Tag": [ { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647428511, "uuid": "8dd3684b-2b09-4aa2-907c-a6cc3b08a8d3", "comment": "Malware payload", "value": "40822f7a17f8d222b334be44e7f790edf84d463747cc68dd66d071bf727583fa", "object_relation": "sha256", "Tag": [ { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647428511, "uuid": "0369154e-c6da-4dbc-a5ff-89dd5bc65454", "comment": "Malware payload", "value": "f2511c1c095961903cf0c51d4ec59c1d28d78749", "object_relation": "sha1", "Tag": [ { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647428511, "uuid": "4d467819-7811-4752-ab40-b7c5ee891915", "comment": "Malware payload", "value": "3cdb4970b09688dea6e346862a1a61a1348805c10e7a8f2b4eda785455f2d3324821f95c825d476d690b36d34857b3bf", "object_relation": "sha3-384", "Tag": [ { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647428511, "uuid": "92fd4b77-85d9-4187-b1ad-791507194a4a", "value": "T1F3F423E108036CE624A73DD578B8763BE1DFC9AC5BF8616AC220315B1924FBB1D36949", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647428511, "uuid": "8bb3b175-a255-4f81-8033-2bbbfeab74a8", "value": "12288:NS5ESQ0fKJ0R9Xn3ORtXwxwJSiDtaARgcXErHJnozcMxnfv2J1sTC/9DSMdayfB8:WEN0KJ0SRtGwJSfgXErpnNMJGt/xSyaV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647428511, "uuid": "9147f30e-11eb-4089-a262-deb56fc29027", "value": 771200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647428511, "uuid": "ba7c283c-0c41-4f72-a9e8-0e4d390b8acf", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647428511, "uuid": "378d823b-50d8-4824-8fc4-81d0f2ef0668", "value": "ORDER.r15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bff6dcf4-a541-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647446235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647446235, "uuid": "c1edd07a-bdd0-47ea-b833-cb4ea7484c4d", "comment": "Malware payload (Heodo)", "value": "ec1f1f1712e1a5e9fd513a87c860d6e7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647446235, "uuid": "ae2fe304-6aae-4d0e-8b44-026a5f2ef797", "comment": "Malware payload (Heodo)", "value": "40fc910af60e33724b8a19a0c55df51d002fbab0c1f9f87b8ee46d1626f6e88a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647446235, "uuid": "e8e89504-cbda-411f-9060-0263af378083", "comment": "Malware payload (Heodo)", "value": "bda296688c58326099438a2b9ec8373bdfff43b6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647446235, "uuid": "2fdbf0dd-ec87-4fe9-8d43-148ae199fd2f", "comment": "Malware payload (Heodo)", "value": "1be4f8c5761e5aa32583eaf6c9f5d275cc94680c862ef752a8adf3c6d0ec9c487396ef8b1e41f1947846aa3d762f6b9e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647446235, "uuid": "b25d6e5d-f690-4192-a793-2c594af23604", "value": "T196E47C12F461B2B9D04B04741F1723A86EEF5E518629CA13AFA8ED5E1F31251FC3FA16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647446235, "uuid": "9ff0c781-a8bd-452b-8f10-da469613a080", "value": "066d4e2c6288c042d958ddc93cfa07f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647446235, "uuid": "e75ef16e-ba52-479b-8273-bfa2df2a507c", "value": "12288:DtAanana8Meee0GBGu3qI+3DNJ3vE6v5ekxS332d7t5hT/hexLx:Kanana8qGBGuoNxEexCM7o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647446235, "uuid": "a60dcbbb-ad36-48bf-b0fb-a74bb6112193", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647446235, "uuid": "ef21f16c-0f24-4e5e-ac93-f72b324981f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647446235, "uuid": "845d798e-3731-482e-87ce-475b4600b668", "value": "ec1f1f1712e1a5e9fd513a87c860d6e7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b1d75fe-a579-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647470171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647470171, "uuid": "e47f7010-bf82-4ac7-90d3-b479cf5aeea2", "comment": "Malware payload (Heodo)", "value": "b9ec4d99b70a2a66e1307eac19df9c16", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647470171, "uuid": "5bed9e91-da58-4d44-8237-0f1c3e9ad3a0", "comment": "Malware payload (Heodo)", "value": "4132d79e4b8d55a9a1f8426cda798dd09b667bb1fa3f746f38eb91ca0b8fe56c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647470171, "uuid": "e79c19c2-2eaf-4cb6-9172-c06fa9749a22", "comment": "Malware payload (Heodo)", "value": "f1c758540d95478a4fe747b30bdbf406a4a5d992", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647470171, "uuid": "debe87d3-ca01-41a0-9ea2-80a11af8c4ec", "comment": "Malware payload (Heodo)", "value": "c99be004ab964f36587de7df2086858a578e9a309ddda0012ac3225550fa65968544121fe837c6948973579bb68a34ac", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647470171, "uuid": "b5a7da70-f9f2-4014-8aca-358fcc4958c4", "value": "T15DF4DF1176E1C076C1BF12304956A38D23FAFD509FB986976FD02A6E3EB41828E34767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647470171, "uuid": "b1ec1b47-c753-4ab6-b15d-cdf7680ce855", "value": "66a21a1bcb4077b3ed89c00ee693486b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647470171, "uuid": "f78be6f6-e84b-494e-a331-4f40800aa1d0", "value": "12288:g6O4TpP0XjxCCFJuf07j+Xk7hE8rLneTfABCJoWRWwfpW:BeCCF88j+Xp8OTYA7pW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647470171, "uuid": "fc56f6e7-b714-4660-8481-ec3e6186a74e", "value": 749568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647470171, "uuid": "9d0d4dad-94fb-4200-9cbe-ff9c9c7a0785", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647470171, "uuid": "eec3cccc-0bf1-445d-a80c-4bc8662af67d", "value": "b9ec4d99b70a2a66e1307eac19df9c16", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4f4d9a2-a559-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647456605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647456605, "uuid": "d1410ad9-246d-4d55-9e86-ca42804e2b72", "comment": "Malware payload (Mirai)", "value": "12ebc76a2381084450eff7102744301c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647456605, "uuid": "b9ac9163-69b5-4f12-b759-b2ccfa087174", "comment": "Malware payload (Mirai)", "value": "415ffab23c982dabcfd45739503c731ee843649dc4300c45470dc1800763234b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647456605, "uuid": "ee664443-1a59-40f9-82c5-ec5933ab4e1e", "comment": "Malware payload (Mirai)", "value": "7308cfd702e0193847ad4d1c24520f404a7dc3e6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647456605, "uuid": "d5cf9a4c-0fce-4c21-a6ae-7353977873d9", "comment": "Malware payload (Mirai)", "value": "5297dd492a5a8b023040ac88ccf5c9fda359b10e804f28681455d26e46a22e2c98762024b9a74c53c67261f05eb1fe23", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647456605, "uuid": "a9bf75e6-c414-4be9-acb3-de1f37ef4094", "value": "T198E34C46EA418B03C0D52776B69F42453323A764D3EB33069928BFF43F867AE0E67506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647456605, "uuid": "0445688b-5a70-4026-89b1-b6a39c3b0fd8", "value": "3072:Vh/ZEV320ra+Ua2A6O0VuNZLU2Y0SU7/Sw/3M/9bLYi/:VhSV320rvUa2A6O0VSZUU7/SwvM/9p/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647456605, "uuid": "697162cf-de31-4a0a-942f-e0e27ce65bea", "value": 154311, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647456605, "uuid": "d79994c7-067b-402b-bba8-7466870a05ad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647456605, "uuid": "155410ac-679f-44a1-89fc-92dfc680a8d2", "value": "arm7.cloudbot-20220316-1850", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7e60dd8-a52b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647436826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647436826, "uuid": "990d9c01-6ad9-48d0-96e3-3edc4e1222f3", "comment": "Malware payload (Heodo)", "value": "a0e5fa20d6f52934c0dea78d67120d97", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647436826, "uuid": "89e28263-4dcf-47c4-930d-20d2c02429ea", "comment": "Malware payload (Heodo)", "value": "41983508fe860e5269a6596311cf6f9aed8e0cd9b17013f7cc57a69d528f84ca", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647436826, "uuid": "67744401-53a3-4288-9fb6-a09ba14fb743", "comment": "Malware payload (Heodo)", "value": "7f1a2926b18f227abfbc8eee414efddd2def459a", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647436826, "uuid": "6350aa6a-4dff-480b-9e98-3fe2677e4a63", "comment": "Malware payload (Heodo)", "value": "9445ccc8b359dd95152c5e79f8925c6923bdda88657b11bc3507abcd46946fdd9b7bae8a40e55d4f4a72b2e2e24a1cff", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647436826, "uuid": "123decf6-955c-4160-bab1-0f417bca6466", "value": "T12BE2C02DF2A0EE1DC21EE939446895DA421DB4558502EB4FB95CFB1D2F0A5C23B1F0DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647436826, "uuid": "fa0dbef9-e37f-4077-9741-448a06127d6b", "value": "384:sjzZPFhNjqEBOA7iEibbwBLg0SCdiVXUKgUrNU/qWhZOdBNPJM+kqr9eCgh0k5lY:sjpFhNNlizXT28dFfPdkqstJmE6/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647436826, "uuid": "d1cd586e-cfc1-4ab8-820b-4b704d5f6c29", "value": 33750, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647436826, "uuid": "12e9d769-fc74-4be0-ad9d-0f06881b469a", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647436826, "uuid": "8a5b3f85-da1f-430a-83c7-a0b90da90125", "value": "Rechnung-Bestellung-39292.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d7cea65-a549-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647449532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647449532, "uuid": "5b4bcca6-cfd5-424c-91cb-7338034fb744", "comment": "Malware payload (Heodo)", "value": "f2595fe4ebcd1200f557c1d96cef153b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647449532, "uuid": "92ff3163-9b90-4669-814a-e8ae0a66d1e9", "comment": "Malware payload (Heodo)", "value": "41ac8691811a99df2e44c8d5ede6290f80a41291705497b7898fc1d386995432", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647449532, "uuid": "43d44988-7c39-4cf2-97ab-c6d1169542ea", "comment": "Malware payload (Heodo)", "value": "16c8d2d882b3b1667ac3aa48f785485f8c63ab73", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647449532, "uuid": "334e2189-9fbf-4137-bcce-9b980294edc5", "comment": "Malware payload (Heodo)", "value": "4ad1d83a56cfcbc93484d9f9f7fd0c7f4a95aaa55b736a7875d75ab52b7ef628ab5b22c02391e6b3ed9a7e89cdf3b218", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647449532, "uuid": "11871288-b925-4b16-b65a-11f15d022bd5", "value": "T165E47C12F461B2B9D04B04741F1723A86EEF5E518629CA13AFA8ED5E1F31251FC3FA16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647449532, "uuid": "edf9a72f-b2fb-4e99-889a-be53ea5fe2ba", "value": "066d4e2c6288c042d958ddc93cfa07f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647449532, "uuid": "e412466e-168d-479a-b1db-764702f0894f", "value": "12288:DtAanana8Meee0GBGu3qI+3DNJ3vE6v5egxS332d7t5hT/hexLx:Kanana8qGBGuoNxEOxCM7o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647449532, "uuid": "950014da-1f1d-412b-a49c-e32930f42982", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647449532, "uuid": "e9226d71-6cbe-4880-a646-41bfc73eab1b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647449532, "uuid": "7f89a7a6-3f1c-4cf9-b2ca-f8958ea63fa9", "value": "f2595fe4ebcd1200f557c1d96cef153b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1e9a203-a576-11ec-9275-42010a9c0029", "comment": "Malware payload (DCRat)", "timestamp": 1647468975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647468975, "uuid": "c21c091b-a3f9-43f9-8ae9-5facd43d7106", "comment": "Malware payload (DCRat)", "value": "9096814c6408aa93466c364a30e54f97", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647468975, "uuid": "8c990ce2-8669-4500-b6c1-0c0fae511502", "comment": "Malware payload (DCRat)", "value": "41d9459adfc2174e254616e62e78811abee49d1114f044df8ef04eab28ed0514", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647468975, "uuid": "ceca2a55-8690-460d-8dd6-d30b182f6c19", "comment": "Malware payload (DCRat)", "value": "a24bc2b4b7014e5fc8c80818252b06e648152548", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647468975, "uuid": "c61acb30-496d-44fe-980c-56e2f2c92ce3", "comment": "Malware payload (DCRat)", "value": "c532e9eb0ba79b4c7e4865953b6886538a8afbfa055755735fe9520705bebd752e3971dd7d84e2069c2d54875f1133fb", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647468975, "uuid": "2d55d40d-3c64-4643-b583-9f143374bf95", "value": "T1326633FF5194CBA6C9C26276DE7BB5C58259E02C0415CB36C758AB45BEFCA70DE0C224", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647468975, "uuid": "f93b2ee2-6e1a-4055-909f-d065f68ca6d7", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647468975, "uuid": "1e2ffbdd-7061-46c0-a46e-860edc2ec555", "value": "196608:RwxWAsDZ2of3thGxVMCp8wBCu5Anrm4RROh4:RwMfFQgC/BX5urm46i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647468975, "uuid": "96dea88b-9207-44b5-a802-0ea01bca65f6", "value": 6690970, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647468975, "uuid": "99af0e16-7b62-4a87-bcb1-0b00e18861b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647468975, "uuid": "6587886c-a3ad-4ec9-8c08-d97beef4b450", "value": "41d9459adfc2174e254616e62e78811abee49d1114f04.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a758e8b9-a4ff-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647417847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417847, "uuid": "0be89600-247b-469d-b5b4-ae5ef59f1a91", "comment": "Malware payload", "value": "8ad5986ba9d72a946b8b5db936856c3a", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417847, "uuid": "1925c742-ec22-44ac-a38f-92407f9e318d", "comment": "Malware payload", "value": "424567529230f79008084834d33dfe3699f73f679a4d863ac6018e1387ec410c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417847, "uuid": "339acfb2-eeef-49bc-82e7-9f22b42c0d3e", "comment": "Malware payload", "value": "69392e6452e93abff2ff7a66557dc9d84d30e5a0", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417847, "uuid": "89296153-c5d1-4bf8-ab0e-c5af0bbd3ae6", "comment": "Malware payload", "value": "ce17cfbb09a709d6a4e5d6495256537e6978f2deb5b3e62e353a2fd58f695770169e2dd11c69a35da03dfed30137a065", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417847, "uuid": "a1676b9a-e72a-468a-a29a-c2e3c1a43e2b", "value": "T1D6F4AF844BB09EB5ED49E187D5A8155F83B2420AF34273CCE2E2F613A9FEF211615C5E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417847, "uuid": "7eace19d-3f66-4d32-bab9-f9413e4b6fc2", "value": "12288:MYlvghdI9TrAH01Ls+PElpyhZsmJ9mdaNXJ43gy2w8P/gq0Hoh9uZPs:lg49vAH01Sl6Z/HXs52w8P/gq0HohB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647417847, "uuid": "02dea23c-ad9e-42df-b28c-b99afb35b748", "value": 776122, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647417847, "uuid": "173f03d0-5824-46a2-bc37-400caf5973f2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417847, "uuid": "619b1ab4-043f-4579-968d-299145c4de3e", "value": "QT245007793.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d6d227b-a540-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647445613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647445613, "uuid": "07a8a122-3491-42c8-ba3a-736198fb4894", "comment": "Malware payload (Heodo)", "value": "07d9d589ec0fd0a14102cbcdd0358d89", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647445613, "uuid": "d8e904a2-26ab-4e11-90a5-7e058099bd26", "comment": "Malware payload (Heodo)", "value": "426a2878ebc019931c08e02fe8060afea81aca35bedea9450b9e2c42415eaedb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647445613, "uuid": "5d674a70-05c5-4598-a3a0-b956a24059b1", "comment": "Malware payload (Heodo)", "value": "f6d164cf2fa583e7fbeca47dd8ae9bc962f8c71c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647445613, "uuid": "cc433c9f-c350-45ba-adc1-a054bc4d9607", "comment": "Malware payload (Heodo)", "value": "e8414c73439bb50265c24454b1f4dd7dd471b97c02e5518058100c97125621c485afefcb2b0a170085b5574c2068ab94", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647445613, "uuid": "aba1657d-f783-4c00-9825-548ef1b79ca9", "value": "T19CE47C12F461B2B9D04B04741F1723A86EEF5E518629CA13AFA8ED5E1F31251FC3FA16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647445613, "uuid": "877259e9-d8c8-4c48-9ce3-cfff84d2476b", "value": "066d4e2c6288c042d958ddc93cfa07f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647445613, "uuid": "33208634-7761-4963-9e01-4e74006edaa5", "value": "12288:DtAanana8Meee0GBGu3qI+3DNJ3vE6v5e9xS332d7t5hT/hexLx:Kanana8qGBGuoNxE7xCM7o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647445613, "uuid": "ef0f3f07-2400-46cb-baa0-01ab52705eea", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647445613, "uuid": "dfae7f0a-5647-4027-900d-30e339689fd6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647445613, "uuid": "44e79600-8405-49e9-a7ef-1240cf94f439", "value": "07d9d589ec0fd0a14102cbcdd0358d89", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70315f17-a519-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647428921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647428921, "uuid": "3fbe5021-7ecb-4f3e-b22f-01ef4ed7c499", "comment": "Malware payload (Heodo)", "value": "fe438ab1ac9fbe9a1ba35e2fa963f2fb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647428921, "uuid": "2dfe4469-1aee-4577-9aa5-a6f35b8fe7f2", "comment": "Malware payload (Heodo)", "value": "42b8e20e420cafa93bfcc2a519d274b071e14dcd5edca642cbd8505fffbdafa9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647428921, "uuid": "48f6ae14-b0f4-41d0-a021-fc9ca019c616", "comment": "Malware payload (Heodo)", "value": "01bea7a141b71219e17f6ea6ca45e0121160fd9f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647428921, "uuid": "02329563-c1e7-4bf3-958d-66296ccb7b0a", "comment": "Malware payload (Heodo)", "value": "97f2d14d01aa0f24f0556343fec3e71fef54c2c94b96c6a543d1e61157ed89d5131ab7782d8de3d8124f178f77699e6e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647428921, "uuid": "c4e70315-02c1-4e0a-a7a4-3dbf5975b1f5", "value": "T197E47C12F461B2B9D04B04741F1723A86EEF5E518629CA13AFA8ED5E1F31251FC3FA16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647428921, "uuid": "d8d06b23-923f-49aa-b114-c86bf667a685", "value": "066d4e2c6288c042d958ddc93cfa07f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647428921, "uuid": "893b2cd9-00ba-411a-b078-87bfd11dd28c", "value": "12288:DtAanana8Meee0GBGu3qI+3DNJ3vE6v5e9xS332d7t5hT/hexLx:Kanana8qGBGuoNxE/xCM7o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647428921, "uuid": "e2d81101-b71e-4205-bea5-bcd65583fa27", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647428921, "uuid": "f4568130-0e68-4452-a194-d499567a3365", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647428921, "uuid": "ba4fd2a7-7fba-4b1c-9a8e-3966dc2bd2bb", "value": "fe438ab1ac9fbe9a1ba35e2fa963f2fb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d12e85c0-a573-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647467739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647467739, "uuid": "cbf5805e-ccd9-4dc1-8477-d51eb2af5203", "comment": "Malware payload (Heodo)", "value": "d56dc0a84a1fc7b23e5017e921db527e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647467739, "uuid": "243439ba-f474-4db8-9b38-fec9f2c3192f", "comment": "Malware payload (Heodo)", "value": "434002096d3c7570060551f0bc38e2b07ce4a99b1b5ac30890f579a3ee1ead19", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647467739, "uuid": "0573d595-5e5e-49c9-9b05-426a3d538264", "comment": "Malware payload (Heodo)", "value": "c42457f20a4947ad1fb423918691a048e7c0f7ee", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647467739, "uuid": "61e28d6e-06dd-4af6-b3a9-5e149b740aac", "comment": "Malware payload (Heodo)", "value": "a8318ed93d2dc66971b0447cc137e654899f978220c419819e557df35911af2c28d030679d83cb4516fe4fd9599e2275", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647467739, "uuid": "0d77de93-9559-4bd8-bea5-4ef85878d50b", "value": "T1D4F4DF1176E1C076C1BF12304956A38D23FAFD509FB986976FD02A6E3EB41828E34767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647467739, "uuid": "bd405466-76dc-4d61-9ce8-644dbe530e68", "value": "66a21a1bcb4077b3ed89c00ee693486b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647467739, "uuid": "f8a629b4-f730-4d34-8001-94dadb3d4eb7", "value": "12288:g6O4TpP0XjxCCFJuf07j+Xk7hb8rLneTfABCJoWRWwfpW:BeCCF88j+XG8OTYA7pW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647467739, "uuid": "84f8ddda-3029-40fe-8f74-601cdbcdd01f", "value": 749568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647467739, "uuid": "65a706b6-f8c9-43d4-a0ab-ad857a0550ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647467739, "uuid": "ac4dee7f-1910-403c-af1f-de89b270a79f", "value": "d56dc0a84a1fc7b23e5017e921db527e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "895a0a89-a4bc-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647389020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647389020, "uuid": "34208a97-69d8-43fb-844d-5f518e19f5ae", "comment": "Malware payload (Heodo)", "value": "838b4ae54fda63e867be7ae7d1f5d606", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647389020, "uuid": "0791c44e-b127-4f78-b416-fdd59af2daaf", "comment": "Malware payload (Heodo)", "value": "434770608643614aa5a48190b6c26fdfc83878ce64be46fc7ecef167a4cf96a5", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647389020, "uuid": "023d3ae1-2e5c-453e-adec-ad5a36a30e66", "comment": "Malware payload (Heodo)", "value": "bd5ea9ca4ba7725a3fc50f6959f0c4b5b8860458", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647389020, "uuid": "3225bb23-2967-44e9-a390-b141c333c60f", "comment": "Malware payload (Heodo)", "value": "f62b0c128dcad731702220d851da80d0cfe4d969402db95f4e329335cb9d0de754aeea48dc20a849c7eb22e9154cf2be", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647389020, "uuid": "8255631c-6d55-4b12-8446-2cf5cd448983", "value": "T1A8E45B3071F74031C3AA1D3905D2DE64DAF5AD4B87B2F0D32F99AB4E99F5AC12B20616", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647389020, "uuid": "34e42e8d-e89e-4eb3-b10f-24e2e302fe14", "value": "a38617efee413c2d5919637769ddb6a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647389020, "uuid": "1787acac-67bb-4b2d-8b39-8c11c37b5cc2", "value": "12288:E94YBCR2xP7guDo463OP4eusiSOZjb2woE+MhJT:2kRAguDogPSddb2woEBJT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647389020, "uuid": "0ef6ec7d-273b-443e-9788-de22cfc73a23", "value": 684032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647389020, "uuid": "4455bee2-44a1-4c2f-9c31-fccd7444641b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647389020, "uuid": "91374b54-ee10-43bf-b128-87acdb688657", "value": "emotet_exe_e5_434770608643614aa5a48190b6c26fdfc83878ce64be46fc7ecef167a4cf96a5_2022-03-16__000335.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11a5bc35-a52d-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647437352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647437352, "uuid": "9013c1d1-92a3-4a1f-90d2-40ada2201ea6", "comment": "Malware payload (Heodo)", "value": "7d1a7c9d4746be74be411b7f8a50ace7", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647437352, "uuid": "7face521-a4ce-4810-a1a7-571670df66e7", "comment": "Malware payload (Heodo)", "value": "43aec7d9df162442c0e337c7d1ebe80c66731e6edaef048f446531e8a88e9e33", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647437352, "uuid": "861c9fbd-5b4e-4570-ab6a-f4978b582557", "comment": "Malware payload (Heodo)", "value": "95d60dc691833b921b1873fa2de39948e08fa8f1", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647437352, "uuid": "faf42fd2-6cf8-493f-a01c-59af784793ff", "comment": "Malware payload (Heodo)", "value": "5aa9ffeb359a1b9af243ce13de25bba69793151f92307fb4ad6186726a5db4bf0364edf88ec68f9ff0aa66b444449052", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647437352, "uuid": "61b255c6-3d6c-4eeb-ad3a-f11454f924f2", "value": "T151E2C02DF2A0EE1DC21EE939446895DA421DB4558502EB4FB95CFB1D2F0A5C23B1F0DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647437352, "uuid": "e21adbe6-bb0a-4f40-922b-cd68798b6b56", "value": "384:sjzZPFhNjqEBOA7iEibbwBLg0SCdiVXUKgUrNU/qWhZOdBNPJM+kqr9eCgh0k5lY:sjpFhNNlizXT28dFfPdkqstJmE6/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647437352, "uuid": "0871f156-b4d6-4ef7-971f-464a12126858", "value": 33750, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647437352, "uuid": "c0524ec5-3861-4227-814f-87e8598578c2", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647437352, "uuid": "db8e70e0-7d71-4306-a002-ea8338880813", "value": "Rechnungszahlung 2022.16.03_1423.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cc4b31e-a50d-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647423815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647423815, "uuid": "44c7cace-45d6-457a-89c7-329bf75b338e", "comment": "Malware payload (Heodo)", "value": "60c56910a7ceab796745468fce88054e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647423815, "uuid": "58dbb7ca-c9a2-46c2-aa1e-7549520951e9", "comment": "Malware payload (Heodo)", "value": "43c366653c3b263cfe78dfa76cdf820a2603cef2c63894df70b1c1d29c4f864f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647423815, "uuid": "fc80d0bd-1c15-4f5f-aac5-d9bd398c41b0", "comment": "Malware payload (Heodo)", "value": "7a058699e2d0e01959dec89e1af3d445656150a6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647423815, "uuid": "37eaec67-ae63-45e1-8f84-8287ada9247d", "comment": "Malware payload (Heodo)", "value": "32694f212986363e078f4ebaccba6487bfd4a60bdf7ec3e1e9212c337ab7136a50b44c412e2b42a70e68e6503a737ab6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647423815, "uuid": "85201c36-8d2b-4d90-b3be-392bc686ef59", "value": "T130E47C12F461B2B9D04B04741F1723A86EEF5E518629CA13AFA8ED5E1F31251FC3FA16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647423815, "uuid": "66099709-f0f2-4d18-b2f5-7990dced9323", "value": "066d4e2c6288c042d958ddc93cfa07f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647423815, "uuid": "345c8bdb-d8ad-4190-8d8d-bfb484462312", "value": "12288:DtAanana8Meee0GBGu3qI+3DNJ3vE6v5eyxS332d7t5hT/hexLx:Kanana8qGBGuoNxE8xCM7o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647423815, "uuid": "8d4a01e4-6f7c-4a3a-bea4-eb42e909a440", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647423815, "uuid": "dbdca14e-568e-4f63-a79a-14c51115e148", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647423815, "uuid": "a283288e-a92e-4b83-9cbe-b1917c1526b7", "value": "60c56910a7ceab796745468fce88054e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8804e275-a4bc-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647389018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647389018, "uuid": "cc24c40f-81a7-4a32-99d4-f30161255399", "comment": "Malware payload (Heodo)", "value": "e03d0bd63144e8cb2da90b164dd311fb", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647389018, "uuid": "a05a7b45-77d8-49c8-ac52-badbc4325587", "comment": "Malware payload (Heodo)", "value": "441a59bda62025652c718122aa6ade3f4fa311aada93ee3b0d052da5520130ff", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647389018, "uuid": "63906f48-2f4a-41b1-bd7a-685cff38d2b8", "comment": "Malware payload (Heodo)", "value": "e53eaa1f9bbef1f266da17d2a96964c4589a3f83", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647389018, "uuid": "531698bd-5080-4ae5-a85a-04a9389a7887", "comment": "Malware payload (Heodo)", "value": "d3248dae549b157fc49bd8d380ec6f8d579740cf0931f44e7a2c48abb1ee5f5c9bef3b7bbb3201374374f088632c6854", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647389018, "uuid": "15b8acb3-e27a-4c19-a218-73b384488c5c", "value": "T135E45B3071F74031C3AA1D3905D2DE64DAF5AD4B87B2F0D32F99AB4E99F5AC12B20616", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647389018, "uuid": "0658d675-c54d-4896-b2c4-9c6301aea59c", "value": "a38617efee413c2d5919637769ddb6a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647389018, "uuid": "79caf71f-3b96-4bee-80a7-d6cc067ac26d", "value": "12288:E94YBCR2xP7guDo463OP4eOsiSOZjb2woE+MhJT:2kRAguDogPyddb2woEBJT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647389018, "uuid": "4c1af5b2-69cc-4b28-9e7a-61f833b3b863", "value": 684032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647389018, "uuid": "c7f6d553-d9c4-4669-b944-f28e9547f2bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647389018, "uuid": "cb2fd0c0-f43d-4226-bf45-d71372a8acf2", "value": "emotet_exe_e5_441a59bda62025652c718122aa6ade3f4fa311aada93ee3b0d052da5520130ff_2022-03-16__000332.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88b4d632-a4bc-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647389019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647389019, "uuid": "68da8677-640b-4743-bd76-c4b7e0aa74e9", "comment": "Malware payload (Heodo)", "value": "032fe02dc1c39844e3f907e2c5fa1c00", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647389019, "uuid": "f14ba320-a80d-405d-8be6-8a47950e7e87", "comment": "Malware payload (Heodo)", "value": "447efbd1d154ef760bf1b89b06cc954c777cad7b9a7ea8bcb56837426657030a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647389019, "uuid": "c5d7ca3c-c1ca-4398-b0ec-1e8dfd5bc4a3", "comment": "Malware payload (Heodo)", "value": "6547c34e3df8a97f5f2121fb6e0d9c693e3a160e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647389019, "uuid": "a1456ff6-f055-46b1-83e4-6b35637629a8", "comment": "Malware payload (Heodo)", "value": "8d63152ea015ad06298e9dd236393153d40f3b94c943f9e5b46d792d52a5e589338cb804d2cc9d7f85efc8bcca1477be", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647389019, "uuid": "98fa75c8-ef03-4736-ade0-fbec1cac2188", "value": "T17EE45B3071F74031C3AA1D3905D2DE64DAF5AD4B87B2F0D32F99AB4E99F5AC12B20616", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647389019, "uuid": "2697ad33-ca6f-43a1-931d-4a135c59ac11", "value": "a38617efee413c2d5919637769ddb6a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647389019, "uuid": "665f78b5-00c7-4674-a91f-e7cf5bcbb7d0", "value": "12288:E94YBCR2xP7guDo463OP4eEsiSOZjb2woE+MhJT:2kRAguDogP4ddb2woEBJT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647389019, "uuid": "c2ac3f07-7c66-434f-ac68-9728a078a3bb", "value": 684032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647389019, "uuid": "0c437319-ab41-4f58-a452-be329acc5f2b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647389019, "uuid": "c58e644a-e927-4c41-85bf-02260ce80ea9", "value": "emotet_exe_e5_447efbd1d154ef760bf1b89b06cc954c777cad7b9a7ea8bcb56837426657030a_2022-03-16__000333.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f008289-a565-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647461480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647461480, "uuid": "cfb333d5-f44d-4ac9-94ab-7395fccb0459", "comment": "Malware payload", "value": "8242fe0c9a411da0dfca4c2c1e14a3bc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647461480, "uuid": "e534e875-88f3-48ce-90f5-4eafb76b8a53", "comment": "Malware payload", "value": "4489f7479f7c2f96ae84800da3c916fce9babfd1100c5fcead0f2bc54e916cb6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647461480, "uuid": "e76323e9-ad09-4761-b44e-b143bf214ebb", "comment": "Malware payload", "value": "093c635d0e340be3ec8496465521fd17ddc969e6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647461480, "uuid": "c61a2289-3730-40f7-b10f-b3e3162117a1", "comment": "Malware payload", "value": "cb44ccba5c1ee7e325d5bf860812d5cc20a20127042f0cf325c3e19856747f4dded55fd52e196402303a9bb19f8ede14", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647461480, "uuid": "58a5f910-2942-4445-bb3c-b36c4043a5cb", "value": "T1D31512BF13E88A76D3ED15B7D49400455B72F66B7A83EF031EC46CE6818B748281D29B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647461480, "uuid": "c01916ce-5759-4408-b2e7-f1a04d381319", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647461480, "uuid": "ac497727-edb1-4283-b6ef-961355d762ad", "value": "24576:TwOmeCm7Mc/6rS0z6jtfg7+DAi+NQZmEL/:TfIm7MTrS0z6a7UAi+FEL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647461480, "uuid": "cd684461-854a-4acb-a4c3-07e6e8beb6d2", "value": 888320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647461480, "uuid": "c91884fc-c0bb-4c45-9623-ab9497f4779d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647461480, "uuid": "bd598b83-d848-46cb-b364-8902ba573a81", "value": "8242fe0c9a411da0dfca4c2c1e14a3bc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "887df393-a4bc-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647389019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647389019, "uuid": "2ef2c110-4561-49ee-817f-5c60ac993989", "comment": "Malware payload (Heodo)", "value": "a58233e7b0a17988053ba211eb600c28", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647389019, "uuid": "1e662534-4006-45e5-a86e-e54eeb918794", "comment": "Malware payload (Heodo)", "value": "44b83583ba1d597a5aad8871cd3233a6a7edd02154ca6f77627c6e6f7474fa92", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647389019, "uuid": "09c7923b-88dc-428f-83bb-29858d5ddc4f", "comment": "Malware payload (Heodo)", "value": "c9409eb60d0e7da4b1ce22add56aef62eff453e2", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647389019, "uuid": "fa523fd5-034b-430a-97ec-e4e1b627e7a6", "comment": "Malware payload (Heodo)", "value": "43efacf8ee95ce36ee98bd81044aaf64eec15e2538d117ed30f0fb38f03ec8aeaf1f589d09e451581b7cf0b1433162e5", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647389019, "uuid": "b6e81051-4764-4fd5-b190-813f026419d5", "value": "T1DCE45B3071F74031C3AA1D3905D2DE64DAF5AD4B87B2F0D32F99AB4E99F5AC12B20616", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647389019, "uuid": "3653886a-3ee2-4c8d-bf44-08f10ede5c97", "value": "a38617efee413c2d5919637769ddb6a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647389019, "uuid": "fadc9c3e-8e60-459f-b699-a76bbcb85dd0", "value": "12288:E94YBCR2xP7guDo463OP4eysiSOZjb2woE+MhJT:2kRAguDogPOddb2woEBJT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647389019, "uuid": "02557471-8da0-417b-8381-82bd1778bd5d", "value": 684032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647389019, "uuid": "8f2aac8a-c767-4bf6-a058-6296bdbf637b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647389019, "uuid": "0555da26-b6de-4e29-973c-7ff9c02d9531", "value": "emotet_exe_e5_44b83583ba1d597a5aad8871cd3233a6a7edd02154ca6f77627c6e6f7474fa92_2022-03-16__000334.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e86b576b-a582-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647474220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647474220, "uuid": "35e4aeec-4676-46e3-9c05-c6cc64da00a5", "comment": "Malware payload", "value": "7c5c8ebdef399a59d3af8d01c61392a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647474220, "uuid": "af0b024d-7f42-490c-8eb0-8f2a1cf9d315", "comment": "Malware payload", "value": "4533be3c5e3a43774233b4c8216cf5723f2968adc86f33a20bc487566bc69375", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647474220, "uuid": "73d552e2-e1d7-4e59-8d2c-e508469aa626", "comment": "Malware payload", "value": "c9a894cd0698e3eafef7d248b8a0fb77c5256d5d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647474220, "uuid": "f449ef96-45c2-4c52-8474-5bf10712e025", "comment": "Malware payload", "value": "7b24bfc028d702117021dcffabe71a5a1cfececc6ab5537a48ad2b4d7712e9125fe4a900f7f7d02d0c053b95dc41e885", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647474220, "uuid": "96fe0172-4a19-479d-a161-f4c452c8d832", "value": "T187A623FD61483318C46ECC349537ECB971B56D0E0AAA89A5B8DBFEC37B5A824D911F01", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647474220, "uuid": "87b2e19b-192a-43a2-8cdf-106c3be574a2", "value": "2e94efa8721780d16bef6f247a11963d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647474220, "uuid": "4699a7fd-14cc-47e6-9250-a1c03bfd0b9d", "value": "196608:BOZhNqFNqB077EKiNsVlKbTemsOjJUp5CGusux40kBYsKrgK8L:6WqB0kRSVlOTJsOy1uju0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647474220, "uuid": "ab6ba791-ad8e-45ba-beaa-d7d13185f506", "value": 9824256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647474220, "uuid": "885fc14e-8836-4a28-b62a-dca7dfb48bd0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647474220, "uuid": "9f6d042b-6263-45c3-b82d-3614b1ec5855", "value": "43518424.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93c83d2e-a50d-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647423827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647423827, "uuid": "8e60c249-80bb-4189-b57b-816186620e94", "comment": "Malware payload (Heodo)", "value": "e026406658c3fa85fb8073c400d8c641", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647423827, "uuid": "49125a65-abc7-4f31-958f-486f5dbac9e2", "comment": "Malware payload (Heodo)", "value": "45490ab77313fd91486964eb1fe5d0e1dd150bda21017d2c77e7926258c0964c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647423827, "uuid": "48bc605e-0f4e-438b-b378-f70701556601", "comment": "Malware payload (Heodo)", "value": "b0a7a06d1a6b2ba197f68cc554b7d7746532e324", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647423827, "uuid": "402e8772-1ed5-4581-afb8-05becad674e5", "comment": "Malware payload (Heodo)", "value": "163fdb1bcc626be4a112f6420abbe8bb21ddd14a73aa13b5d506725568a6532a715cafea442f490d1b64bc496eb77618", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647423827, "uuid": "6237848e-2d23-4b5c-9097-2a9fec32f892", "value": "T10CE47C12F461B2B9D04B04741F1723A86EEF5E518629CA13AFA8ED5E1F31251FC3FA16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647423827, "uuid": "ccc4aed7-694e-4b56-a92b-29349f3ecb32", "value": "066d4e2c6288c042d958ddc93cfa07f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647423827, "uuid": "3d1ed5b4-7379-47d8-8237-8b7fbf2f4dd9", "value": "12288:DtAanana8Meee0GBGu3qI+3DNJ3vE6v5eZxS332d7t5hT/hexLx:Kanana8qGBGuoNxEbxCM7o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647423827, "uuid": "2d6ffbd2-df70-49fb-9c2c-495f43a8bce3", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647423827, "uuid": "97db5ff1-2aed-410f-8b3f-bca168914752", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647423827, "uuid": "fa89060d-429f-4215-99a2-933e9e86ef37", "value": "e026406658c3fa85fb8073c400d8c641", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a5ef523-a507-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647421100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647421100, "uuid": "ce6a5bc2-706e-43f3-a949-903d28aebc74", "comment": "Malware payload (Heodo)", "value": "a0f9bbe4a46fcdae77b50bcd3727fd3c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647421100, "uuid": "9f6a7e79-fc3a-47be-870d-7da9ed6b09fd", "comment": "Malware payload (Heodo)", "value": "45949159433ad89c430230f819a4ba2d0fc533ad4b2f5b8a3ab23e0654961ad5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647421100, "uuid": "8cd6a582-c217-434c-864a-cf82202ae5a2", "comment": "Malware payload (Heodo)", "value": "a104846118efd0b85d3a7c45863f8c5bb0a93166", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647421100, "uuid": "9236858a-f2f5-4a7f-a7c7-f92cea4e16c9", "comment": "Malware payload (Heodo)", "value": "8d204bf8b45e5097534726acb55ffb93b711502d6b963092600da0812ea3e3710b3ebc04a9417373ab22512747e2f808", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647421100, "uuid": "234d113e-31eb-46fb-b182-1501ee3292ab", "value": "T1CBE47C12F461B2B9D04B04741F1723A86EEF5E518629CA13AFA8ED5E1F31251FC3FA16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647421100, "uuid": "9a6ca8fc-ac94-4a24-8c98-a9a548bf6757", "value": "066d4e2c6288c042d958ddc93cfa07f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647421100, "uuid": "2cd6eb60-51fa-4ee8-82a3-e484dd9e8cca", "value": "12288:DtAanana8Meee0GBGu3qI+3DNJ3vE6v5e8xS332d7t5hT/hexLx:Kanana8qGBGuoNxEGxCM7o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647421100, "uuid": "305ed12b-fefa-41dd-be6a-47df425ea23d", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647421100, "uuid": "8aa5d750-3f1c-4048-8634-5688fc3d2650", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647421100, "uuid": "369d73cd-bff8-4689-8c42-2374c0553159", "value": "a0f9bbe4a46fcdae77b50bcd3727fd3c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "817376c8-a4fb-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647416065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416065, "uuid": "084736d2-e5cd-488f-8b4d-0f615d00ded9", "comment": "Malware payload (Heodo)", "value": "ad1e86f09c97f5bae77da99d2b718478", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416065, "uuid": "43e4a264-d8cd-41d9-8268-c4c3e1cf1588", "comment": "Malware payload (Heodo)", "value": "45cf2af43a1fb4b7f364c8679b6fc9e4fd3db2f95750b35f9dd5d58d9650f18a", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416065, "uuid": "300e7ee2-8439-4a75-a500-0cdcc86abf85", "comment": "Malware payload (Heodo)", "value": "bd1b9e990f27d4c8b9db85f7e7d83ae807374697", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416065, "uuid": "1015ad48-02dd-4b76-84f2-8b7b052df045", "comment": "Malware payload (Heodo)", "value": "8f039dfad52a57007a97b6f9db8c41f069140b6dfabcf53eb09fbb2ba93e178baff81a28605ce44a22583ef90afdd952", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416065, "uuid": "235aad55-971e-48c0-b2b5-cb83ae609ca8", "value": "T1C2E2D01DF3A0EE69C61DDC3944A841EA425A74258506EB4FB99CFF1D2F067C2270F19E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416065, "uuid": "1db1a32a-e3de-46dd-b38f-02144ad1ccff", "value": "768:8jf8WFhN7beEizXT2LxdFfPdkqstJVE6D:WEsTXrgXUndkq8E6D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647416065, "uuid": "b03934cc-de86-4cb0-a94e-6755922b8e6a", "value": 33737, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647416065, "uuid": "d25693c4-8ba2-4c62-a5df-18a91c8e6ce5", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416065, "uuid": "2f93c555-e317-4178-bb19-41267d44fe54", "value": "N.224 ZCL 15.03.2022.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ac3ff8e-a4fb-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647416081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416081, "uuid": "9cb30589-6b51-4523-ad6e-ef656096d098", "comment": "Malware payload (Heodo)", "value": "08eb0a933b23adf7b31caab77fe8978a", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416081, "uuid": "86252017-4dc2-4bf7-88bc-47fcabb57119", "comment": "Malware payload (Heodo)", "value": "4605ae07e63515a7e7f6e4e43feb71217e2c2b44044e414e792591d34ca437d3", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416081, "uuid": "493fe646-7171-4152-a6b3-2547a3509e55", "comment": "Malware payload (Heodo)", "value": "0d1e100c57f19962f777d998d1bb791b3ac4d16e", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416081, "uuid": "5c6d9a96-7a11-4d96-9a66-be31c05ac8ec", "comment": "Malware payload (Heodo)", "value": "5212fd7c41063a4ef6e00864d69f366639b5a9ca524d946894d586ca8bfe5443302e088723c7f1a39c52d2ef4b59493d", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416081, "uuid": "caba8fc4-9dc8-4963-9737-c72465dfae5d", "value": "T14133D00F9A22B5ACC3136C3CCA8C55F9650E5592A0C9F72B08857B9C7B1B1E7179F282", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416081, "uuid": "0414e029-e4a0-45d6-86b5-e317e16cc35a", "value": "1536:wkcEEt24xZdRBzH9hJBrdEwwNXekVIcog:hcEe2Kd3zdtdEwo/z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647416081, "uuid": "0aa97696-a8b3-489b-99d4-8c330dfd09c5", "value": 50643, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647416081, "uuid": "ccd990f3-6445-461b-9e93-0d99a4444a3d", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416081, "uuid": "0884268e-fecb-4d66-b5d6-43c10e003dbd", "value": "OMICS Online_2.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dbc410e-a4bf-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647390343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647390343, "uuid": "0b3a74b3-6a41-4869-8ee3-a9e5e9f7e3d0", "comment": "Malware payload (Heodo)", "value": "c0992f6ed12c25f0cff5326b2a96c530", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647390343, "uuid": "02fd39bb-658f-4d25-9845-8a80e5c76eb7", "comment": "Malware payload (Heodo)", "value": "46068e116b2427228131a7f870bf118fe710d46e712e616f7e98725376b47f6b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647390343, "uuid": "094cdf45-0870-464f-a8b1-e54d306da0aa", "comment": "Malware payload (Heodo)", "value": "e5aef217c39676392fcf4dd606b0c65528713314", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647390343, "uuid": "f6632693-342b-4d5d-902e-703519a0495d", "comment": "Malware payload (Heodo)", "value": "81d6c8f6c4cfb38a552c03674622ae080370f6c9a70c53b8d7eb8a70b9d1a68b5806b0a4299551b319ccb722dcac5752", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647390343, "uuid": "53d18381-eba5-4fcd-95e0-bf152c427159", "value": "T1B3248E6239C2803AE5B331B18A5A623EB2F5DB104B7FB9C35BC11C106B79997D739613", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647390343, "uuid": "2fc03252-24f9-447c-9fd4-fc1c1bb44b3d", "value": "3072:rjsfF1NzGtVFyEfs7fOzU6Nl4OE4svliUMvW9PUgIg6+Si49EdcVK/S9WHuh3cvR:cfF1NzGtVoGsil4OahPx1Sd4BHTVDjK4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647390343, "uuid": "15c64fa9-0514-4de7-bd4e-9493fa851198", "value": 210874, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647390343, "uuid": "f3a7e9c0-e91a-4de2-b71b-81554f4bf7a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647390343, "uuid": "94c9df27-60ef-47c3-83fb-20690318889e", "value": "emotet_exe_e4_46068e116b2427228131a7f870bf118fe710d46e712e616f7e98725376b47f6b_2022-03-16__002539.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8c52cc5-a4fd-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647417071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417071, "uuid": "9ae93962-15fa-4d6a-8b99-a87810df48a6", "comment": "Malware payload (Heodo)", "value": "9afde53476706bee56bb86a303df167e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417071, "uuid": "f6ab5720-faf8-44b2-aac6-70b32be38357", "comment": "Malware payload (Heodo)", "value": "465d9a667cad574e79fd360ecb5292cacac9d9fd49c08e49ae04e338efd7505b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417071, "uuid": "a82ee7e6-53e2-49e1-a40f-321f6870fd13", "comment": "Malware payload (Heodo)", "value": "e0c7510722fa65114d8527fc3a7861a0ba26b8ed", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417071, "uuid": "3032bfa7-61fc-4331-83e9-4980c56f36d8", "comment": "Malware payload (Heodo)", "value": "2b98286dc7d4970689782bec97d35a16aa79c8fef7c62afa92781158cd5d3460919efe389bd352cf85488d70adc3f466", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417071, "uuid": "bfca807c-7439-45ac-bcb6-0a506699dfa3", "value": "T111E45B06AF22A1F0C06B03B40555125AC2EF7ED0A72ED657825DFB7EDD339977A30226", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417071, "uuid": "d34b2ace-69d1-42f3-ae53-dfc0f1985d1c", "value": "066d4e2c6288c042d958ddc93cfa07f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417071, "uuid": "60707c97-f302-4ec5-af93-3f1ac59fc62c", "value": "12288:jc899XKPmN4WMkoF6ZPJSFTdtXlcIL9v6O8:7GP7WgFTdFL9v6F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647417071, "uuid": "a738e7f8-8c6b-4501-a9fd-2f82d67690db", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647417071, "uuid": "24e0669c-912d-4f1d-8667-9e446e906a5c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417071, "uuid": "3e9dbe9e-99f6-4224-9b4c-8c0f8d878d8e", "value": "9afde53476706bee56bb86a303df167e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66ef3761-a577-11ec-9275-42010a9c0029", "comment": "Malware payload (DarkRAT)", "timestamp": 1647469278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647469278, "uuid": "5b0f8bd4-c723-4f38-a3bb-aa0b4c32e6e7", "comment": "Malware payload (DarkRAT)", "value": "8064168e9d94b9d8757cd95d2b557033", "object_relation": "md5", "Tag": [ { "name": "DarkRAT", "colour": "#AC0C83", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647469278, "uuid": "33693c4c-089e-4acb-a5bb-69740cc903e5", "comment": "Malware payload (DarkRAT)", "value": "46b568ffe9d50111720c12c2923e2179a9cba8716e5e9358daf122f1250dcb8f", "object_relation": "sha256", "Tag": [ { "name": "DarkRAT", "colour": "#AC0C83", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647469278, "uuid": "6fef594f-614a-488d-9996-dc96c3e49d69", "comment": "Malware payload (DarkRAT)", "value": "a0ee9623d67ecdd6db46d4b74817a64983878619", "object_relation": "sha1", "Tag": [ { "name": "DarkRAT", "colour": "#AC0C83", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647469278, "uuid": "6a53a246-df60-4b81-bfd5-03e19edd8200", "comment": "Malware payload (DarkRAT)", "value": "86bef1dd83893651302e3c447f0e44d3c6172bb16cab4e9bd287a1d602a925aa830d7ffdc1637d1cb4134bdd55d03cbb", "object_relation": "sha3-384", "Tag": [ { "name": "DarkRAT", "colour": "#AC0C83", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647469278, "uuid": "3eacc9cd-9891-4a5a-b707-08f7bae29d1c", "value": "T1B985BE067A54CE42D0A9473BC4DFC11883F8ADCA6A26D71A7E9B33AC21513E71E4D5CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647469278, "uuid": "abf62426-b02e-446d-8572-a2710d73cb9e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647469278, "uuid": "f45a26aa-9921-4b16-82f7-37d094cb6299", "value": "24576:if8ct/RBlEk3nG2s6zAK9HYM7GutyiJdyRPN4BnHeeeivfCP0/tcHIBaYQJhyOZb:ozt/RBl/E6sK94MrNzyZyBeUqPico89", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647469278, "uuid": "19f833be-ffd4-4750-a302-4678d7b04d0b", "value": 1745408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647469278, "uuid": "f63d10d1-3af1-4f89-bfba-f3b7701f46ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647469278, "uuid": "325600ec-8df5-4f28-92a3-832dec714223", "value": "8064168e9d94b9d8757cd95d2b557033.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95e67cea-a507-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647421253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647421253, "uuid": "a47096f6-7db8-4ba2-ae4f-ec8343023cfe", "comment": "Malware payload (Heodo)", "value": "af243c7c83f0be0551ca5a7a2e26f407", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647421253, "uuid": "b271569a-a516-4c0b-9b1b-7d6c55ea6b7a", "comment": "Malware payload (Heodo)", "value": "46e777814bfc5ec8244dba6109ac958f36e7cfdefa23daec46ec50bdb55e0a42", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647421253, "uuid": "b4f3d556-26a1-4ab5-aa2e-e27f08171ff6", "comment": "Malware payload (Heodo)", "value": "e3654768258475afbde9f8255dede421f0f782be", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647421253, "uuid": "fca3f259-9564-460a-b76b-b09e1ba84ab9", "comment": "Malware payload (Heodo)", "value": "2ec822a5e9561b8227deab475b1cc161466cd7499cfd89b5fde7842ab30bda356a8659e8c8c87682af3b57421c581bba", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647421253, "uuid": "8d7d5f2e-37e1-4574-8df9-9a569f3423d1", "value": "T1BBE47C12F461B2B9D04B04741F1723A86EEF5E518629CA13AFA8ED5E1F31251FC3FA16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647421253, "uuid": "2597f317-7813-4b2f-9e19-cd227d40ff93", "value": "066d4e2c6288c042d958ddc93cfa07f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647421253, "uuid": "862c2333-9d47-4a60-aebc-278e1afe589f", "value": "12288:DtAanana8Meee0GBGu3qI+3DNJ3vE6v5eYxS332d7t5hT/hexLx:Kanana8qGBGuoNxE6xCM7o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647421253, "uuid": "d8b517e7-caef-47cb-8a17-5a049cb70ddb", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647421253, "uuid": "c7f72da4-fab1-4bd1-8a44-2e403a71a46a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647421253, "uuid": "619bc4ae-f63d-46aa-a62f-91ede1d338e9", "value": "af243c7c83f0be0551ca5a7a2e26f407", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddfb80f8-a530-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1647438984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647438984, "uuid": "0c5f7b44-9730-4267-bd52-24985cbaf857", "comment": "Malware payload (Loki)", "value": "481ff8f497119838981083b69d2e3f70", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647438984, "uuid": "d9adb6f1-cb55-4f1e-9950-f992a87981d2", "comment": "Malware payload (Loki)", "value": "472ba709de6e92915b1bd52be195da041e9c38f9a981a8609a5a401c142ce938", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647438984, "uuid": "1037cc4d-833d-4f60-9833-6d4fc0f32911", "comment": "Malware payload (Loki)", "value": "7fdfce49ab115c222f6b7b3b3382900bb8f41194", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647438984, "uuid": "3db47f9b-06bf-4e9c-ac35-5c466d971668", "comment": "Malware payload (Loki)", "value": "8a895250f30ad36ebeadb0e33e2ba4941d1cac85059a76cc94a1bf5d023edef9d56c88e4d796efbf3d8849a72864cd16", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647438984, "uuid": "1d9ab760-8d9f-4671-bb1e-9ef4e1ffeca9", "value": "T1F4F1D811E7F84B35EEBB0B72589362408374E712685FAF5F6844534B6E122C54163FB5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647438984, "uuid": "2f7f9071-0371-437e-8f5d-3cadc8346186", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647438984, "uuid": "4130fba4-2429-45f4-8be4-02d2ec49b103", "value": "96:e89cNdm45cfnLVljNWirY7/Ohiagf0JhHlgXwqpJxe+KW9dKhL5FXUq5zNt:e8MB5cvzjNWirqWoZsJhFgXDM2wd9UC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647438984, "uuid": "6971618f-8b78-4e51-9300-43227b832194", "value": 7680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647438984, "uuid": "d3c935d2-a0ca-4206-bd44-d084a48c0035", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647438984, "uuid": "158415f6-9a18-4765-b7a5-d63d0501fd36", "value": "Payment Copy_3850.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d989781f-a55f-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647459163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647459163, "uuid": "90316848-5b0d-48e8-b1e3-828e1bfbcf97", "comment": "Malware payload (Heodo)", "value": "1feb1ec39d91e7a928e7261d6819c128", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647459163, "uuid": "56055209-15fb-4f89-912c-df3a48547125", "comment": "Malware payload (Heodo)", "value": "473ba9192f77cdceaa1f4a27e39f412858ca0daffa4da964c1e3b30ba68b35b7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647459163, "uuid": "329a600a-7905-45ce-85d8-fc061b3bdb4b", "comment": "Malware payload (Heodo)", "value": "1ae15e194a08c3cc1cbfa8a0ef58d9cae28260f2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647459163, "uuid": "44ed6aaf-ec59-4905-a611-86bd81dd905f", "comment": "Malware payload (Heodo)", "value": "e9452aeb4c2a888bc8d87b2d8d069705ed4d07e9548258d6d925e9e01118e78513913648e391cadcced6d52009caffff", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647459163, "uuid": "49b7a30c-84ff-470f-9b89-18235b06e07d", "value": "T1F5F4CF11B2D1C076C1BF06741916A35D63F6FD608BB9878B6FD02FAE3EB45828A34356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647459163, "uuid": "3c20c459-233d-4f0e-ba45-d8cc7a66286c", "value": "66a21a1bcb4077b3ed89c00ee693486b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647459163, "uuid": "30729fcb-5d27-43c6-967d-89b36276c607", "value": "12288:WZjb8BOPxue5dKV9M/98f0koP1XvkgKtuBdfMAofD:WCBAdKV9Xf0kq3KMBdkAofD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647459163, "uuid": "a0c9e112-c8b2-4cd4-add6-23fb922663b9", "value": 753664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647459163, "uuid": "e2a79498-566a-43d4-a37c-bcf18219e5de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647459163, "uuid": "f679ad0d-33d6-4d14-82f5-f677a427c62a", "value": "1feb1ec39d91e7a928e7261d6819c128", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a8e4217-a578-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647469687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647469687, "uuid": "2de6ff07-6d11-427c-b1ba-8dd81730182a", "comment": "Malware payload (Heodo)", "value": "7bccf5340b4a25004db89d9ad4ff0477", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647469687, "uuid": "f1184a08-e575-4194-a40c-3d8eced46294", "comment": "Malware payload (Heodo)", "value": "4752523a2024ac0a0aeeee2e7fcd27e360a7d95d8adbf89f9ff1b9cf55e2eeaf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647469687, "uuid": "315f5ff4-b4cf-448d-b005-e9997ff95164", "comment": "Malware payload (Heodo)", "value": "ad002b15577c1701303d5318e7013f3f43a400f3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647469687, "uuid": "d3ad4b05-73c4-4963-bc3d-eb0c5cbcc52a", "comment": "Malware payload (Heodo)", "value": "f0e0d2b399808930c6948748e2b352d878f528a90b080c11b7fa4d44c9f0806e72f13b1d2cfbf842f3cef328d3c5d18b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647469687, "uuid": "86eef0f5-82de-4c78-8215-c6f7ee37d949", "value": "T1B6F4DF1176E1C076C1BF12304956A38D23FAFD509FB986976FD02A6E3EB41828E34767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647469687, "uuid": "25ba35cb-0a09-47bb-9feb-fbb2d3a9e57b", "value": "66a21a1bcb4077b3ed89c00ee693486b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647469687, "uuid": "d8ed965c-6853-4711-9208-083ead33fa66", "value": "12288:g6O4TpP0XjxCCFJuf07j+Xk7hI8rLneTfABCJoWRWwfpW:BeCCF88j+Xh8OTYA7pW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647469687, "uuid": "a006a37a-0835-417e-9496-3867a41dacb7", "value": 749568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647469687, "uuid": "497dc83b-c5ea-4c9e-82a1-d927a07ddb9b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647469687, "uuid": "82e1e9c7-30d6-4b60-819c-9a51081ebe56", "value": "7bccf5340b4a25004db89d9ad4ff0477", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4392bb4-a4fc-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647416687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416687, "uuid": "b7e6ee35-f6ec-4fef-922e-0fc5668646bb", "comment": "Malware payload (AgentTesla)", "value": "93393056896e89b5366d38f3b755b5f7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416687, "uuid": "af7c535b-6f38-4371-945d-d619ef9b7759", "comment": "Malware payload (AgentTesla)", "value": "4754cc7616f9f1cc07d8266efc7a2d7a886eabd592236e0ce3cb6a446728e57b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416687, "uuid": "1bd3ed96-374d-4e97-8f9e-bfc4e9b78a87", "comment": "Malware payload (AgentTesla)", "value": "cb810a3e63e93671c07e6490960e7d2733813fa5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416687, "uuid": "2f238da8-8b72-42d3-a5a0-d1ca06caac5d", "comment": "Malware payload (AgentTesla)", "value": "3f0741fbc02228884f5fb2b83fbc68930200791639dcb23f429d1a505c06607bb4bc4ec390d6ab9e28887b4712ce3351", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416687, "uuid": "e7795555-ed21-4e81-8fe9-9f75e0d93ed3", "value": "T1F51402362DE42BC9C0FBA230079F041D0A66DC6DDE3A908769B5F98F4534AF0897A567", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416687, "uuid": "dbd1f5ce-bbe5-4f8d-add1-b07bc0d83bf3", "value": "3072:aRt6hlEeejNqixCrjl35cDgYy29r72Di/njmb98BKWDJRWbRkNgyQ2+gVdyfQ:phyewNXsd5cDgYBF/jwyBKWDXuVyL2fQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647416687, "uuid": "3fd8d012-06b1-45e8-af11-eaa4b35d4d3f", "value": 191256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647416687, "uuid": "ad712e36-fc47-4c25-9ec2-88c7786fb5b5", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416687, "uuid": "d45c20b2-cdb0-4f65-aa92-e408400fa345", "value": "RFQ PLLC105009207.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd9fccc6-a525-11ec-9275-42010a9c0029", "comment": "Malware payload (Teabot)", "timestamp": 1647434205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647434205, "uuid": "3c89752b-6025-44b1-b825-96847edf91d4", "comment": "Malware payload (Teabot)", "value": "bf2ddaf430243461a8eab4aa1ed1e80d", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Teabot", "colour": "#A91DAE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647434205, "uuid": "a2f3f794-1f4a-459f-a99e-7ec99a98a0e3", "comment": "Malware payload (Teabot)", "value": "47bb7f855cdf116c62499240089fa1b7a69585e8b7f639e192b9d038da4094cd", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Teabot", "colour": "#A91DAE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647434205, "uuid": "116a62e3-41e7-409f-99d7-cae8245625b4", "comment": "Malware payload (Teabot)", "value": "29c497dc416d903917e92ae347371b15009eaee1", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Teabot", "colour": "#A91DAE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647434205, "uuid": "21261c39-8992-4f38-9183-c1a1e8142db7", "comment": "Malware payload (Teabot)", "value": "99d81d90334dc114ad63b6b5c5fd5030dc7698638837294a5fdce44fb7229fb6b1c8060a44495c402a94a56ce832b812", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Teabot", "colour": "#A91DAE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647434205, "uuid": "5a384a33-5dfd-48b2-b5e2-bc08665dd857", "value": "T127F53387E3B7F011EFBFE6B85914B17B564B07E002C4FA9E24469A9444F3CC96E89C58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647434205, "uuid": "70636c52-179a-4704-ba02-860298128c68", "value": "98304:ylxgweICNV+mN24ElmQjE9LBcGDIXAOthoV:ylxgBImV+mCmQjMLBarrc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647434205, "uuid": "c9744fb4-8cde-4473-9329-98bf2d355177", "value": 3371203, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647434205, "uuid": "5a58e4b1-e487-4a96-b27e-932ccaba1d1e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647434205, "uuid": "00cd78ea-4a3d-46f0-862a-af1e391b03c3", "value": "base.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79234d9b-a549-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647449552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647449552, "uuid": "d3f38135-0eb6-4dd7-9842-221e5f259617", "comment": "Malware payload (Heodo)", "value": "54ffc020501e514f175007bd39c077de", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647449552, "uuid": "4c2da741-724c-4069-87f7-7d1c0c6893da", "comment": "Malware payload (Heodo)", "value": "47e31752c94d03dae990f96af97696bf5c546933003e4565a265de206cc1fe6b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647449552, "uuid": "7ad4392e-319f-4355-bae5-18ea106d54c3", "comment": "Malware payload (Heodo)", "value": "99862223696b82b674f2f43fcf04a601667a48d8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647449552, "uuid": "4fadb58d-ee99-4f33-8164-e373d429fcae", "comment": "Malware payload (Heodo)", "value": "1e7d70be69989159e6ffdcb30e3ded22c2fdff07c2550e6d93e004f334d7c8833e9cf212566bb78406f884bee343cbc7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647449552, "uuid": "69b045b3-a62d-45ce-a182-dd940ad6b5b3", "value": "T15DE47C12F461B2B9D04B04741F1723A86EEF5E518629CA13AFA8ED5E1F31251FC3FA16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647449552, "uuid": "f23ee7a0-6b47-4393-bee3-f4b3533c6ec1", "value": "066d4e2c6288c042d958ddc93cfa07f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647449552, "uuid": "29506b82-096a-40a0-b74e-bf05ed0d24fb", "value": "12288:DtAanana8Meee0GBGu3qI+3DNJ3vE6v5eqxS332d7t5hT/hexLx:Kanana8qGBGuoNxEkxCM7o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647449552, "uuid": "73b4adfe-bca7-4d53-bbe4-344b21b59bfc", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647449552, "uuid": "1ff71882-04f2-40a9-81a4-b8342e809577", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647449552, "uuid": "7e838f2a-9cf6-4877-bb91-22d72bb64fdd", "value": "54ffc020501e514f175007bd39c077de", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e46b0add-a50b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647423103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647423103, "uuid": "00372c25-a4eb-4c09-b0c7-0a91998ee523", "comment": "Malware payload (Heodo)", "value": "2f2f388aa8854b79baef04ec7bc004e0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647423103, "uuid": "f71311b3-b050-4937-9a02-f3c88f42a7fd", "comment": "Malware payload (Heodo)", "value": "496ee8713672e1e25e0fd93d166b655f80c4f187222069eeaf5954d3a3390205", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647423103, "uuid": "07ed1fc7-cabf-4b44-bfdb-fb9ef5bd1d90", "comment": "Malware payload (Heodo)", "value": "93658902b462b4ab2fe1252d35ffc733e89396c5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647423103, "uuid": "dbd48cbc-a689-43a4-8678-5825805881d7", "comment": "Malware payload (Heodo)", "value": "169c4ed801cb6e88629dcf371339b1500a7e387bfd3845572da430979693bbc57f7cf97c06a45a9865b4c378d9f56f32", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647423103, "uuid": "2ba482c1-c64e-4000-af7d-8ae227200fc8", "value": "T15EE47C12F461B2B9D04B04741F1723A86EEF5E518629CA13AFA8ED5E1F31251FC3FA16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647423103, "uuid": "f6b8ccb9-8516-47c9-9d6a-0550b0a1c6e9", "value": "066d4e2c6288c042d958ddc93cfa07f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647423103, "uuid": "61186f16-97be-470a-9614-ff2a715e4273", "value": "12288:DtAanana8Meee0GBGu3qI+3DNJ3vE6v5exxS332d7t5hT/hexLx:Kanana8qGBGuoNxELxCM7o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647423103, "uuid": "de8d3939-6914-4b8c-ac72-fec338f02f87", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647423103, "uuid": "7df928ff-f2ac-49dd-a19d-e485aef4fe4a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647423103, "uuid": "120c2e62-e505-472a-ad1d-01ca8805d870", "value": "2f2f388aa8854b79baef04ec7bc004e0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9650142-a541-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647446251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647446251, "uuid": "0c2c3dcd-4d9c-4ea7-bb8b-972ee697c053", "comment": "Malware payload (Heodo)", "value": "faba4e21d333ac3d1fda937dcdde06b5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647446251, "uuid": "57e45582-efa6-401d-8fe3-21f6ecfd3680", "comment": "Malware payload (Heodo)", "value": "4999f52e55209102eb5f61437622af0d94224d30f3dcf2502c850377d2af0dc5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647446251, "uuid": "0877ab19-fcf0-463f-80d1-0956390853bb", "comment": "Malware payload (Heodo)", "value": "70ccb5b5196bd2b5d6c77140730808c3ef875264", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647446251, "uuid": "1b167e2e-62e6-4002-9e91-3002d49d5be7", "comment": "Malware payload (Heodo)", "value": "ccd79a263d04c38c6b2ec6964dd45883b34c49b2f1c9480bde1e89eda73cf31e9700d3f04c245c157ce7ddd7e1ab53d0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647446251, "uuid": "b747547a-efac-4409-83bd-00f4ba0c1aa7", "value": "T1EFE47C12F461B2B9D04B04741F1723A86EEF5E518629CA13AFA8ED5E1F31251FC3FA16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647446251, "uuid": "74a7800d-5c27-4507-82ac-c1dba0ca579f", "value": "066d4e2c6288c042d958ddc93cfa07f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647446251, "uuid": "5b771f4b-d806-41bb-8880-8697b333da29", "value": "12288:DtAanana8Meee0GBGu3qI+3DNJ3vE6v5eRxS332d7t5hT/hexLx:Kanana8qGBGuoNxEjxCM7o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647446251, "uuid": "4532c63e-d26f-4e33-831b-e57d0f45bf34", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647446251, "uuid": "a2a12150-e055-46aa-b2af-6382ec8b5c7d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647446251, "uuid": "e1758ece-0939-42e9-851b-b46916099b7e", "value": "faba4e21d333ac3d1fda937dcdde06b5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fbd941c-a522-11ec-9275-42010a9c0029", "comment": "Malware payload (CobaltStrike)", "timestamp": 1647432786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647432786, "uuid": "48857e92-c10a-46c5-a6ed-f1e4aff1b1c6", "comment": "Malware payload (CobaltStrike)", "value": "8b5ad07e4d0736bec6f642d744b013fb", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647432786, "uuid": "ca625aa4-25e8-44a9-984f-fe724d6afae7", "comment": "Malware payload (CobaltStrike)", "value": "4a7753f21e2c304d33a8ce823f0cf61de8c43f906c172dd69414d82da6a50ead", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647432786, "uuid": "698ddcda-e986-4e51-8b87-7df6b7c0aa9a", "comment": "Malware payload (CobaltStrike)", "value": "79860fbbf7f3f2e0e2399f23e9acd15954442375", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647432786, "uuid": "ad702fe2-098f-4ec1-9025-86e58e2cbef9", "comment": "Malware payload (CobaltStrike)", "value": "de460de195f17468e145dc50615d8fbec38d6b90cec93c16a50dc52a07ada2c0d89ea48aeda3461f66c880e40d79cb07", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647432786, "uuid": "d3f27855-2e6f-43e5-aa8d-e959230f7cf2", "value": "T1B9C52302EBD8D9B1C1223DB23842B729567D3A301F24CB9F9F989D58DD385C2A734A57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647432786, "uuid": "a8495dc7-f160-4dc0-82e5-77c29d9ddd42", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647432786, "uuid": "5f665e4c-b454-4526-96f4-5550973330ca", "value": "49152:/bA3dy0o/9WUddRC8qOZHXtsa+khuq1Ik+j0JpzJPXqROi9f1N+b7ioDG56e+:/bnz/9WmC8qOZCkT1IkFJ5B6T9f1APrv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647432786, "uuid": "d0485d9f-35f7-4ee7-9281-5557ae3517b6", "value": 2695006, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647432786, "uuid": "60b6eaee-d777-4953-b222-1a14655eb9b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647432786, "uuid": "b8d7680c-b97a-4cc4-a035-bea09cd866a5", "value": "flashplayerpp_install_cn.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7eba18e7-a505-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647420356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647420356, "uuid": "e227535b-3fbb-45b5-9031-b16e938c95fa", "comment": "Malware payload (Heodo)", "value": "493c9f3ab57cf2f28691aeff56928b1c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647420356, "uuid": "2b8b0f77-e810-46fb-a015-920dd9152b7b", "comment": "Malware payload (Heodo)", "value": "4a77f99073d5d5c92f95e4f051d7ae1facca6a7c37ae24b487f0f6bc112c6567", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647420356, "uuid": "3cbf8613-1d16-4743-8779-8cad6ca2b1fb", "comment": "Malware payload (Heodo)", "value": "5602321935150c57cb6028646721d08c9529e8ce", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647420356, "uuid": "1f3b4bf6-f9fc-4213-87b9-65a45576187c", "comment": "Malware payload (Heodo)", "value": "992acfb54b7f8f8124254e3db462205a00c6b9e36e84cca18f74d11a93d8077a7ebf8f85f45ee67ddd39d8785a76b07d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647420356, "uuid": "d19a9678-fdfe-4b1f-b4f9-4f7711fb7394", "value": "T1D8E45B06AF22A1F0C06B03B40555125AC2EF7ED0A72ED657825DFB7EDD339977A30226", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647420356, "uuid": "d409deed-9668-4d00-876a-500a09b5da94", "value": "066d4e2c6288c042d958ddc93cfa07f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647420356, "uuid": "b7eb25a4-275d-4096-a188-74ea1b681867", "value": "12288:jc899XKPmN4WMkoC6ZPJSFTdtXlcIL9v6O8:7GP7hgFTdFL9v6F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647420356, "uuid": "733b174c-fa98-487e-b43a-45d4dd8451c7", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647420356, "uuid": "e64f631b-c68c-4703-9617-43af5c5b319f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647420356, "uuid": "07ae6bf8-63c9-4d38-9ffa-949e0a0e15c8", "value": "493c9f3ab57cf2f28691aeff56928b1c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2ebd240-a4ff-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647417866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417866, "uuid": "8cbeed59-4d48-4edf-9b76-2d8bfa96b24a", "comment": "Malware payload", "value": "7626c26d5fcf888c62c8c5bbdf1c9566", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417866, "uuid": "f4685f45-1471-4eaf-bf9b-ad97529946bb", "comment": "Malware payload", "value": "4a8489cbdba8d8f8e60f2c69f001aa43115841e232f729cf706f056a04b39a8e", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417866, "uuid": "8981cc1f-8457-4a6f-974a-cd0c34d2b8e3", "comment": "Malware payload", "value": "bf5d644be7b26bf6773bebd8943a616226f274e4", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417866, "uuid": "6c7e61be-7861-4808-8f3a-1abaa50df878", "comment": "Malware payload", "value": "17a47b1888754e82150ace366e7786fab8e730dbc93ab5e5dd2d0bd42eabe4cc3140c002b57bb526733553e20d4f82df", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417866, "uuid": "fe7ae17b-2388-4108-9199-b491b379288b", "value": "T16C93F12D8A946FF4DE145909E0BC2D5FEBD45B8F8444A582BB1F7A09EF7720482063AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417866, "uuid": "d0e889bb-4b21-46f4-8030-19e108842e5f", "value": "1536:EBD1H2qbeq7rsfGehs8lm9vsFZZt8zfNgmlN03vWK2EI3uUT2Ix958ZBNy5M9jyZ:KBteEsfsXWFoV3lyOBEhxIxH8Z3yc9ir", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647417866, "uuid": "48dbc47b-30d2-4e68-8a20-43247fc9b8f2", "value": 97608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647417866, "uuid": "bc2b4dd9-d082-4072-926a-f1c80647fe2e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417866, "uuid": "d52b3a11-ee42-4d64-a321-45a2a04d2937", "value": "eVoucher.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "148828d5-a4f5-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647413306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647413306, "uuid": "6159f295-8c47-4bf9-b574-8d3c344b1dd2", "comment": "Malware payload (Heodo)", "value": "2ed6e3059f46e32e3c17acd6381b0b6d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647413306, "uuid": "c6336683-d7d5-49c2-bd8a-3563326e01af", "comment": "Malware payload (Heodo)", "value": "4b4187c49ea36ddd24ba09b60453bef24ed1e6b89c4b95983ade13ef5d476bd9", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647413306, "uuid": "2760ea0e-85d3-44a7-87d1-d5e323b1bc5b", "comment": "Malware payload (Heodo)", "value": "905d9b95608bf9eb7c1213beabb31380938847d2", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647413306, "uuid": "85e52438-baf6-4274-b2c3-b2e204104412", "comment": "Malware payload (Heodo)", "value": "572705602ed0c3df39624ff9eee23bc51853aadf7e61bebfd28409382f5e9af7db065f376d912f71a06b2264ae2fe398", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647413306, "uuid": "45b8e27d-ca81-43c1-afa9-66f0aa44f626", "value": "T1B4E45B06AF22A1F0C06B03B40555125AC2EF7ED0A72ED657825DFB7EDD339977A30226", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647413306, "uuid": "df415511-a6fa-43bd-83ce-16c2c8d11aa2", "value": "066d4e2c6288c042d958ddc93cfa07f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647413306, "uuid": "909eecb6-ee51-41c6-910d-88261e3a9dff", "value": "12288:jc899XKPmN4WMkoD6ZPJSFTdtXlcIL9v6O8:7GP7wgFTdFL9v6F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647413306, "uuid": "4fff6822-3c0f-47b5-81b0-2832c5618c3d", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647413306, "uuid": "0226fdd1-9032-4871-a1a6-67769cf7bce9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647413306, "uuid": "0665a5ba-3ba8-482f-a7c6-bd02240c938a", "value": "emotet_exe_e4_4b4187c49ea36ddd24ba09b60453bef24ed1e6b89c4b95983ade13ef5d476bd9_2022-03-16__064820.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8eaf28dc-a4fb-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647416087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416087, "uuid": "a9298110-2dde-42c3-8b8e-0cef553a59e0", "comment": "Malware payload (Heodo)", "value": "7913b4a78eb9287f94b9e7c0a309949d", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416087, "uuid": "fcbfa813-e03e-46e9-abed-efa4505dcf62", "comment": "Malware payload (Heodo)", "value": "4b59b5e7771ab40d12ad1fded6551e3bfa0bb53b87e29bf370be132e01cbb623", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416087, "uuid": "057afefc-d478-44d8-a36e-a32be99e430e", "comment": "Malware payload (Heodo)", "value": "9def726aff0109d4b95a4fd73d6e46ae4c1f999e", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416087, "uuid": "e68add78-9c20-42d7-85b4-6aa854ba5464", "comment": "Malware payload (Heodo)", "value": "6e358eb71db994e28392ac7b1b5d8fbd45079ee5a8f42973686dd2fc7891eecd82a8ad82d91c6467319fd287ccd5b489", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416087, "uuid": "b850fe34-1884-4eb8-8245-f26f54caa2d8", "value": "T197E2D01DF3A0EE69C61DDC3944A841EA425A74258506EB4FB99CFF1D2F067C2270F19E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416087, "uuid": "40bb0103-34d4-41f3-93b0-39bdb699e338", "value": "768:wjf8WFhN7beEizXT2LxdFfPdkqstJVE6D:KEsTXrgXUndkq8E6D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647416087, "uuid": "d1cdfe97-c07f-4575-bc92-864af13da9fa", "value": 33737, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647416087, "uuid": "cd789b02-ffbf-47d5-aef5-ea3adb493144", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416087, "uuid": "fc67c0fa-e66c-4a6b-bdf0-82f94e802c81", "value": "Payment Report - 2022-03-15_1526.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "349d7801-a525-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647433975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647433975, "uuid": "413ecace-22cf-46d1-affa-efc73b8ae24d", "comment": "Malware payload (Heodo)", "value": "0c982e462a5a561788c015b86fd91da6", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647433975, "uuid": "4189d52b-d30e-4bb3-bf11-e3b858bf6a2d", "comment": "Malware payload (Heodo)", "value": "4bbfa4a5af98206d7b2b7e336aa4721d2cba30538bb2d5e6333a63f6f07f334e", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647433975, "uuid": "6b968cb6-fda9-40f0-9bad-b8578bd158ef", "comment": "Malware payload (Heodo)", "value": "c0ce4c23f3fd49568d336f307f237a4e49e3f9fb", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647433975, "uuid": "a23f6cce-f829-43be-b30c-491e7c6c9163", "comment": "Malware payload (Heodo)", "value": "ca4d542a53fc0b448d5161b2959a4fa3d36ac80a3db4681b20c4d2329c94e2a2ff2c0ad58bdcd6dde776daf41c94de6b", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647433975, "uuid": "f10623f6-2522-45c9-9ee3-ceb0c6853847", "value": "T1F3F2CF2DA3A0EF5ED61DED38849881EA421579154506EB4FA85CEB0D6F493C33B1F0DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647433975, "uuid": "daf20920-3057-443b-9f27-970acd30ed31", "value": "768:ojFhNKbeXizXT2LxdFfPdkqstJ1goE6vS:oBTGeXgXUndkqegoE6vS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647433975, "uuid": "22b156ef-d761-43fe-a8ad-bc1e5e88ee78", "value": 34391, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647433975, "uuid": "b77ce82b-9d21-4175-b20e-d11cc7a257be", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647433975, "uuid": "111eb013-2363-4c30-847a-8c54ff7a4b86", "value": "GS-8479-report.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4b5be76-a55d-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647458296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647458296, "uuid": "eaf56452-3989-49e4-8543-6fd4dcf4a230", "comment": "Malware payload (Heodo)", "value": "fe202b586dfe35fafb494acdab77ff2a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647458296, "uuid": "b9ccb30e-06f5-4e40-ba26-1dbaaf34a874", "comment": "Malware payload (Heodo)", "value": "4bd5342142fe78ddf287c7a4bd136724a22c3bb85f593086bc2e3dc18c91acb7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647458296, "uuid": "001ad6a9-eccb-4675-bcbe-432f5a6b5dfa", "comment": "Malware payload (Heodo)", "value": "2ac1d54b458a820ef3f941f04cf6c70c69e0699b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647458296, "uuid": "a3c6b086-1c3a-4146-9875-e96dc754729c", "comment": "Malware payload (Heodo)", "value": "698e8fd0a71b2ccdd6392dc69c1fd442bc3bdf70811f61996415f39d91dc708361a53d90d194437760bcac46acd6d471", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647458296, "uuid": "6387d550-6456-479a-a42d-e44f1382ba71", "value": "T17CF4CF11B2D1C076C1BF06741916A35D63F6FD608BB9878B6FD02FAE3EB45828A34356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647458296, "uuid": "6c34669f-7146-4e3e-9472-0af366b33a35", "value": "66a21a1bcb4077b3ed89c00ee693486b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647458296, "uuid": "8c80c527-733e-4ca2-b7bd-6ef76c4feaf1", "value": "12288:WZjb8BOPxue5dKV9M/98f0koPeXvkgKtuBdfMAofD:WCBAdKV9Xf0k13KMBdkAofD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647458296, "uuid": "67eb2e66-fee2-450d-a237-e25299421be3", "value": 753664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647458296, "uuid": "7745a82e-ea3c-4e12-8668-7e0f5dccb33a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647458296, "uuid": "f041d719-96bc-440f-8021-7324cb6271d4", "value": "fe202b586dfe35fafb494acdab77ff2a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39604f3e-a4fd-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647416803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416803, "uuid": "8e87a3a2-fc0f-40af-99c3-879912c913a3", "comment": "Malware payload", "value": "6319f10cb2d71ff21b1ff11c54f51045", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416803, "uuid": "167a92f5-06fc-4a8c-b6d1-cc6f5f973149", "comment": "Malware payload", "value": "4c8ec42ba7be6be9acdd8fd40e23126a93699dd2506326e729de36a2bd8d7d58", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416803, "uuid": "aea3f2da-6e04-4869-af72-472a3652013c", "comment": "Malware payload", "value": "388e0f9a417dfa7bb89b6ee324dbbe50662e0d96", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416803, "uuid": "ac8ea10e-b179-4075-9979-8b6f4f8320fd", "comment": "Malware payload", "value": "e74c8e9ed5346345721bb9c14d19f1ed27d30a0ce322787d32d304c1556c2ff2da2fbc9c9a739b9fa596e0ace7f67f53", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416803, "uuid": "9cc18e2c-a830-4334-aeae-b5e94e430eb0", "value": "T1AE35E09D3790729FC9ABC872D9A41C24EB74B83B570BC207A01356AD9D4E69BCF141F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416803, "uuid": "13d89a95-1c00-44cc-a40a-0bd1d2c9d266", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416803, "uuid": "d0f7860e-64cf-4081-8714-216d4dfa0fa7", "value": "24576:p+wOvDFQLyj6moygoEI6BF4pn6lCUl6DUN8WyOd5U/ZQa2O:p+fvuLQH6BF4doCU3/Bdg6a2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647416803, "uuid": "9e2f7cee-6797-46f5-ad62-762cf669588d", "value": 1061888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647416803, "uuid": "12b811e2-7604-4e9c-9c01-65087fd69386", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416803, "uuid": "87814450-7592-4bea-a199-7857ae1cd5b6", "value": "Purchase_Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8da8519b-a4fb-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647416086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416086, "uuid": "b16477e6-8260-4179-a462-9e7fae544743", "comment": "Malware payload (Heodo)", "value": "01e7e65fea1f1c9479e4c741890dcce9", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416086, "uuid": "de10e84b-3baf-4990-b27e-7ae70ab1cfda", "comment": "Malware payload (Heodo)", "value": "4ce9e556079c5c211947df0451837e880d9b961fedad7329d4899735863fce77", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416086, "uuid": "65afff9f-54ee-49e6-834e-c38997dcaa58", "comment": "Malware payload (Heodo)", "value": "859f47100e4480054ba819db2c19c6eb4843f279", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416086, "uuid": "ea4c19d2-577d-4466-b2f0-48be824b5265", "comment": "Malware payload (Heodo)", "value": "d1aa6eb6c87670924df1eab2faf8878a5fd1cb89b42829383a224f5f7e9aabdbb9fd4a2ba0188c6ae3d2600738df47c3", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416086, "uuid": "30f8b8d0-57cb-47d7-aaaf-a4461ba6a7f2", "value": "T142F2CF2DA3A0EF5ED61DED38849881EA421579154506EB4FA85CEB0D6F493C33B1F0DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416086, "uuid": "9c732515-d2f0-46bd-b01b-e969f7f32d6b", "value": "768:IjFhNKbeXizXT2LxdFfPdkqstJ1goE6vS:IBTGeXgXUndkqegoE6vS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647416086, "uuid": "4567321e-583f-498d-a553-ed4e899b73d0", "value": 34391, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647416086, "uuid": "c5ca975b-31b7-45b6-985f-cb68d59106ad", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416086, "uuid": "692a90fd-bcb2-421a-99e1-1a51542e8f9a", "value": "Payment details_1.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8107ff80-a579-11ec-9275-42010a9c0029", "comment": "Malware payload (Smoke Loader)", "timestamp": 1647470181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647470181, "uuid": "2358f521-5bb6-4f21-96ba-a7af8923e38b", "comment": "Malware payload (Smoke Loader)", "value": "47ad50e7ce1f5aba9801c8e7e96e70af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647470181, "uuid": "325e754a-2706-47d8-9bfa-cffe999d7e4d", "comment": "Malware payload (Smoke Loader)", "value": "4d0feaf75a3e81618735ca8b05dec273d0d9d83e225d6013218709d9efdd732e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647470181, "uuid": "bdde3287-4461-4ffd-abf9-aa7760b1551c", "comment": "Malware payload (Smoke Loader)", "value": "5ea52c0653cc02cfc36cad78d5640611d0660cb2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647470181, "uuid": "8a47b595-b48d-4830-98f1-fcd2714d44d9", "comment": "Malware payload (Smoke Loader)", "value": "50d6678b693f300430c6a1cb0308a49e414ce112a0b88998aa060f46c58b66cbaf6e32b908371799f73753c436f99aa4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647470181, "uuid": "9151d26d-402b-4b28-9059-0193fc28ff02", "value": "T1C434CF223760C833C59624715864CBB27A3FB9326AB5C9473B541B3E5F313D2AA7934B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647470181, "uuid": "98e90618-2473-4a7e-a379-3b707541f415", "value": "c0473d6b08a443ec380cb4c04207d018", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647470181, "uuid": "79e1a51b-ae44-43e5-84fe-0311ca145128", "value": "1536:cVd6LRohrDyQRlOZ3XCBbEza6F3OkSn/MiTISYb34li55Cg8/FByY554wwAL2B:cVoLKLPsSYb34losgm554wj2B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647470181, "uuid": "871e55f7-c08d-4177-844a-b26a8323f6b7", "value": 242176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647470181, "uuid": "78fce6ea-07bc-4adb-956e-1a0a513aad59", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647470181, "uuid": "06c13c39-c462-4d38-9a61-857abd644b07", "value": "47ad50e7ce1f5aba9801c8e7e96e70af.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd44c14b-a568-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647463088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647463088, "uuid": "f2d5661b-335d-4388-899e-bc9f7b5426f4", "comment": "Malware payload (Formbook)", "value": "c59332b5a9609325e0319473f9e689fe", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647463088, "uuid": "8d7cdaae-127a-443a-b697-d54e2567d07a", "comment": "Malware payload (Formbook)", "value": "4dbed228adad670d76d01a7815ccf6e6275f75774363dab1b089f58149040d74", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647463088, "uuid": "c8d6fa94-0e89-41ce-a16e-fc0fd6ba1359", "comment": "Malware payload (Formbook)", "value": "8254bd9ba01feedde6bb525ad409dc984aca5202", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647463088, "uuid": "6f0aa313-60f8-4dd0-bc40-c8239f4abd04", "comment": "Malware payload (Formbook)", "value": "08f0f1c6ad25c31f6860c77ff4d17b0cef70201a8647e4f24ff4cb2ca87667d3a62e6e0622ab473985801abba0b32841", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647463088, "uuid": "2dec337c-9deb-4317-a2f5-6efd994eb75b", "value": "T1DA8533F187AB2A7CE4F28E005CDAD415DCB59906BCF4E7DBD71B4EEA74111920A0F09A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647463088, "uuid": "9a6f77da-7b9f-4075-b0ee-5458b127583d", "value": "24576:5F+wKM1+Ereomio90nUX/S+w64Nz+JKmNwYC1VYHnLnos1qwI+MCeeSY:CwKZEaotLAVwL5mJUYHbpTBSY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647463088, "uuid": "8fbb7b71-3858-4d99-94e6-d0f38eac87a3", "value": 1708832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647463088, "uuid": "52ab389b-7281-4442-a67c-5d130bbe5978", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647463088, "uuid": "afc7b739-ff4c-446f-8ab4-70ffa910f23b", "value": "QUOTATION_1.r11", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cce0ac8-a578-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647469691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647469691, "uuid": "a3ea135c-37a8-4e6a-a4ff-a50f05fa4d8a", "comment": "Malware payload (Heodo)", "value": "a3db205124a3af9733455e51172c3732", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647469691, "uuid": "e76a1881-ffc8-41f5-9478-41f246ef036c", "comment": "Malware payload (Heodo)", "value": "4de7837c48a4eec54d3be054c53e41d34b91f7608520e100fb87054d167055cd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647469691, "uuid": "d4400ed8-8486-41e7-aff4-9a03d1ca952a", "comment": "Malware payload (Heodo)", "value": "193fcd294023acb0759c885f4e549913fbc93dcc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647469691, "uuid": "697c72cf-ed0d-4c4d-8a74-5941eb583228", "comment": "Malware payload (Heodo)", "value": "ef779b862013b7d13e45207a7849f3292c5c15d1de3088bff916373f07d998c4d99f6096c630936a89d0b80d4472299e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647469691, "uuid": "1699e2b7-b6a4-4a32-be8b-0b3a468c76ee", "value": "T1FCF4DF1176E1C076C1BF12304956A38D23FAFD509FB986976FD02A6E3EB41828E34767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647469691, "uuid": "9d338436-200d-40af-8fe5-2e08e4dcae06", "value": "66a21a1bcb4077b3ed89c00ee693486b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647469691, "uuid": "9bb5e703-76d2-4d6e-974d-d73f6aa7ac0a", "value": "12288:g6O4TpP0XjxCCFJuf07j+Xk7hl8rLneTfABCJoWRWwfpW:BeCCF88j+XM8OTYA7pW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647469691, "uuid": "e2c062b3-a29b-46da-b354-037ea25ec9b7", "value": 749568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647469691, "uuid": "6116f759-5b51-43da-926f-04db1288a0dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647469691, "uuid": "9628e3a7-40f3-47a3-8a00-de3f71be7801", "value": "a3db205124a3af9733455e51172c3732", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fe95d12-a547-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1647448570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647448570, "uuid": "2a8c6064-a810-40d3-a891-0de0503b353d", "comment": "Malware payload (Loki)", "value": "0961ad4f31b70e3056bac17854c86cd8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647448570, "uuid": "e1d41be0-c6b3-4a92-985f-5856b5ab4c43", "comment": "Malware payload (Loki)", "value": "4e29b1693a1980ff834d472befce5debd2ee4288b0df8d5bcc808c3b172aef82", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647448570, "uuid": "5de6f6ac-78df-4a89-be1a-8bfdd7ab3557", "comment": "Malware payload (Loki)", "value": "1091932de5b093418558a2d28398ff261ffc6c18", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647448570, "uuid": "d91b4e1a-9120-463c-9246-c42fb1bbc740", "comment": "Malware payload (Loki)", "value": "29be6a288a7f05eb79b1f9e5272146125eddca30e86f964ca53e6138ab580d5fdbe80f7201aba5f7efcea7d9d796c5dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647448570, "uuid": "a8667167-ca06-439d-9a53-45f23a805d70", "value": "T17264120D29C889F3C3B64BB526F5B379F3BA2A48416859072F492F7D35B91C08D9C789", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647448570, "uuid": "8bb27ef0-ba29-441b-8de6-f9b1c97f686e", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647448570, "uuid": "01b638b5-82fa-4691-b718-54c0407f5d94", "value": "6144:rGiK+1L5dyzHbvwGwEt18KkSL99+uU2dgaR78tqeVYPm7O+oHbBP:WO5dSH0Gptnh9rJcYPmiP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647448570, "uuid": "a91e934d-f8d3-497f-b8eb-83a6276687af", "value": 307899, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647448570, "uuid": "a74edbf2-11cb-4b65-b167-23a60e3212de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647448570, "uuid": "07e98ce8-83d9-4116-a68b-5d8475753175", "value": "vbc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "741b6fd0-a4d5-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647399722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647399722, "uuid": "923ca2fe-e554-429e-9580-a807d524b167", "comment": "Malware payload (Mirai)", "value": "08aca18384cf32cd8796bb02fea03c07", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647399722, "uuid": "44a836e6-0729-44e3-ad81-b6cd08c5e714", "comment": "Malware payload (Mirai)", "value": "4e5aced627646ff9425802a256c80d6c8971c3daa4c329b83d9e96d492a8cecd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647399722, "uuid": "26a687cc-cbb9-48c7-bde0-86fc0981c77e", "comment": "Malware payload (Mirai)", "value": "e633e9cd36858df5284556177aa94085440ae1ab", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647399722, "uuid": "fd1e86a8-c923-4781-9d2c-46e12213e18c", "comment": "Malware payload (Mirai)", "value": "d7756a776be1e5c4bba439d3c44ada473a7361333d82fb91c839318dd099094ce7312fd1df5c6474c74de651a0d52fff", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647399722, "uuid": "5646baa5-8845-4d5d-a952-47e399a34e77", "value": "T16D633A61B9818627C5D423BBF66D528D3B2563F8E3DF32079D212F513ACA82F0D27A45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647399722, "uuid": "91efc3aa-e62c-45e8-aa5c-bf73bac9002d", "value": "1536:itXw6FDUxyC5Hjc8zpkTYy013FFEjtQDanabJTJa10v:itXw6VPjT0JnEB4PT4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647399722, "uuid": "a014dabb-2f37-4414-b8c6-9a7733f1eeb9", "value": 68980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647399722, "uuid": "88dddc56-4b41-4874-b6ae-aa0d276e6334", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647399722, "uuid": "90ab392c-079b-4105-a521-2e0de02814b4", "value": "08aca18384cf32cd8796bb02fea03c07", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "951f6eea-a4fb-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647416098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416098, "uuid": "59453a68-1152-4826-bff2-446cf3f0b317", "comment": "Malware payload (Heodo)", "value": "ad0ea48f4534356afa00f9e225082d1d", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416098, "uuid": "2c780440-39c7-4982-848a-aef8f5d64907", "comment": "Malware payload (Heodo)", "value": "4e60c8e1b4923dfabf684f13bdd36ad7556afa2061eea08500b48b27be7e9f53", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416098, "uuid": "5fecf06c-1403-4ef8-94b2-9b444bcffdf5", "comment": "Malware payload (Heodo)", "value": "6c84ef9e25f0dbcc3d965db918a22cb8581d418f", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416098, "uuid": "185f7008-9ded-4ebd-b453-4302ca157a89", "comment": "Malware payload (Heodo)", "value": "53dadcbe125204fbcf8cebb1dc32f85a6606a8b492ce70be0d998b96b37849391f66c2a858f18f4b79fdc6c07b650727", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416098, "uuid": "d4624629-4fb1-493e-badc-731bde83f4db", "value": "T13BF2CF2DA3A0EF5ED61DED38849881EA421579154506EB4FA85CEB0D6F493C33B1F0DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416098, "uuid": "a8403d5e-0976-4a83-9a97-e2015c76b9ee", "value": "768:sjFhNKbeXizXT2LxdFfPdkqstJ1goE6vS:sBTGeXgXUndkqegoE6vS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647416098, "uuid": "e687bc4e-ffca-4bd1-a796-9629bd9e7d6b", "value": 34391, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647416098, "uuid": "3d9d716a-510f-4a64-bf80-36504ffb64b6", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416098, "uuid": "d7595f4b-44fb-46c4-8669-16963c835ca2", "value": "Report - 2022-03-15_1959.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bcfe643-a518-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647428457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647428457, "uuid": "8cb1e36c-5e9c-4c4d-be07-f61af874655b", "comment": "Malware payload (Heodo)", "value": "8a5d98ff6545c6d084870a7a345595b4", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647428457, "uuid": "98fb155a-dda4-429e-8e9c-f7f066e2009d", "comment": "Malware payload (Heodo)", "value": "4ecfc28bd85dd3b111e0e605d4c5cac4eeb0f8b40c9bbfc53f480823983d7c0b", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647428457, "uuid": "ff35b5c0-5bc8-4663-8745-44c26f7a1af4", "comment": "Malware payload (Heodo)", "value": "e970d529c80173a3b7e114aebe0562bcf3a05c76", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647428457, "uuid": "e6e6a187-f34a-48fc-984e-9a39e050a453", "comment": "Malware payload (Heodo)", "value": "4f58fc372d416f0409dffa6af9a4755d519a32884df447cc49119c673739ed1c4eb59c4be188439d8a3559a582339ef6", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647428457, "uuid": "079dd691-d99b-4074-a65d-bc5e93ec4a0b", "value": "T1CAF2CF2DA3A0EF5ED61DED38849881EA421579154506EB4FA85CEB0D6F493C33B1F0DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647428457, "uuid": "c84ee52f-f083-413e-8676-b7391297daae", "value": "768:ojFhNKbeXizXT2LxdFfPdkqstJ1goE6vS:oBTGeXgXUndkqegoE6vS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647428457, "uuid": "c5553eb3-6080-4927-8706-de45deeb1d47", "value": 34391, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647428457, "uuid": "ad3e6277-710a-462f-bdfc-9c9a1a85c5f6", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647428457, "uuid": "2b7589eb-2afb-4b76-b7e9-504517ae94a1", "value": "TL7139526922_202203161040.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cee7dbe-a4db-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647402367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647402367, "uuid": "02b83d52-6e7a-40dc-beda-4e9270cb14d5", "comment": "Malware payload (Heodo)", "value": "76e1b92e56be4105cff1382431ba4f5b", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647402367, "uuid": "b334900c-7c72-4924-a965-07c70002571c", "comment": "Malware payload (Heodo)", "value": "4f3b3aaffee2393e2d707227638b34c1bd2cb49d5e7dbd30995dd42eeb00fc61", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647402367, "uuid": "80bd7310-d2b2-4502-90fc-45b7654f3568", "comment": "Malware payload (Heodo)", "value": "37f3ced88a27219d05c0b04840e0ef242b3a0701", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647402367, "uuid": "785e5220-9fcc-4520-932e-6a64d760d31e", "comment": "Malware payload (Heodo)", "value": "6d9a164f921ef199fc7b7aabe16255a0eaf65d5ebe43182d3c11e76956dc0e3a7f7375819bf9d17e60ea8e42b78320c0", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647402367, "uuid": "d0fa9c0e-6c22-463c-968a-e4a7af2b8ff2", "value": "T1CFF2CF2DA3A0EF5ED61DED38849881EA421579154506EB4FA85CEB0D6F493C33B1F0DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647402367, "uuid": "9e16928c-2f41-416a-b621-fea075435fe6", "value": "768:YjFhNKbeXizXT2LxdFfPdkqstJ1goE6vS:YBTGeXgXUndkqegoE6vS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647402367, "uuid": "96683ab9-9e21-44e7-9ff9-48b7bbc09537", "value": 34391, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647402367, "uuid": "f22bb772-54d0-499e-88ed-089854ec4c07", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647402367, "uuid": "1fa995bd-cd57-4856-8030-1b893917055b", "value": "Form.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a170bb3-a572-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647467056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647467056, "uuid": "194750ea-df48-4f4d-82f6-f87ff47eb681", "comment": "Malware payload (Heodo)", "value": "7442b86172be6bcff59a1f476927be0d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647467056, "uuid": "d4b5f755-dafd-460f-85ac-fa945100a076", "comment": "Malware payload (Heodo)", "value": "4fde87a8e2f7e76c5bca4fa412d2a2da056367a32ce79aec8c91a83d143481c8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647467056, "uuid": "7ab547cb-f1d0-4797-bd24-4f78310c543a", "comment": "Malware payload (Heodo)", "value": "71801870b999b1f8873c727af568f658f9ea2424", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647467056, "uuid": "8d505573-4c00-4b8a-8497-1d4f667dc80e", "comment": "Malware payload (Heodo)", "value": "70f51ece2c29fba4d627b38fc390614de990668bd9be1f1c746e115727910fd6496f228f2f717f147c88c7c7a169b61f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647467056, "uuid": "f5aa6fb0-872f-413d-ae24-f44d702a1ecf", "value": "T127F4DF1176E1C076C1BF12304956A38D23FAFD509FB986976FD02A6E3EB41828E34767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647467056, "uuid": "3b60f1b4-c673-4eb3-912c-478fd12ed3dc", "value": "66a21a1bcb4077b3ed89c00ee693486b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647467056, "uuid": "4854bbc8-58fd-4e38-8ac1-67b7b49f3c55", "value": "12288:g6O4TpP0XjxCCFJuf07j+Xk7hL8rLneTfABCJoWRWwfpW:BeCCF88j+XG8OTYA7pW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647467056, "uuid": "0dfa27e0-70ed-4435-98e6-bbb87106e2f1", "value": 749568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647467056, "uuid": "993e62e6-b6cd-43c3-b550-f1db0a2508a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647467056, "uuid": "2a18611b-22d8-4c93-85ca-5510bb66fa91", "value": "7442b86172be6bcff59a1f476927be0d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f657a9a-a4f5-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1647413458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647413458, "uuid": "ec96cbd2-44a9-47eb-b057-ab10b3bfcfcf", "comment": "Malware payload (Loki)", "value": "0198d0bb677d8075c0baaa10243630aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647413458, "uuid": "1a5a5017-f6ae-4a4b-89f9-ae62efbe5418", "comment": "Malware payload (Loki)", "value": "5031a3ba6ca72289b8627f3dcb9111380900e4682ff11b901c789cf3588f7afc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647413458, "uuid": "bbbb8c75-7b13-4c36-8b0f-f019b988e549", "comment": "Malware payload (Loki)", "value": "f97d375e697e526761ae548ed4eeab02a7bd781e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647413458, "uuid": "3fa12ab2-e387-4610-889a-7a18737ded6f", "comment": "Malware payload (Loki)", "value": "f4417ea373d6a93d4c65580984548ce1d8fcdc1e06130a47bdef7ab1378cfce4dd5ff95dfbaca66430d61459edc05054", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647413458, "uuid": "cf52526f-0319-43e4-a760-cf758a245196", "value": "T1A68522567A458DB7E2031C794C5DD6B228A3ACA95149A12CB9AF360F08F131123FF76F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647413458, "uuid": "2358b91c-2824-4625-b3a8-943bbc8ce4f7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647413458, "uuid": "f70cc131-1d74-4920-8060-9fe7a8d0f7a8", "value": "49152:vYvEQXJG0G37ck+dxhW1/dRr7mj1ij4Cw9yZAcP:qJG0G37ck+dGVtmxuw9WA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647413458, "uuid": "ff57bdab-db2f-4944-b732-1c8327fc95ff", "value": 1736704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647413458, "uuid": "8aeaf090-bc20-4ff3-bf09-7bbe11c99041", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647413458, "uuid": "83a4cdcd-510d-4709-aba7-a1568db19a72", "value": "Estado de cuenta.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69102145-a51c-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647430198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647430198, "uuid": "e3116c9c-312c-4eb0-8263-5d950ad75665", "comment": "Malware payload (AgentTesla)", "value": "73e5451011ebf24c6ff6b945adf6f443", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647430198, "uuid": "1e24c112-0c19-427b-9405-18efe13783a6", "comment": "Malware payload (AgentTesla)", "value": "5057d8b5104c79609ea7234da4d51f6883622ee5e3e1b660489d247b920f6d90", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647430198, "uuid": "1bf858f4-ee09-4474-848e-11d6ba410d2a", "comment": "Malware payload (AgentTesla)", "value": "33cd90107c301a1dc51b13142160dda8dc525483", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647430198, "uuid": "c43dd74b-3995-4d70-8854-a5cc8c1295b4", "comment": "Malware payload (AgentTesla)", "value": "e45608a4d8be26ae2770ee5fe52795cb6f5bf7bf72d33ef1cafc9eec704f0d2d411e30194c96e3ee5dd5129889ce0f81", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647430198, "uuid": "787c7bc8-abd2-4688-8c75-dd1a6720c670", "value": "T14BB4AE5D323035CEC82BCF3189619D28EFD1AD76931FE117549335AEA67CA9B8F044A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647430198, "uuid": "4746e967-4e9b-458f-91ea-9a54d79f0034", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647430198, "uuid": "e7a58dda-057f-49f4-a8db-bbaf0039bcca", "value": "12288:gotie5WzalD9dm6SB3sH6+l/RahVGYx/EBXwbKlJoQ9RUcZ64uQlRpKO+7G:ft/5ka1z/6+l/RahVrSU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647430198, "uuid": "1ce188b9-0020-41a3-a2a5-cc4328bed97b", "value": 525312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647430198, "uuid": "ed2658f3-1710-495b-b09b-23313a9dcc1d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647430198, "uuid": "bc071d4a-cca6-4f47-a5e8-5de8c10e8d82", "value": "Shipment Docs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "704cbceb-a4c2-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647391555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647391555, "uuid": "d1c69c59-b37f-4b97-a3a7-660d8e1ed63c", "comment": "Malware payload (RedLineStealer)", "value": "bba76f47943390b7f21a4c284a26178f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647391555, "uuid": "fefa3060-769e-434e-9ae0-ea95e7b680df", "comment": "Malware payload (RedLineStealer)", "value": "505e0842e4977d13d918dbfaab8f0fe4dcc229afa36c8881b558efcd6cc41b86", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647391555, "uuid": "15c9dcf1-c677-45e4-af94-5fd8e4b76739", "comment": "Malware payload (RedLineStealer)", "value": "6b953ece746822a965f64256612efce79045bbe2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647391555, "uuid": "9e7fc0dc-8998-417a-a534-5aaaf873b84a", "comment": "Malware payload (RedLineStealer)", "value": "2b8522fcc9ccfa493f6c6740fb0cf999239095ee28c7eb5000ee617838b768813319cc3ee1943f5ac8b55e2c9b859b3d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647391555, "uuid": "bda3409f-3981-46bc-bcf1-7b9db7ae69f0", "value": "T1F945DF43B668EAA9C83BF976B685014135E6B33A415C65E319388C73CFD904A3FF7858", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647391555, "uuid": "0b19dbae-5d4b-4992-a6f2-f1404fd4562b", "value": "b2622b3f891d26c181b8a01004edd7f0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647391555, "uuid": "d4189abc-809c-4a80-8c49-cf13c00d0cd2", "value": "24576:UUkKusv23eiGyMjer6+RWnlGjb8Yf4njpuauyf5P:UU3l23J1uVnq6jprf5P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647391555, "uuid": "d6c99c6f-ddb8-4342-883b-afd84d0ab99e", "value": 1215888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647391555, "uuid": "be5843c2-03d1-4f04-9f20-c29560f866bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647391555, "uuid": "e667f03b-cbc1-492d-86c8-184e9a7cb78a", "value": "bba76f47943390b7f21a4c284a26178f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bf7d761-a4ff-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647417667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417667, "uuid": "51a48348-b01d-4869-9efc-e7dce4b65fb4", "comment": "Malware payload (Heodo)", "value": "d3f2348a267584f34c7efec4bb59ae1c", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417667, "uuid": "1052ab6f-f097-4c53-a5fb-25a8b53514f7", "comment": "Malware payload (Heodo)", "value": "5081c1a97c39985a12f7b55d7bb2c5782e58c3d62314619942cb49b8ae26eb1d", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417667, "uuid": "6284dac2-78aa-43e9-9fa6-881aeb55f484", "comment": "Malware payload (Heodo)", "value": "fb21a33094f10d083981036d9f1bd4da538d2868", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417667, "uuid": "e1ba3f25-5fe4-4a0c-889c-e424e95f2dcb", "comment": "Malware payload (Heodo)", "value": "e5e2233bc43b8d788b820c99ebacace6c9458e98566c7ce210b958b46be056801fbb8786b62e1e5fea68d43ded9103ee", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417667, "uuid": "34f2e706-b7b2-455c-9e35-262aacfa3a04", "value": "T1DBE2D01DF3A0EE69C61DDC3944A841EA425A74258506EB4FB99CFF1D2F067C2270F19E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417667, "uuid": "dac158b8-c1aa-400c-b5b2-2785dd65d0eb", "value": "768:sjf8WFhN7beEizXT2LxdFfPdkqstJVE6D:GEsTXrgXUndkq8E6D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647417667, "uuid": "0c982434-d40d-48dd-9dfb-14482ade7ef7", "value": 33737, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647417667, "uuid": "731fd377-2a18-4dfc-9efe-cdd70b4ea8f3", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417667, "uuid": "f4ba059d-f369-4cb8-9861-4af52f1254ef", "value": "491RVUQ_897.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cba3175b-a55f-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647459139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647459139, "uuid": "7b6ed3eb-3816-4e2b-9ba1-b4366ec7fbee", "comment": "Malware payload (Heodo)", "value": "3c0457a58701e2b2f6b02d1d9b881d2d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647459139, "uuid": "eca527d2-3a35-4987-ab77-d2635a31b6d3", "comment": "Malware payload (Heodo)", "value": "50a4c49a9a7650b99255a502d17e8295559e4e85b316eb5d6e5e9b9cfd6d2a47", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647459139, "uuid": "0acfe50e-a1b7-451e-9819-281e3463cb58", "comment": "Malware payload (Heodo)", "value": "3c0ba501fd93362fbb52379a978790f41f54d7fb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647459139, "uuid": "a557fb74-2d9c-4325-b586-beab7b899ccf", "comment": "Malware payload (Heodo)", "value": "d4a21c547bb07085e5cc21c88f56294ec69c7d3d133b7836d2a5d04abaee873b8233ca4029bdf896deaba20360df603e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647459139, "uuid": "61074943-d816-4f1a-8b49-3b21a8d431d3", "value": "T100F4CF11B2D1C076C1BF06741916A35D63F6FD608BB9878B6FD02FAE3EB45828A34356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647459139, "uuid": "82aeb999-10b3-4f5c-8bf0-1b20b026a33e", "value": "66a21a1bcb4077b3ed89c00ee693486b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647459139, "uuid": "4893dd0c-989d-45c6-9693-be868c8511b1", "value": "12288:WZjb8BOPxue5dKV9M/98f0koPBXvkgKtuBdfMAofD:WCBAdKV9Xf0kS3KMBdkAofD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647459139, "uuid": "f7e6399a-8246-40fd-89c8-9ea8c9f9beb5", "value": 753664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647459139, "uuid": "cd43e448-459f-4d40-9860-8dfbd1282fdd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647459139, "uuid": "588ce4fc-b0c4-44df-b365-4f4cd4f20bd6", "value": "3c0457a58701e2b2f6b02d1d9b881d2d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ca6b056-a4fe-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647417319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417319, "uuid": "ef52bb7a-f492-4d66-bb0d-5105c1615310", "comment": "Malware payload (Heodo)", "value": "b5774fc999f9432923d43df873d3b194", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417319, "uuid": "8ea8e5e3-fd43-4ad1-a514-023743bdec0b", "comment": "Malware payload (Heodo)", "value": "50c295f41e54b227ab5c695fb0a6c25560371fd20f863c9caa22a68528a71eeb", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417319, "uuid": "5586ae28-0edd-4664-a580-6a0e990d926f", "comment": "Malware payload (Heodo)", "value": "2926b78d278b8b2fa71b95b73ba95aef7a8aa8df", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417319, "uuid": "e42953ee-00df-4a3b-824c-ebf8eb5f5832", "comment": "Malware payload (Heodo)", "value": "18f5741b2a463e61367e0a91b61901e424d0ac691993025fb985430ffc19ff34f655741624538c6b67d6e53b2d29723c", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417319, "uuid": "5a3216c8-b040-4e3c-9038-c303279405a3", "value": "T1AFE2D01DF3A0EE69C61DDC3944A841EA425A74258506EB4FB99CFF1D2F067C2270F19E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417319, "uuid": "75f0ab0f-e688-4683-af07-14e4f0354f33", "value": "768:8jf8WFhN7beEizXT2LxdFfPdkqstJVE6D:WEsTXrgXUndkq8E6D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647417319, "uuid": "fa59caf7-deab-4da6-a969-6b39f1e810e5", "value": 33737, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647417319, "uuid": "7c2c3616-b325-4ae0-bcbe-325366d9c546", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417319, "uuid": "37b89f51-5c46-4434-b1f6-f70f9136849c", "value": "payment.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5232697c-a549-11ec-9275-42010a9c0029", "comment": "Malware payload (ModiLoader)", "timestamp": 1647449487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647449487, "uuid": "2588ae27-053a-41b8-bce5-abfd95e3f17b", "comment": "Malware payload (ModiLoader)", "value": "27e080d6b7799c36bfb2eea52da66b22", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647449487, "uuid": "51448893-19a4-4f96-a756-a784f8e96610", "comment": "Malware payload (ModiLoader)", "value": "50db4ba14e8cad9f9c6039d104478a95b9364a9de83d8591a5d735bd026a24e2", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647449487, "uuid": "bab2cb4e-1700-4931-9c05-874a012a847d", "comment": "Malware payload (ModiLoader)", "value": "b500ed80ae8f67db81224e0e14def5b9b83a6996", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647449487, "uuid": "54007b71-8066-4fe0-8e82-c0cfed9eb9be", "comment": "Malware payload (ModiLoader)", "value": "1d95873f031a10ea66c336679be9da3a014206691f428970ac209d822066da132d5f301174278e7ea35a4b824ebf33cf", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647449487, "uuid": "2561e9d8-d9cf-436e-9a5d-f0ba73f58507", "value": "T110D4238EA774F389D8F26C6BF53761248456720DB63004CACCB5757222D7AF3B693069", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647449487, "uuid": "18332d8c-a037-48de-8b75-a722bd8662e2", "value": "12288:Szb/j0aBTuMiEzOcqjKZpUJvBCrI4PbejmX2B8n+AIPk+V:8b/j5BXp6ZYUJvBC5PbeuJ+bMa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647449487, "uuid": "6efe1e3f-e272-41a4-8ce1-dd16fc996aca", "value": 649682, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647449487, "uuid": "34bc66a9-1086-4a8f-ae02-67ab4cfc77c7", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647449487, "uuid": "6168d397-c3ee-4299-9355-7c1c676f4d73", "value": "Detailed Check Remittance Information from%0D%0A%09Henry Schein, Inc.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93be075f-a51c-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647430269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647430269, "uuid": "18e80d4c-70f7-4213-a0a1-44a0b538bd37", "comment": "Malware payload (Heodo)", "value": "8f68c066dd477d55cb1932558f32cd20", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647430269, "uuid": "57ca897f-f84e-42f7-8b91-56a3f9a467cc", "comment": "Malware payload (Heodo)", "value": "50e669dcf64dedaf5f6fa5663134b3c2a0261b5107bf292dbbac6c6650458439", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647430269, "uuid": "88770f70-d875-4b6d-af01-b74e3b17c165", "comment": "Malware payload (Heodo)", "value": "0f93bffab5c85112ba05444c75467880a40d41b4", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647430269, "uuid": "54eec971-0e2d-4d91-b812-216ab0629aa9", "comment": "Malware payload (Heodo)", "value": "588f20c3705f6ea9c06485edcbf2b4a1e3e76acbf0fc1d67be57d04abb15a13f69d6e9cd3de44344ad767ee31e6073f6", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647430269, "uuid": "f559549b-2ed2-4f5b-92c0-6ca308ebc8e0", "value": "T107E2C02DB370EB1DC21EEC3944A995DA825A74268106EB4E6C6CFB0D2F456C2730F1DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647430269, "uuid": "77910c65-4079-44c5-8453-3e8cb199a398", "value": "768:QjFH4QqFhN+DizXT2RdFfPdkqstJkjE6oB:qS7TkgXendkqJE62", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647430269, "uuid": "9f6bcc0a-3181-4444-b53e-02b374121ba0", "value": 33758, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647430269, "uuid": "cea3fad8-cc61-461e-92b6-ec785e2595aa", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647430269, "uuid": "9f46428d-058d-4142-9a7d-25e72435d46d", "value": "PACK_16032022.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de5ae22f-a52c-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647437266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647437266, "uuid": "ea09d39c-f97e-485e-b0e4-06787063c542", "comment": "Malware payload", "value": "f9296b4a33506cf586b538d56ebda2b3", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647437266, "uuid": "a3c84c5d-0303-4697-9a86-617dd854f6b0", "comment": "Malware payload", "value": "512a13880ba4026b1fcf37aafc877ead8b6bee768766d328e1206d6c8eb0eeb1", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647437266, "uuid": "fd3c39d1-5cc2-4cee-91bb-b7b99b9acc43", "comment": "Malware payload", "value": "bd61b99621d67516db0978843175707f251c4c3b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647437266, "uuid": "480be98c-ba6a-4501-8b1c-49c372bb1c2e", "comment": "Malware payload", "value": "ef05d0497a72384748b30cdffcd8911facf02825b4efcb326501b369e284ed73bedfd532a5543c16f3a7eb044ef1f984", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647437266, "uuid": "e7325f13-5a09-49eb-b50e-86dd14befcd7", "value": "T1CFF059C3E4D0A1A64643121A9B75805CEFB957DFF1D0861DFCCD42614F12BCA92832E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647437266, "uuid": "1354d7a6-c31d-4f7a-bf17-8d70d60254e8", "value": "12:TMHdICF4dEL2qm710yodSh8//umdJrHcrvn:2dzL2q2BzA/umXHcrv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647437266, "uuid": "d17751c4-b5d2-4112-ae9e-abc2eaf98897", "value": 581, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647437266, "uuid": "fdf6ecfe-58b3-4c54-955d-5713935e5b34", "value": "text/xml", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647437266, "uuid": "7ee07d94-c190-4d1f-a2b4-fd7577368b2d", "value": "IMG75666613674.jnlp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7c9c64e-a548-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647449308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647449308, "uuid": "d1d3146c-2dfb-49df-ae91-018d66646524", "comment": "Malware payload (Heodo)", "value": "eaa60fb53b4c809244f5f4a35d9130eb", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647449308, "uuid": "1d5f9ff5-9cce-4049-adfc-ca795dbf10a9", "comment": "Malware payload (Heodo)", "value": "513a64b04d07f8c94d862263168b1d4f62a94ccd29a23a5864b0c066e6fe440d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647449308, "uuid": "a4ff5843-1168-4e3e-8764-784aa5311afc", "comment": "Malware payload (Heodo)", "value": "114d20fd95cf3002c0f4dad796c6e03ecc7fb889", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647449308, "uuid": "5e4ea76b-35b5-4354-8e92-7c8b1e0a18a4", "comment": "Malware payload (Heodo)", "value": "c8d7e7cb9cd6aae0429970af86abbfa93535474495cf883ac0888f41f2e1a755806cec76bfd76d0e238bba41504b64b1", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647449308, "uuid": "5dd4c4d7-aceb-405c-a424-b4dc9e74b85a", "value": "T145F4CF11B2D1C076C1BF06741916A35D63F6FD608BB9878B6FD02FAE3EB45828A34356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647449308, "uuid": "d4613272-c764-4468-8ef0-5c708c6505c3", "value": "66a21a1bcb4077b3ed89c00ee693486b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647449308, "uuid": "e243841b-ab2d-40c6-8d89-e0700c42d89a", "value": "12288:WZjb8BOPxue5dKV9M/98f0koPdXvkgKtuBdfMAofD:WCBAdKV9Xf0k63KMBdkAofD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647449308, "uuid": "0370ca9e-821b-4387-91fe-8c48800c2055", "value": 753664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647449308, "uuid": "e72e1a22-3631-42df-bf49-aa307a1b39d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647449308, "uuid": "bad56ad0-e646-4555-9257-ae4da02afbf5", "value": "emotet_exe_e4_513a64b04d07f8c94d862263168b1d4f62a94ccd29a23a5864b0c066e6fe440d_2022-03-16__164822.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8865cf7a-a4bc-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647389019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647389019, "uuid": "73f8bbd3-de2b-4258-9464-79f2eec58cce", "comment": "Malware payload (Heodo)", "value": "65fd7c097ade045257573f13a402a54c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647389019, "uuid": "72078019-6677-4a49-b53a-0dd6f4d17229", "comment": "Malware payload (Heodo)", "value": "515ad6e26218143767437b1f51d091026a716916bf0e2451b797680a82783a21", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647389019, "uuid": "0fc51a92-f1c5-4464-94bf-a3ad737bcaee", "comment": "Malware payload (Heodo)", "value": "c086ae0ac68f1400d3e9e93c56f58df090f96b78", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647389019, "uuid": "0482a2a1-0e1d-41ca-b8d3-3cd370b2b30b", "comment": "Malware payload (Heodo)", "value": "d3d11f5a963d788f30878e1c9422c8da64145e06fb2ee4c3a08a13b8a51f91c3a12c8ada7f841dc64d51305b2a555d7a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647389019, "uuid": "159ad451-a6d5-43b3-b3a8-e4b8b3b7e6ba", "value": "T144E45B3071F74031C3AA1D3905D2DE64DAF5AD4B87B2F0D32F99AB4E99F5AC12B20616", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647389019, "uuid": "990139c2-8d51-4c3a-b297-ba981cb88ef5", "value": "a38617efee413c2d5919637769ddb6a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647389019, "uuid": "125292f8-8d85-4be5-9ce9-83bc1075335c", "value": "12288:E94YBCR2xP7guDo463OP4eNsiSOZjb2woE+MhJT:2kRAguDogP5ddb2woEBJT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647389019, "uuid": "1ef5bbb9-7b1b-4d29-b0e5-f7699c3573b5", "value": 684032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647389019, "uuid": "c98236e5-9a54-4980-b034-4579b8e14fcf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647389019, "uuid": "b84c3c09-855a-4d58-8708-3b54020a3330", "value": "emotet_exe_e5_515ad6e26218143767437b1f51d091026a716916bf0e2451b797680a82783a21_2022-03-16__000334.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f410af07-a533-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647440309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647440309, "uuid": "aa08aed6-1ff0-42e9-9bc8-6823d52cd3d3", "comment": "Malware payload (AgentTesla)", "value": "65143dff3771b9b126906932ebf35bba", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647440309, "uuid": "12e7d59a-2474-42c6-83ee-74affa9a7db2", "comment": "Malware payload (AgentTesla)", "value": "51d4d06407b684e4e0a28b8e29776fd00b83fd2835d2d9ec6dd70fbf90422991", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647440309, "uuid": "e97b7b70-22cf-4fa3-9050-33b9549558bc", "comment": "Malware payload (AgentTesla)", "value": "7edaacdf43ea270f278f40228d2f6e3d05cf4e56", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647440309, "uuid": "72e964d6-0d61-48ab-8696-b651d6385041", "comment": "Malware payload (AgentTesla)", "value": "6ee527a4d203e260ada6b3a6ab585d0a8279ab5828324b46a43b845c3afe3ad4b46b580ddf165d969f7bb3dfd049624d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647440309, "uuid": "8cbd9cc4-3841-4d03-ac60-f1021be5a7df", "value": "T1A6B402B0F195C8D6D861433468739D321EA76D6BB8B09E0F13563A786EB33E2450F617", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647440309, "uuid": "a61161f0-3e24-4721-b5bf-4d45f5351548", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647440309, "uuid": "93e609e9-f3ec-4edd-a7bb-ac67614b7bd7", "value": "6144:4bE/HU0eJtJxSm37amVw+UpSg360DKnudNChpD3CKeHLb7JCykLJoMbP9/WnSK:4bjj97Uf4m5dw3SrRk9oSPcn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647440309, "uuid": "fdae1251-1efb-4ff8-9eaa-3dbd15521178", "value": 504888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647440309, "uuid": "e1ae2c58-d12b-423e-b355-cd41b8e66de2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647440309, "uuid": "423f6c19-490d-479d-b679-6ab62c82a3fa", "value": "factura_011457.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49a65fd0-a4fe-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647417260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417260, "uuid": "78731150-a2b5-4bc3-b01e-c5759ae09932", "comment": "Malware payload (Heodo)", "value": "9b61de11ba7f23301061d470c3bc4ad0", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417260, "uuid": "ed69e9fc-8b9f-47c2-a76c-f936f2663c0b", "comment": "Malware payload (Heodo)", "value": "525c7f9b5fb96a4a1c04b9685b81516331dee41fa59bcd34854dd74dfb6476c3", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417260, "uuid": "d236d6a5-0775-4ec0-a5b9-1fce037fd52e", "comment": "Malware payload (Heodo)", "value": "5c84a296a33987d0827b17fe31cdc191cc204088", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417260, "uuid": "759f591e-7396-4799-b377-88822f32917a", "comment": "Malware payload (Heodo)", "value": "38d8ee9b0be10fc60a23b84aa7c26115d65829adef9a8a33a67a6ba668089f396a3259a528c91ab13399bdec1529dd94", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417260, "uuid": "91a578d7-8014-40f5-9cf0-cd173b9b9f34", "value": "T17EF2CF2DA3A0EF5ED61DED38849881EA421579154506EB4FA85CEB0D6F493C33B1F0DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417260, "uuid": "57bc655c-6ac2-4e47-b8e1-9b726da94255", "value": "768:cjFhNKbeXizXT2LxdFfPdkqstJ1goE6vS:cBTGeXgXUndkqegoE6vS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647417260, "uuid": "42bf6922-bdf5-482e-998b-633f041c4401", "value": 34391, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647417260, "uuid": "76b81b08-4a54-48ac-b6d1-b86c936b4a43", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417260, "uuid": "45c47dfd-1d0f-4b3a-8eac-ee01cfc75032", "value": "YMN-010322XVGBC-160322.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7878391-a4ea-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647408881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647408881, "uuid": "40fa8faf-bfef-4f19-a421-ce1f43d92f0d", "comment": "Malware payload", "value": "aa41c841b00de9c23b0f0ddf313c6b2a", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647408881, "uuid": "a14df38e-86ce-4dbd-9b02-4518c60b2b92", "comment": "Malware payload", "value": "529061ae6657bd2c9ad74bae03d7b9ce0222eb9c810b69dbd0bfeb64e1271850", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647408881, "uuid": "d5b3f3d6-15b7-4784-939d-975c7d4e43b2", "comment": "Malware payload", "value": "46aaa6bd0e2c7c4d5a7d74c7bbaacaaffc822f4e", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647408881, "uuid": "0fa973fd-cde3-4025-8bc6-d57dd77ee05f", "comment": "Malware payload", "value": "3d85d6172f2bfe6f74e57694389225a7ff404198e0e2e819fb863c0791a7474dfca56178426deee81e18e636667df9cf", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647408881, "uuid": "2fae98f2-32bd-4549-980d-f27fec5579c7", "value": "T15E1401473D85DD0CF8519E781740925DCB40AF9A6A89E2CF250C776B23B2B7628B63B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647408881, "uuid": "944d095e-76e2-4df7-9883-10d68c3b5a86", "value": "3072:NQn/B4K5VxmVREp9bNuHm2psz3OeaqjT3RUGveijlcUX0C7k5c0UftyHKnFw1IgL:qn/l5VxUEpH2aikNUGDWM0C7km0+tOK6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647408881, "uuid": "41fc8d2c-5653-410f-af92-bb32185c7f9c", "value": 191032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647408881, "uuid": "38e9e79f-d0d7-48b7-b13d-62a5a9922852", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647408881, "uuid": "68d3d53d-ded8-42a0-a2a7-bfac8b6f6039", "value": "NPO19269453001.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10f4931c-a4fc-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647416306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416306, "uuid": "3ab663ed-72c2-4b8b-a3b7-374095ebf939", "comment": "Malware payload (Mirai)", "value": "8482b9dee8df904bed79637d5357fdc9", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416306, "uuid": "d3ce4a8c-3427-449e-9b48-26fb8f39cc89", "comment": "Malware payload (Mirai)", "value": "5466474994ea1cb2357248e15a925b717f0cf34bc570379090bf1bbc6be74808", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416306, "uuid": "c999d829-faf3-4f6f-9d70-ee7c822767b3", "comment": "Malware payload (Mirai)", "value": "28ec45a9dfa9be15b3640fce1f940a807a4760f2", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416306, "uuid": "023bebdc-c73a-4712-b0ef-f076c7e41515", "comment": "Malware payload (Mirai)", "value": "e891f9cacd65a5b69f1cc7ddbe9d75524b3e4fb2721ed8b4408f371d93cbf449de7ed1ed5d273ed650d74674d33666fc", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416306, "uuid": "c038dd02-69a6-4d21-8013-1326a130214d", "value": "T1DB63F746F8828B26C5C613BEF92D118D372353E8E3DEB2239E106B6077C646B0F66D55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416306, "uuid": "ab6decfd-f1af-4c6f-a36f-ef03db79f737", "value": "1536:H0nDSvcYkZbUNS6Q8fKb1duEltX+RZoZk9v0zAIyi+wcauE:TvBkGNxQ6Kb/jTmYkZwcauE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647416306, "uuid": "14d190d7-cb80-4f2b-bb46-bf8099698680", "value": 71108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647416306, "uuid": "ad98e603-0831-4ea4-ab53-f9d7e9aced9b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416306, "uuid": "6781f482-e7a3-4d59-a948-4f3ba112b812", "value": "mirai.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ae730b4-a556-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647455165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647455165, "uuid": "61de6888-8a83-40ea-a150-c262ade46f09", "comment": "Malware payload (Heodo)", "value": "228c35b517abcf496b08929ad6bd3030", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647455165, "uuid": "b0ab4188-2c7b-4ab3-aab4-ac17721b6a34", "comment": "Malware payload (Heodo)", "value": "54b59a962530c84042f180ffb5406978bae015100fc79974311595ea6c919151", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647455165, "uuid": "de7fed6c-9de4-4041-97d2-e66e0e73bcff", "comment": "Malware payload (Heodo)", "value": "5584aa99678a35b55840d0065cdb0b3afd9037c9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647455165, "uuid": "6153119c-8033-44f8-b69f-03bed2d8e18f", "comment": "Malware payload (Heodo)", "value": "5232bee875b682e8ccde59d39359fcf846f39339fda4e7240af7b6682110167ddccfac2d0b3e6c85117c9838fb0e4ea6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647455165, "uuid": "3397855f-c4b9-4a61-9c3e-d2bc663bfe11", "value": "T16BF4CF11B2D1C076C1BF06741916A35D63F6FD608BB9878B6FD02FAE3EB45828A34356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647455165, "uuid": "3660bae8-af33-4c80-aa33-9066971ffbb5", "value": "66a21a1bcb4077b3ed89c00ee693486b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647455165, "uuid": "adbace4f-ca74-4ff4-be25-beb382c42d56", "value": "12288:WZjb8BOPxue5dKV9M/98f0koP/XvkgKtuBdfMAofD:WCBAdKV9Xf0k43KMBdkAofD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647455165, "uuid": "9b069bcb-c973-459a-9526-2f0a8e8eeabe", "value": 753664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647455165, "uuid": "00c8deba-4107-436d-969c-585ee67af52f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647455165, "uuid": "aa473886-b6a9-4031-a289-b5895a465c5b", "value": "228c35b517abcf496b08929ad6bd3030", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11d1bb5d-a54a-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647449808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647449808, "uuid": "20722c3b-3c8d-4208-9bb5-e156e30fdd85", "comment": "Malware payload (AgentTesla)", "value": "8d14f4a78de99da834a925447dd79244", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647449808, "uuid": "49d2e3f5-fdf1-476c-910a-fd5b37adbd11", "comment": "Malware payload (AgentTesla)", "value": "55060421fa60f4e01fb8eb1a69dbb529ea66248a3cefdb378446ed951e385556", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647449808, "uuid": "ead57eba-f192-4e84-889e-0ab687b31c21", "comment": "Malware payload (AgentTesla)", "value": "dd04bfcf3fa208be50483cec3c8b1251b0282c8f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647449808, "uuid": "d77d28e6-2fee-46b8-a4c9-f0cf18926eee", "comment": "Malware payload (AgentTesla)", "value": "554eb2c16e3085d08a9ab046eeabbd16bb1c8dd8767697b030f057d8f977cf8b81763a74cdf15dede31bcd1692a63b50", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647449808, "uuid": "d49ddd48-177e-47b7-961e-b5d6a7058d8a", "value": "T16664F9517A4442E7EDB889322311F1700E233CBFC77CA95574D83B1B2A7968EDA25FA4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647449808, "uuid": "432d3fe6-51b8-4aaa-8aba-0e4ffa5395af", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647449808, "uuid": "bc4131cc-4557-4468-af97-d778e7d3c258", "value": "6144:soweBlC8+lEvKlJfF05Ibmu9EgeIKxAtW6:silC8+lEvKlJfF05Ibmu9EgeIKxAtW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647449808, "uuid": "b2665f63-9382-4916-839e-30781c43b961", "value": 306688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647449808, "uuid": "3a8bf22b-29bc-4bfa-acfe-83f58cb471fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647449808, "uuid": "9f87f047-8e01-4c46-aff2-d84d51c6f199", "value": "JCR 424472,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2683e8f2-a50b-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1647422785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647422785, "uuid": "6baef2a3-eae1-4b61-adc6-31735e9d8797", "comment": "Malware payload (Loki)", "value": "52288352e9b4b1a964a5e283108d0571", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647422785, "uuid": "a9b9c55c-5ed9-4554-9c59-45b9ac45cbe7", "comment": "Malware payload (Loki)", "value": "556bb94b646f84b443d319e3cdad138b6a760cbedb0e329976c283ebe2b5219a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647422785, "uuid": "539979ae-941e-49e5-9c51-70639b5a9957", "comment": "Malware payload (Loki)", "value": "9e457154a093f53400e2536a7e41c287cdeca39a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647422785, "uuid": "3ed7e746-8d7f-4104-a314-d7e69baa040c", "comment": "Malware payload (Loki)", "value": "dfb2ba9677d19a3230261348c8d1e2266f4c1c908717bf241a491164ab10572c07aaa5ad648255181f365a52a75e33a2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647422785, "uuid": "07a1cf52-c067-4ade-9be3-2d756ae6b840", "value": "T1FD54220FB190A8F3D7921AF541F37CB7D7B98385DA592C0FABA25F3B25592630606212", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647422785, "uuid": "188664bb-4e3e-4669-9622-04e753e71a06", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647422785, "uuid": "1b975042-5934-4f85-ae15-8f5b2c083de0", "value": "6144:rGiPXph3A1rbQx/p4iecq7Y/O2I5+eNnWqJ4DAJduA:D5h3OM/pccnOpgeRWqJ4MduA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647422785, "uuid": "2ed5c423-0b0c-496e-9c20-961c196a73be", "value": 301280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647422785, "uuid": "dc28571e-3087-43ef-8267-0ced260ba32e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647422785, "uuid": "8d40161e-4d47-440f-8159-90937692f198", "value": "52288352e9b4b1a964a5e283108d0571.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cc0a8ad-a56b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647464080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647464080, "uuid": "aaa8479c-d619-48fe-8ee5-b919895e3714", "comment": "Malware payload (Heodo)", "value": "2b7725f31b343bcab13eea64785d7a38", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647464080, "uuid": "925fbe73-5837-4358-9b85-85339562c963", "comment": "Malware payload (Heodo)", "value": "558f7d1bfa6a53d335151acda6afb969bddb1cc9e2fff35181e322fdc2c98f10", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647464080, "uuid": "45d91a67-0332-4b54-adc3-74ed5c1423cd", "comment": "Malware payload (Heodo)", "value": "9d41c0ff9959cf03e88eb0495a43d58a5bda4f5c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647464080, "uuid": "e3abd774-6754-4e50-a5c0-7c8868f16d86", "comment": "Malware payload (Heodo)", "value": "919fed6d37d53a4e8288fe4dd2a452226699e44db39a735f50b903d503d0d2a35d16374b0cdd0c1cfa6396d6579fc16d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647464080, "uuid": "fc4cc0ff-ee90-45b1-a4aa-a2fc0e391237", "value": "T10BF4CF11B2D1C076C1BF06741916A35D63F6FD608BB9878B6FD02FAE3EB45828A34356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647464080, "uuid": "b3c589de-a3df-4daa-b4a2-b745fe59feae", "value": "66a21a1bcb4077b3ed89c00ee693486b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647464080, "uuid": "f91f093e-16cd-4ef7-96ac-9e1f703d3858", "value": "12288:WZjb8BOPxue5dKV9M/98f0koPbXvkgKtuBdfMAofD:WCBAdKV9Xf0k03KMBdkAofD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647464080, "uuid": "afd853a2-85ab-43c3-940c-a4a3c30ef008", "value": 753664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647464080, "uuid": "47c1e199-f974-4350-aca5-dbf7a8f6c933", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647464080, "uuid": "0848dcf5-2cb6-4871-bad7-140b8fb7afb1", "value": "2b7725f31b343bcab13eea64785d7a38", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d2e8f68-a4fc-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1647416461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416461, "uuid": "ad02225f-8b2f-427c-8d3e-379fc374a7d2", "comment": "Malware payload (SnakeKeylogger)", "value": "178fbe492c301defb773d987ad676bf3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416461, "uuid": "eeba287c-deb5-4f9a-bc7e-44882599ee43", "comment": "Malware payload (SnakeKeylogger)", "value": "55b39536a130196a04126ed0f0eb9913a4b5ef7e474baeb4c6fb4087d8534b0e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416461, "uuid": "654536b5-c17f-4ccf-9c42-0620d05090f4", "comment": "Malware payload (SnakeKeylogger)", "value": "14956fad102506faadb25f00bba0d4f515c5b6d5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416461, "uuid": "22757308-faff-478e-88b9-3f0ca78d9c15", "comment": "Malware payload (SnakeKeylogger)", "value": "87b8b689795c3b01456bfd64110181dfbb74d8d3be6cfd0504bd782642290afd24110ff04bcbed0cedf76c59945b3ad0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416461, "uuid": "b581610d-5a5d-4db4-940f-0e8cf1c1545c", "value": "T180F4BFF0EE1C87BEDC14723BC4A848700EB55A9D7820BF5AA25D01DD495BECF49A742E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416461, "uuid": "df492f42-f31c-4602-93a1-159b9d28e655", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416461, "uuid": "6bb05e69-4143-4003-8f7e-f9c95a44924d", "value": "12288:1G18S/xFx+S8D0l6th62AgABKD0Yl2ShiP/gmDRURlhRe9tLh:wxKG62TgABKD0KOg0wrAX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647416461, "uuid": "bd702247-e630-45b4-a4c7-9ff076f15c26", "value": 775168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647416461, "uuid": "b6b581e7-51b6-4b4e-b1fb-13c46482817a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416461, "uuid": "cb360633-7d22-4426-b404-0b0dd44930f7", "value": "178fbe492c301defb773d987ad676bf3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ef57d50-a56b-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647464084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647464084, "uuid": "929dedf9-07de-4582-938a-8f8098eb46a6", "comment": "Malware payload", "value": "6deeac04f6bf124b003dbfc6e07970e6", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647464084, "uuid": "ac5ffda3-6b58-4125-a5b5-8fc472fe7443", "comment": "Malware payload", "value": "562e1ebb02c748ddb6bf9d548cfff81901178b7b36dda82f6d08d5ed48f4e689", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647464084, "uuid": "d7066223-d204-4efc-a917-784d46e05259", "comment": "Malware payload", "value": "53ec3c8cff34e3f5d678e831cbadb0fea2401cae", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647464084, "uuid": "400cec55-8de7-4c82-8e3f-6aef40648bc3", "comment": "Malware payload", "value": "23cb9fbe59ca9df14e024277f35d94e84a6edd0d626a86698d32b5a49aca6318fed8ccfe2e623260e677037efa8d52c7", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647464084, "uuid": "dfe55426-c9d2-455a-bf1d-de2496941d16", "value": "T16DD38C52BEE640B6CAE371714A49225EB3F5C7408B356FD367E21C186E3C5D3963C28A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647464084, "uuid": "07932bb1-1be9-4f19-ab0e-45682e7ec883", "value": "3072:RILUXM6Fwk1aXqhxudc3L01zo0TAW+ImdB44bnf1jsd2PXVjPwSQ7jFQG3jAJi:g6FVcu+sW+Iz4TXVjPwSQ9ai", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647464084, "uuid": "49a9db41-10ba-4fb1-be44-6afbe6b7fecc", "value": 130545, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647464084, "uuid": "59a337ca-1aed-40c0-8da1-b239b7bd27d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647464084, "uuid": "7413343c-2981-44af-8eef-25d1957b32be", "value": "6deeac04f6bf124b003dbfc6e07970e6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "248fb457-a516-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647427506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647427506, "uuid": "e39028f4-fe01-49b4-8350-40d0772b6305", "comment": "Malware payload (Heodo)", "value": "b2ee9c416502d72f1637a068ebc0645b", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647427506, "uuid": "6e28a7cc-803b-4c3a-866d-f4720617c76f", "comment": "Malware payload (Heodo)", "value": "567b94271dac5f033ac5af6d12a95b921dcebac730ab5fa067c84869a0abf1a3", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647427506, "uuid": "c4d688bf-2734-479d-adb4-da78b1a68f37", "comment": "Malware payload (Heodo)", "value": "16145ff227574b85489034f4370ab8e19c831236", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647427506, "uuid": "035ec348-989a-425e-87d5-898761b93383", "comment": "Malware payload (Heodo)", "value": "97f8c2daf38fed7f99dc164a345059aacb37e91ce20533787bcd18d0da2d91dea72ca3b37ec49fd6a8b77e1c2b921dff", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647427506, "uuid": "2a28c317-d585-4c76-8ce0-a86246130fba", "value": "T154E2C02DF2A0EE1DC21EE939446895DA421DB4558502EB4FB95CFB1D2F0A5C23B1F0DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647427506, "uuid": "a8477348-5f8a-47ab-aedb-3d665a920f07", "value": "384:sjzZPFhNjqEBOA7iEibbwBLg0SCdiVXUKgUrNU/qWhZOdBNPJM+kqr9eCgh0k5lY:sjpFhNNlizXT28dFfPdkqstJmE6/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647427506, "uuid": "592ac2a3-d804-498f-9e6a-c58b6d5b3e20", "value": 33750, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647427506, "uuid": "567e9c70-dc0e-4047-b15e-c41d6e70f65e", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647427506, "uuid": "fdf502e5-2295-45fb-9039-a39bc2e2eef7", "value": "Fattura N 0000730-19 QMF 16-03-2022.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5401369a-a518-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647428444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647428444, "uuid": "89c1bfa9-2bdc-4312-9915-33dcc0e90482", "comment": "Malware payload (Heodo)", "value": "2fbc93efd11cc7d5f912397b8017ed0d", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647428444, "uuid": "aed8ac04-15f0-4af0-bdf3-cf9fcc1ea14e", "comment": "Malware payload (Heodo)", "value": "569e5fbdea85c5c32b0a3a616c6c8df180afafd07d1b88fbb760ead2cc155ade", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647428444, "uuid": "191cbc8f-7cac-45be-9442-237df28240d0", "comment": "Malware payload (Heodo)", "value": "d9d445666d8e41632fc552eb78f8acc1d92eb78f", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647428444, "uuid": "a212d381-f214-4312-b917-b775f48dd087", "comment": "Malware payload (Heodo)", "value": "0bf128b7474df8a4bd341e6bc4ddf86cdd9e5af76b156469b39b4b84ee9cfa1d89603c88030358fc8046953997028113", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647428444, "uuid": "38abf2b3-2399-41dd-bcb6-2e0fc95a8154", "value": "T1DBF2CF2DA3A0EF5ED61DED38849881EA421579154506EB4FA85CEB0D6F493C33B1F0DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647428444, "uuid": "4f10f059-f6fb-4490-b2bf-e23ee1be5b2f", "value": "768:ojFhNKbeXizXT2LxdFfPdkqstJ1goE6vS:oBTGeXgXUndkqegoE6vS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647428444, "uuid": "e3cc8d78-17f1-4355-b635-92653b37bc54", "value": 34391, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647428444, "uuid": "5a6a949c-d74f-4130-94b7-d96f10f3e0a2", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647428444, "uuid": "1bf0604b-943b-478e-a3c1-a7a15e64302c", "value": "Rep_JTMK9IEHV7LZBP.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ea4ea5b-a528-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1647435415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647435415, "uuid": "2733e5fe-cfd4-4044-a091-622db7740470", "comment": "Malware payload (Loki)", "value": "85df0db74632697573e8c328dbd90124", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647435415, "uuid": "a5ba28db-aed2-4179-8f06-daf55926cdcb", "comment": "Malware payload (Loki)", "value": "56a7ab3623c369355e8624b5548d8b1642c6e834885d003ba16cd89a7a0854d5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647435415, "uuid": "00eac65e-fe13-4d8d-b2f5-ac0ed50cc9c2", "comment": "Malware payload (Loki)", "value": "270715851cba08ade1fff82852a54147a2d79e73", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647435415, "uuid": "02544459-0e1e-4be4-b8f7-14d9e478c1a5", "comment": "Malware payload (Loki)", "value": "9b53a234fa1eed40b6ecf906e0d7fe7c416052aa67bd7fe470f3e98d5b3868f10c7561eb9d43738103dd210e6026f3fb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647435415, "uuid": "8ea2b4b9-233a-451a-93d5-989c06db1487", "value": "T12364120B51E27577E1E006731AB1FAF6E7BF489092710757CF700EAD2E61083EE259A9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647435415, "uuid": "8e2ecb90-7ce2-4350-85cf-106304dcf437", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647435415, "uuid": "44ea75b2-334c-4ea1-80a3-2a3eb3ce5c82", "value": "6144:rGi4dqrwxtLCCSGv2NFm4iqYEJCpac3D5Ym5zqtTDPkst9bOKs1Mx7hO:j0xtLCCSGu2SYEgpTDm1dZNO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647435415, "uuid": "813726f4-c3be-46a2-96a2-047ddafa8dae", "value": 306644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647435415, "uuid": "63f269a8-c485-4894-8762-16a7e34744e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647435415, "uuid": "aa4a49c3-7645-4a88-af5f-8ef81ffa6db0", "value": "85df0db74632697573e8c328dbd90124", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c430d97b-a560-11ec-9275-42010a9c0029", "comment": "Malware payload (RemcosRAT)", "timestamp": 1647459556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647459556, "uuid": "97d8cf43-21d9-47d8-8b86-79e5b8766d95", "comment": "Malware payload (RemcosRAT)", "value": "4dc7ce061befe696cb85c51c2d9d28fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647459556, "uuid": "296efea5-fbaf-4419-9c47-b5e29d0f1e56", "comment": "Malware payload (RemcosRAT)", "value": "56ac1555cc21d3400c4168a52da00cab97bfb205f0b43ab417fbaa85e02def9c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647459556, "uuid": "a6b2772c-1fad-4704-be2c-3b5d3181be3c", "comment": "Malware payload (RemcosRAT)", "value": "19df0b11524d826b92b79bf8dfc90afa927190db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647459556, "uuid": "bf466952-a161-4d10-9f02-c6194fbf8bc5", "comment": "Malware payload (RemcosRAT)", "value": "59f5651e900956559dde3edcf8adec88e459074254876dcdf476b78dbb2b1bd463c20ebe8658c10654ffbcada9a8e48b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647459556, "uuid": "f5893e42-75a1-46c5-b65e-0a11793342d3", "value": "T14AF47DE2A3514936C1270E796C1F56BA583ABE10EE18AD86FBF42E087F7C3417A35153", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647459556, "uuid": "7912373a-30c6-4e59-b36a-c5c201b2874f", "value": "f2bdaf9594ad1018c72c522ae344bebc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647459556, "uuid": "7b74af83-db9b-4746-8cf3-d57687765d18", "value": "12288:9X2hBsMWINdoGVgS2/q5x5QOMTvRi2cuWpkzADKesNnqI6F3HAh:9GHeGoGVg7/qn5QTR9LvlZNnqTHAh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647459556, "uuid": "3f99f4e9-4525-41b5-bd97-2f0ef64b0818", "value": 780288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647459556, "uuid": "d33006d4-42a0-40b7-8437-a7727c1aad85", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647459556, "uuid": "486993ac-2ef6-4949-b109-9148ad0a835b", "value": "Attachment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bebbad38-a514-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647426905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647426905, "uuid": "cfce6613-a22c-4b36-94c1-82105d374507", "comment": "Malware payload (AgentTesla)", "value": "d28ae989b10315c368fb6e2ea109fa25", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647426905, "uuid": "b6490c09-7f51-446a-905c-8c304818b322", "comment": "Malware payload (AgentTesla)", "value": "579d0fb8384c0e6564569f26e751925e7e58106115d2231eeaf99fdd3c5cdf8a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647426905, "uuid": "a31d03bc-d61d-415e-9ad1-0ca210e7ab91", "comment": "Malware payload (AgentTesla)", "value": "137d61383c33ef0b122bbd21a3302bb8ae5e4058", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647426905, "uuid": "2becb056-70e0-4c2e-b4bd-4281c12802ee", "comment": "Malware payload (AgentTesla)", "value": "851a89f588c9e8ceb9021c4dce0c267eaca3076038664166df10b1cf460520f996ab21e2f4ffa206939047052fef1a13", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647426905, "uuid": "d2810745-e41d-422b-a2fb-aac5ae352c1a", "value": "T1CBF423034D81F67CC69BC28489DE72AE0A2DDF447404701E4FD7929EDE7EEAA5A1E017", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647426905, "uuid": "dd015ec5-f4d1-4ecb-a785-669479ae8cc5", "value": "12288:H4Hz5xWsGqxkmqnVHmhCYsF2KVQlXETKSPJ6eb9Dm5/HnqkkbuIYmjZtB0zmC:YHzuTpg4lVQtcX94/nqRuKji", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647426905, "uuid": "7cd4527a-3a5b-40ce-8c9b-7bdab73bca1c", "value": 744271, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647426905, "uuid": "51102490-d6b4-4462-a02e-39ee051c9814", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647426905, "uuid": "3c3a2dd4-e25a-4a23-8dad-3030d89bdc6b", "value": "NEW RFQ CS895.....zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec5d58d9-a50b-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647423117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647423117, "uuid": "b9889184-8010-468f-998e-83a2d4aa7c6d", "comment": "Malware payload (Mirai)", "value": "67977cc523beb41c8dd04e837a09afee", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647423117, "uuid": "9ce0e7b4-bed9-42f6-b7af-c493393180af", "comment": "Malware payload (Mirai)", "value": "57b8880e83ffc0fbe621d770f8a99012ddc152deb38be6f7f897d2a3bf9ce99e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647423117, "uuid": "dbbb4ad3-c4bb-4cbf-9a8a-c1323c21aa08", "comment": "Malware payload (Mirai)", "value": "896653dd628c5e8b4d272bc74931f5498965f563", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647423117, "uuid": "864f3416-1882-42e5-b52f-69247b5c8124", "comment": "Malware payload (Mirai)", "value": "10467e4a3289526ab9b60cb8d14767fd0f4818ce373cab5e304cbd2a785803e0eb836652e13c2599c061c8beb6f2d45f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647423117, "uuid": "db51b4a7-d77b-4575-b935-e5e4a03b4b66", "value": "T192C2D08ED4F66A47CE9C9CBDC1983311494870D1716F3B8D93A24F85BE9914B740B4B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647423117, "uuid": "43d68048-eeb1-45be-85e1-59cfb3076056", "value": "384:yJutnW04oiap6xG08u2s57xRBNR89v4i+xdfZxBenD01ARWGVCzhMhHZl:y0o04ouI0b7PBCifheD06WM5l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647423117, "uuid": "275926f9-a112-4882-b33e-33d7e3b5bbaa", "value": 27612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647423117, "uuid": "6d1224d9-9a25-49b2-8e1d-083b93f4174f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647423117, "uuid": "1472544a-ce2d-4ede-9c7c-4466fd3ece6e", "value": "67977cc523beb41c8dd04e837a09afee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3421bc7-a57e-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647472386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647472386, "uuid": "6983c71a-4e0a-4d3c-9655-d7cb5a10805e", "comment": "Malware payload (Heodo)", "value": "383bf939b3a5877c8e2924325423759b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647472386, "uuid": "2f5d2116-b297-4cf1-8f73-b5476ddcbbf9", "comment": "Malware payload (Heodo)", "value": "581b6cbe68939f4af713c7a13c434760500b73d6dad54cf2c3894144196808be", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647472386, "uuid": "a61e7ba6-9783-47f3-9ad1-f1ffd05c7426", "comment": "Malware payload (Heodo)", "value": "6bf7218f83c4600770b083b433aa338878f24130", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647472386, "uuid": "db1db1c0-d5a9-465d-9905-d7d2dc145fca", "comment": "Malware payload (Heodo)", "value": "fc3ff6ab62af548bd3df46378f00e07548b5ffccfddbb189bf7453fbc365789b1d129ba8ea2b2972268771b37d34cd76", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647472386, "uuid": "11be78e6-add9-4e55-8e0f-9e896c8e7f1c", "value": "T165F4CF11B2D1C076C1BF06741916A35D63F6FD608BB9878B6FD02FAE3EB45828A34356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647472386, "uuid": "b947f499-79da-45a3-af09-8fd422571266", "value": "66a21a1bcb4077b3ed89c00ee693486b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647472386, "uuid": "bf8998b9-ed0b-4050-b7eb-ccfd63bca588", "value": "12288:WZjb8BOPxue5dKV9M/98f0koPyXvkgKtuBdfMAofD:WCBAdKV9Xf0kF3KMBdkAofD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647472386, "uuid": "974be4fb-17a8-4f2e-a99f-c72419cf7b14", "value": 753664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647472386, "uuid": "dd7f764f-daae-4e5a-aff3-67041a3ee575", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647472386, "uuid": "92f9ab1b-099a-41ff-9653-e75cd90b57d7", "value": "383bf939b3a5877c8e2924325423759b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7a97df5-a4ed-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1647410197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647410197, "uuid": "600366d6-1379-41fc-bf8f-e13c08dca930", "comment": "Malware payload (Loki)", "value": "0acea344ed7f1371a76d86841c9bb615", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647410197, "uuid": "5ebe32ea-0979-4d70-9ebb-58c741d94fd4", "comment": "Malware payload (Loki)", "value": "582266f9b30f294229fcb10ab4526ef8ffa2ace062274120e7a69eb652823f72", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647410197, "uuid": "449b1b98-e0e0-4ebb-934f-e280ad6b3fcc", "comment": "Malware payload (Loki)", "value": "6b240dc8de8682fdcfd6f9296794dc2b24531bb6", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647410197, "uuid": "77d96413-801f-47fd-93ce-2409fa858645", "comment": "Malware payload (Loki)", "value": "3d1c51c7fd7b02052ab3015ab6709c4a44821cace035497e09b9e4e1ba9baf9a5799c1c4533c167965bdfa7f4574f802", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647410197, "uuid": "f4c0495f-ecc8-4068-8133-b7210c8ae845", "value": "T1070401BA23EF7C1ED99168B871726C7D00AACE0BE9E21904E4D6F14E88315458A49FC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647410197, "uuid": "9c34c793-d5af-4464-96df-af092bd7b1e0", "value": "3072:kBK8nrSv/1sbNjPusoa9JtFNpZlDKTfX7Eus0j2I8jicmXnij3Wo0oMdj4m:0K8nra/GBPx1ZMjX7Eurj2Xcnfo9Md1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647410197, "uuid": "35cb6878-44dd-427c-aed1-f70ada99ea92", "value": 190248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647410197, "uuid": "17576f57-4916-4953-b19f-16558c41fdd1", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647410197, "uuid": "da7d5426-7011-46bc-b62c-baa754504e24", "value": "PI.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "942dc499-a528-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1647435424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647435424, "uuid": "1509a90f-a493-4ca5-9b14-5c1b1a99eba7", "comment": "Malware payload (Loki)", "value": "685b82fa200c8a4112a110764fb46376", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647435424, "uuid": "5a85de38-bc94-4373-9ff2-d890b43eb16a", "comment": "Malware payload (Loki)", "value": "58b4fce72542dc1cb95d7acfd72d5d2de81d54306719be628663d713bc5eb8e2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647435424, "uuid": "48c2fbe0-03d6-45fa-8ecb-6e5735a36108", "comment": "Malware payload (Loki)", "value": "e6e309c3e4ac7ac0e9ebd73e751dc8ac784be5ce", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647435424, "uuid": "1bd2d7bc-bd7a-4b39-8d0d-ba2678bce0c5", "comment": "Malware payload (Loki)", "value": "dd728c7ddc12f6d742321fbbb8c4a211dfe3801ee2e23e64762c228dbfbc5d1644179635aeffc04558bafb7207c90383", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647435424, "uuid": "a789e20f-0edb-48f3-b488-f059144d17c1", "value": "T11A642265AD91D377D9A2977612B2FBBAFB7AE0D604813F1313849F393C42242096B1D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647435424, "uuid": "a2a70144-6654-4ef6-9b5d-a689972aad25", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647435424, "uuid": "5352a4d4-6a05-49f8-8d0d-7b153f81c3e1", "value": "6144:rGiHdYohFkYNUSvag6tHVw9+Bwq1qXehMhrhBX51AqiF:DdYohFkZSvP6tHm9+BwKMz5Aqi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647435424, "uuid": "01c724c0-e6c4-4fdb-9333-25852d8c05bd", "value": 307913, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647435424, "uuid": "f7c520de-ad44-4b0b-b463-ced22933948e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647435424, "uuid": "01a2deb9-3a0d-4e27-bb8a-5e0267303e07", "value": "685b82fa200c8a4112a110764fb46376", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7d7dd32-a4fd-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647417096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417096, "uuid": "1d8119b6-6fbb-4e50-95e9-5d042f83c382", "comment": "Malware payload (Heodo)", "value": "812290d5d6a1aacc3b4dae3b2c946165", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417096, "uuid": "d00d05f8-d0b5-4699-8bd4-8c0b0ca4716b", "comment": "Malware payload (Heodo)", "value": "5b04d034241d60008ca8009126817a2d4bf30537906863565f988e6e4e9e70ff", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417096, "uuid": "c44ffe84-0b4d-4099-854e-d24734e254bc", "comment": "Malware payload (Heodo)", "value": "37642ce807a560a7a19bc75c14a26faa947cbc68", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417096, "uuid": "0a68d539-67f4-4d75-a51c-1204dd74259f", "comment": "Malware payload (Heodo)", "value": "8cb03c08f49fcee5e72a5d0a21ed00cce5a8a6cbdc2a3b856c2aa901f4df4ab746874506451f9787c5e4ad866e43bc7c", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417096, "uuid": "fdda9078-07eb-473a-a6fb-73332d480528", "value": "T1D7F2CF2DA3A0EF5ED61DED38849881EA421579154506EB4FA85CEB0D6F493C33B1F0DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417096, "uuid": "c99db42d-4424-44e9-84a8-58701f96697b", "value": "768:ojFhNKbeXizXT2LxdFfPdkqstJ1goE6vS:oBTGeXgXUndkqegoE6vS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647417096, "uuid": "744f03e0-f1df-4b85-a4e7-fad7041596dc", "value": 34391, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647417096, "uuid": "14a4477a-f664-4bba-9576-d7e0e31d2264", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417096, "uuid": "a97078aa-be9d-4608-ad11-1399f67137e6", "value": "100957051491691365.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91851138-a4fb-11ec-9275-42010a9c0029", "comment": "Malware payload (NetWire)", "timestamp": 1647416092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416092, "uuid": "fc2ce300-e336-4282-9d44-8139f5f835e7", "comment": "Malware payload (NetWire)", "value": "1e9e023fc03f45617946ad2ddb8a2d45", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416092, "uuid": "2fd1dca0-1170-41ba-aae4-b2b6bf0831ed", "comment": "Malware payload (NetWire)", "value": "5b3332c8ab54721c4b4771b748c9852b4fee0e77ca63915231e7473a827574a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416092, "uuid": "f1142052-0e50-45a2-b9d0-08391b48e39b", "comment": "Malware payload (NetWire)", "value": "0535b0ee07b87e795c94c18d6670ae3c5d646a01", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416092, "uuid": "694fe765-9db1-4f99-bef7-7ebb941f2cee", "comment": "Malware payload (NetWire)", "value": "c45f0d4c9bda0afd64a29fee580a3794d6f5bf116f1abb1ad9781bf88dc171eb1535c323a45ac294e477cb19752d129d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416092, "uuid": "8bc59d11-3fb8-4f2b-abcc-7b988e6e7429", "value": "T12655F1EC355079DFCC57CD3BCAB91C609A207876831BC103985729E99A5DADBCE10AE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416092, "uuid": "b68e34a6-7334-40b9-9d0c-de37156acfd0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416092, "uuid": "5f335dad-c37f-4abe-81e3-6652a7ab00fa", "value": "24576:B2laEuwOpzPV98TD8yvbJeyQEAX/JJ4r05tyfCf8f7w6D:Qlpufpz998TD8yzJUEe/JJ47E8f0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647416092, "uuid": "da69124e-025f-4859-b2bf-cf754a917180", "value": 1359360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647416092, "uuid": "ae97a572-a0cc-42dc-a173-076701372b45", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416092, "uuid": "061a78c9-93ed-4537-a142-9d6dd37852c0", "value": "PDF 2022-03-14 2022-03-15 GH.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e60a5ba-a4fd-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1647416731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416731, "uuid": "c2cc0c37-a794-412a-b752-eeefa2be5abb", "comment": "Malware payload (Loki)", "value": "444904ad57d7d9853a59bed596576d70", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416731, "uuid": "cf1e6e05-d8a9-4374-a128-7a4915f90602", "comment": "Malware payload (Loki)", "value": "5b5b9259fee973420b26740e52f5bba6f511883f172cd120908edc2268be4153", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416731, "uuid": "e4b0d74a-5a6a-4df5-9a8e-b066f7a186a8", "comment": "Malware payload (Loki)", "value": "64dff030545e9b1c4e0aaedd43a2329925ad217e", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416731, "uuid": "bf375c7b-05d5-4d29-a341-65dc9b4b051f", "comment": "Malware payload (Loki)", "value": "1414d6a61de20d52abb17eb19442f4a0a1f4b8f4719acb3e0081b31a1d146b85c5d1e45282af69e58b99055c28dbef17", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416731, "uuid": "cdebcb08-86fd-4848-b458-b95fcc02e369", "value": "T14F14020C22BF5798C3159D3BE9725284342E8D03B976D71C332BFE19663815979E3A2B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416731, "uuid": "f816d0a8-cfba-4d07-85d8-d2fd75b68c26", "value": "3072:wFTDjjrQhYR3AXiN34VefsTI7zpTOlhYa57wOz8kz4XnuoGEFypcouw1bCevqrLz:gVhAXiN3GjIpTOlhTZPz5z4XuorFhUVC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647416731, "uuid": "59420179-bad7-4911-bbd3-2e5e625379ea", "value": 191208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647416731, "uuid": "837bd3b5-33bc-4fe3-89b8-a8d6746ab2d2", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416731, "uuid": "eb2ce1a5-ff6e-41cb-8b3b-7d231378e2c7", "value": "MV IRAKLIS - AGENCY APPOINTMENT.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa2d02f0-a575-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647468666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647468666, "uuid": "33180279-1104-4d53-b7b7-f19aad11791d", "comment": "Malware payload (RedLineStealer)", "value": "4cf069be997dfededa0d39b70fc3e52f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647468666, "uuid": "5d80466f-9f70-4058-b819-c78dd83e9fcf", "comment": "Malware payload (RedLineStealer)", "value": "5b7b0c5236d7365c0c65ce32845469f0da901f775319b93a47df593925f54205", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647468666, "uuid": "82d2d6b1-9878-4a65-9226-f6c043134203", "comment": "Malware payload (RedLineStealer)", "value": "b93e592187847c47df3328c8182c64b02c052a7e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647468666, "uuid": "d1243aed-5660-46a0-b63e-c0fe8f78af49", "comment": "Malware payload (RedLineStealer)", "value": "1c81c06315c92178325a3a2db9f2270463e6aa65d2a936b35a423aeffe63aeecd0b9bf7a57a9e64724b3fda64d98e073", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647468666, "uuid": "070763a6-06a7-4ecd-aec7-532ba8aa8368", "value": "T1A955239F4144F78EC38ACA3A3394F216B4A88565ABC5D255C22F6BD348916DCF36D8F0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647468666, "uuid": "02128e85-ea42-4dd3-a765-24737e571571", "value": "445554923421947cbff896012e27345a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647468666, "uuid": "9987ed5c-3e1a-4007-b94f-73185dca6c62", "value": "24576:GlMJAhqnqEqtDGjLof49V5e8B9wNpb063QHlOiMkEaHNYK3aGnkdZHO:Gp8FaSvE49jW063QHl8NawW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647468666, "uuid": "4d36439c-2905-44be-88ef-9725a20b593b", "value": 1390080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647468666, "uuid": "8b0ca295-8211-4b5b-bd45-010ed650f66e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647468666, "uuid": "ff403d89-67a4-4e33-9f52-e91ce5a93132", "value": "4cf069be997dfededa0d39b70fc3e52f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab31b88c-a57e-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647472399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647472399, "uuid": "9440611d-a6dc-42c4-a6d4-7cae68a02d9c", "comment": "Malware payload (Heodo)", "value": "3e91b8bd8d2ffbca802245754d4f2c83", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647472399, "uuid": "f6029fcd-3d06-439e-a04e-34efa4c39d35", "comment": "Malware payload (Heodo)", "value": "5d26653880cfed6b9159b98470fcdcb2061d99c7ae59ef3f1dd18b4c3cc233b2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647472399, "uuid": "19fceeda-767d-49c1-ac47-cb970f770fa8", "comment": "Malware payload (Heodo)", "value": "b7d9f0f0cb124a3af0603f14d0426390fd67c7d2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647472399, "uuid": "0f430598-2490-4978-b5ca-3bd44cd0a5fa", "comment": "Malware payload (Heodo)", "value": "19884c9b3b2e529527b6b931e57c99bf0d0ac6b3511bf673d692f25a37dafbfa901bcc6c0d1161c8425e10fa2350e1ec", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647472399, "uuid": "a9a8cba6-e73a-480b-954e-99c192815e1b", "value": "T1B0F4CF11B2D1C076C1BF06741916A35D63F6FD608BB9878B6FD02FAE3EB45828A34356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647472399, "uuid": "075337b7-0615-4813-b8e3-cfd1bbc26109", "value": "66a21a1bcb4077b3ed89c00ee693486b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647472399, "uuid": "2eabd2c6-c3ec-497a-beb2-65870d6f3fbc", "value": "12288:WZjb8BOPxue5dKV9M/98f0koPIXvkgKtuBdfMAofD:WCBAdKV9Xf0kj3KMBdkAofD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647472399, "uuid": "98cc1801-7926-4bef-92fe-7bcc9c8dba84", "value": 753664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647472399, "uuid": "c540e372-4714-4b09-a62a-b71c17d4d164", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647472399, "uuid": "0f6250f6-9107-4b6b-89b8-aaffbaa10c6e", "value": "3e91b8bd8d2ffbca802245754d4f2c83", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a96aee92-a56a-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647463806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647463806, "uuid": "4211fdee-007a-4e33-93e5-697b0d5725de", "comment": "Malware payload (Mirai)", "value": "1ca13ca9fb2737a78d8a7b05d7eaf61a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647463806, "uuid": "ec6ecdd9-faae-40bd-bdf4-e7e18363e43a", "comment": "Malware payload (Mirai)", "value": "5de4f5a7d615ede269f0d3670d156411168d47f6f0595891ef25464fe1cb86ce", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647463806, "uuid": "5266886c-516d-4796-b486-05360a97c46e", "comment": "Malware payload (Mirai)", "value": "476253c22be237ab7746ae442652fc978c59bb4b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647463806, "uuid": "36f9b17c-fb9a-42a9-a452-49b2019755b1", "comment": "Malware payload (Mirai)", "value": "5faefd418300a8044fbe4de2a54e81418b2f8a6fe08dd2aba8d26e484dcae99de5297b941637f141318afc84e43cbd5e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647463806, "uuid": "550ff752-e5d4-4991-9bf6-31b2ef9e3a48", "value": "T1F5735BC4E1C3E8F5EC111938307AAB729E77F13E7139DE9BD399A1339941202E60625E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647463806, "uuid": "a038aa23-b54b-48e1-a36a-094e2c0fb161", "value": "1536:b/DYQYs1ZokODichno15UzOHIt09KfsH18ruUGDKVQSi:zDhzUkODichnqUzk40Y0V8qbGVs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647463806, "uuid": "1f50548f-45f6-413b-b4cb-bb56769aface", "value": 74640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647463806, "uuid": "dd4b6b1d-468e-41e1-8bb9-c0c7edb9a276", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647463806, "uuid": "01df1377-8252-46dc-9b30-2c7bc301284e", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75355929-a549-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647449545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647449545, "uuid": "407198d1-226f-42c3-976a-13cac46e6e11", "comment": "Malware payload (Heodo)", "value": "8ee54fc42e509040a428c3563c1c7656", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647449545, "uuid": "c72a323b-ade9-4f57-8769-752e9d37f314", "comment": "Malware payload (Heodo)", "value": "5df28b076f705a8de370942f9a1890bfaedc1710ada7d86de2ea9a88fe21e7ec", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647449545, "uuid": "d4abfa94-1382-4acc-8f08-2474d3a37cc9", "comment": "Malware payload (Heodo)", "value": "76408b4e0de7e3a9b4dee01e5f8dded3a1af14ee", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647449545, "uuid": "39365a24-9f9a-4f5e-b048-c1c7d6f2cdcd", "comment": "Malware payload (Heodo)", "value": "cf55c284ae67baad909af33ce0ad5abf92d15e1976cc37a58d57d0dc5dc27c94d624ce4916a9c6284ef6e24d1f1b46d3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647449545, "uuid": "e2377f6b-3350-4f50-a0b2-69ae05c12918", "value": "T136E47C12F461B2B9D04B04741F1723A86EEF5E518629CA13AFA8ED5E1F31251FC3FA16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647449545, "uuid": "843f227c-3d4e-4a1c-af94-8aa6b2669ef4", "value": "066d4e2c6288c042d958ddc93cfa07f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647449545, "uuid": "defee124-ca0f-4eab-952c-bbc67bcf3feb", "value": "12288:DtAanana8Meee0GBGu3qI+3DNJ3vE6v5e0xS332d7t5hT/hexLx:Kanana8qGBGuoNxE+xCM7o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647449545, "uuid": "376bd302-0f3f-4617-a0ba-98e31aa78bb7", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647449545, "uuid": "751f8ccd-0405-4c92-8414-b25aef9c996e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647449545, "uuid": "b78369c4-f33d-4a23-b62c-ae68e84a577d", "value": "8ee54fc42e509040a428c3563c1c7656", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "703f0218-a4ef-11ec-9275-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1647410882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647410882, "uuid": "b4e8a701-d197-4aa8-bdd8-2e7b1d5003dc", "comment": "Malware payload (Quakbot)", "value": "fe8806caa10220d36983b46438007f8d", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647410882, "uuid": "56911553-9025-42db-9b61-947415de0945", "comment": "Malware payload (Quakbot)", "value": "5f55854c07b785444edf8ecb70e508974c8e4c369528b528b91ccf889128bb82", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647410882, "uuid": "e3ff5c37-1db5-4f53-8e05-6d4e2eee240e", "comment": "Malware payload (Quakbot)", "value": "e2871a3f918b751e9413e94ea1e1a6273f0dfc53", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647410882, "uuid": "43aacfec-3227-467a-aa31-532b3b9531f7", "comment": "Malware payload (Quakbot)", "value": "3afc3ee8f812a5f92f4faa8a6935617caf17b4d8579fb7779f56a2c4620a9fe278ea19695127218aed5da4ad9272b3a6", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647410882, "uuid": "234fd1b7-6bd8-4a06-9d22-84457829d4bb", "value": "T14534E01616246171C2EDB978720B4DC296EF703FE906F9248B5207FA7F022FA8D5D1AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647410882, "uuid": "5c769a17-6b32-4dce-b994-0d11e6738efe", "value": "3072:2NtpvZ+51+mCVdcmF/9OZNCsRCbOI59VzmWBgXEnkZtPaq4LwTGPCXVL:2NtpvY1MzcmfO4bOe5d/OIwTHL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647410882, "uuid": "3c3cb0d6-baa8-483a-9bb9-389345145460", "value": 242208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647410882, "uuid": "4e3b7bae-27d0-4668-8e8f-c28423257e66", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647410882, "uuid": "5f740a19-af83-42bd-898c-b6bc0b6459e5", "value": "iad.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e39487ea-a4fe-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647417518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417518, "uuid": "5cc682c0-e257-43ba-9d95-3b7392409174", "comment": "Malware payload (Formbook)", "value": "74ff75428def775b6923837c23b0de18", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417518, "uuid": "3fec837d-ddc7-4f26-9bd9-24688f244d61", "comment": "Malware payload (Formbook)", "value": "5f633ef17fcbc3f2f34548cbf4af305f64873fefa7af6d3bcbde2b070b31f8a3", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417518, "uuid": "77f36f57-53a0-4db0-b1b2-a7c87b1c9f8c", "comment": "Malware payload (Formbook)", "value": "92ffa221871ac5e06f922fab78612cab719d1ea3", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417518, "uuid": "c6262930-07e9-44f9-8139-1665925ab8d6", "comment": "Malware payload (Formbook)", "value": "e0ce568a06f504219e40ee5edb301ad0be3d0ae777c8e1ab422e89b3b34e25fa0783d6f01304b8f82bd56f9158a578e3", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417518, "uuid": "1f0a55e2-2d59-4194-9788-7089e7e06ec1", "value": "T13AF4122433E8DF56EFFE8E3AF43115151732E35A74A2E36E5995A8FE1A93B54000039B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417518, "uuid": "aa075c4b-2485-4656-b471-496f6391bea7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417518, "uuid": "fe29ea95-8c2c-41b4-bff9-222adbf47675", "value": "12288:KOzZwOEKmHM9hkjCF84MoZ1VfF93jJk8fj52Iz1f0Rxnu+yz:KOzZwO5mggCFBFFFffxf0bLq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647417518, "uuid": "c91fe9c8-4c0a-450d-acdf-241be5a33b05", "value": 788992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647417518, "uuid": "52f613ee-cb05-4a27-9e68-422fdf1f407b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417518, "uuid": "e510a561-85e6-43f3-bc72-e539d6b387d3", "value": "DHL-ONHOLD-RECIEPT 7807431483.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59a5f61e-a518-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647428454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647428454, "uuid": "f8b70e0f-c74a-406b-8883-4d27817e9af7", "comment": "Malware payload (Heodo)", "value": "fa0fa3c7031068fd5fb8dfa014ebbd3f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647428454, "uuid": "8bf565b9-5c6f-4148-9470-dd7974fbe441", "comment": "Malware payload (Heodo)", "value": "601d3a0f72bbf8bfd70dc48763b95e04ec2d1643ff99e10dce45be05728979ed", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647428454, "uuid": "489fe49c-3064-4f7f-bda4-d377da74d0ed", "comment": "Malware payload (Heodo)", "value": "16cd34ae89358109feebde53279fc13aac1f7016", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647428454, "uuid": "52c63077-199a-4487-b249-61954c16b119", "comment": "Malware payload (Heodo)", "value": "df7dd88e6472d9f96803280cd45b22be81fd98f838942be6d5ce4ea651d4d00e4b25871772cf060cca5d3ef9b49e7318", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647428454, "uuid": "1c4a8f0a-ffc6-46ed-92c7-f33ac2b9942f", "value": "T15CE47C12F461B2B9D04B04741F1723A86EEF5E518629CA13AFA8ED5E1F31251FC3FA16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647428454, "uuid": "3658b162-892e-4d72-9d6d-e62710aa9758", "value": "066d4e2c6288c042d958ddc93cfa07f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647428454, "uuid": "85fa7142-5578-4bb8-b98b-b29800bd8ca5", "value": "12288:DtAanana8Meee0GBGu3qI+3DNJ3vE6v5e2xS332d7t5hT/hexLx:Kanana8qGBGuoNxEsxCM7o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647428454, "uuid": "82f95d65-a9d1-437e-888d-94c9d9abe42d", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647428454, "uuid": "a2654d04-1997-47bd-8c79-f78ef847896b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647428454, "uuid": "14112f9f-adf4-4901-8b42-b87966a1178b", "value": "rfs.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0adccced-a4fc-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647416296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416296, "uuid": "c8babe9a-49b0-4aa9-ac3a-c37243983616", "comment": "Malware payload (Mirai)", "value": "c81cf176ce3caa5391f0c412a7c615ab", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416296, "uuid": "26de4152-1a32-47bf-9084-09b66c8c254c", "comment": "Malware payload (Mirai)", "value": "60dc8d9a5d36bef2841c5928034c061c7a81966b63c2fcd247c62dd84bc36e34", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416296, "uuid": "3770f923-907c-4af0-8687-7e6c2a009d81", "comment": "Malware payload (Mirai)", "value": "526955567472b20c7b4c9d76e14ed476160ca48b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416296, "uuid": "ae132983-f74b-4699-959f-34085efd12c9", "comment": "Malware payload (Mirai)", "value": "1a9d3e8162f53065bd4dd6999db301ca786ba83ee9e217348bcac3b09b0e5f3cb37f009d78e678f0c1996db338e3d451", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416296, "uuid": "91fb1ee3-c545-4e46-8d6c-b133a7b3b392", "value": "T10D73A80E6E618FBCFB5A823487B78E20A65833D627E1D541E15DEA111EB034E741FF98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416296, "uuid": "a7338a4f-184a-4f45-ae54-6adc9b7b8cb9", "value": "1536:YZIJO4rSB6xWqzEIxCRIxuF9IJajZvGIyv:LPOB/qzE4xxuF9IgNvde", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647416296, "uuid": "9adecf6b-13ce-4463-82c3-53e606c2ae31", "value": 76612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647416296, "uuid": "8152d957-2ef4-4060-adb6-7e8dba7163cc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416296, "uuid": "243a2e35-0f06-431a-83bc-2fabfe905c5c", "value": "mirai.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08d6e036-a518-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647428318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647428318, "uuid": "12f7c23f-3bf8-4c45-ba31-de443d8bcdea", "comment": "Malware payload (Heodo)", "value": "7241a344d1d50a272c2417d0a2bb3ba0", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647428318, "uuid": "631ec750-48bc-4cfe-98a4-f8f1553eb72e", "comment": "Malware payload (Heodo)", "value": "611cb5977f1e02c572abf560f77f8e475f9ac9b3e0fd5128f1f0a569bcbb254b", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647428318, "uuid": "790db583-b286-4414-a1a2-b91e858da6ee", "comment": "Malware payload (Heodo)", "value": "914638b31738b8c98bd8db6bdc31c5c882b59804", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647428318, "uuid": "7b276b34-93da-4911-a2b0-f3f72216f039", "comment": "Malware payload (Heodo)", "value": "a55efbc4631defd2bb4b7343b9c73f13512b8323eabc8fb64505170a6539d7851aa643a4e987845feeee43596fcd18db", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647428318, "uuid": "f7a5fb35-2a23-4f28-8a72-1109a1b00554", "value": "T1F3F2CF2DA3A0EF5ED61DED38849881EA421579154506EB4FA85CEB0D6F493C33B1F0DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647428318, "uuid": "cc4c2b87-4a91-4778-a51f-c61dc19a89d8", "value": "768:cjFhNKbeXizXT2LxdFfPdkqstJ1goE6vS:cBTGeXgXUndkqegoE6vS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647428318, "uuid": "2ca782aa-041c-477f-8867-eb9981e43181", "value": 34391, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647428318, "uuid": "19b53356-c8f2-4fd7-b0f7-0cb4a0d4862a", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647428318, "uuid": "034408e7-18c8-4f06-add3-1759d310d3e6", "value": "54532265368968264.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70a824e1-a50c-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647423338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647423338, "uuid": "193c47e0-d2af-4079-9899-d3a7f64b78d9", "comment": "Malware payload (Heodo)", "value": "ff08fb9b2101219ffee7a3f8c0521dc2", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647423338, "uuid": "2828ee1a-deed-4903-9971-8a2a56cb78e7", "comment": "Malware payload (Heodo)", "value": "615c8294a6e299201a43afdae3cf10cfe26a5528090f6c1b52b74e32a7c420df", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647423338, "uuid": "6e11185e-e90e-4719-bf27-e9fd4b21147c", "comment": "Malware payload (Heodo)", "value": "a05dcbe25676f86386c824804625b98e79f287d7", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647423338, "uuid": "e7359e5d-1026-4301-87e2-82ea576bb3dc", "comment": "Malware payload (Heodo)", "value": "8d2e5cd1dd17c114f2fb2f5827abba7806ebe1155d1e1f15142d40714cda72863f8fe9ff932e88f475323ddb3f531f51", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647423338, "uuid": "07c215d6-289b-410d-8071-b2aaf8a0b5e2", "value": "T199E2C02DB370EB1DC21EEC3944A995DA825A74268106EB4E6C6CFB0D2F456C2730F1DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647423338, "uuid": "4f7513d7-1728-431e-890a-60db0ee6b092", "value": "768:AjFH4QqFhN+DizXT2RdFfPdkqstJkjE6oB:aS7TkgXendkqJE62", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647423338, "uuid": "7015bbce-676f-4429-873f-d266a8a61113", "value": 33758, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647423338, "uuid": "63b30e24-bfc7-4b7f-8bec-2e3624df4bfa", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647423338, "uuid": "b65acacc-6ab0-4097-81de-f0b5102c4728", "value": "doc_1603.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "877dd2b2-a4e8-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647407915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647407915, "uuid": "2bc40b83-4df1-446b-807c-70a810cd868b", "comment": "Malware payload (Heodo)", "value": "7fcd3025fc97e977071321a9e2cb6f34", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647407915, "uuid": "af430407-ebff-4aec-8852-9c503823f2c4", "comment": "Malware payload (Heodo)", "value": "61c0f7cd9ee01e7adb98dd9ea3168486d334d2412e2de841fe65fbe3e2260418", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647407915, "uuid": "5c6be6b1-a020-46ef-9d3b-95f059a0d174", "comment": "Malware payload (Heodo)", "value": "25de1394cc890781977548e1039a0e914b7a6295", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647407915, "uuid": "2de5ac30-2f6c-4a9d-9c46-76c05f19a3d8", "comment": "Malware payload (Heodo)", "value": "0e3e2a95df11962ded9e03c5dc6dd0f1de42bc0ffbc489f31a027a703b1e233f4529559ed3ab0c9a9e121a69a3eb5f18", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647407915, "uuid": "13744c41-b40d-43e8-9b03-e6250f261ac6", "value": "T194158E83BBD3C076D156233708485F7422EAABD9876381BB7EE0487D7634902B656F1E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647407915, "uuid": "11ce72bd-286e-42f3-9ba7-3088f16389d4", "value": "a75fbf174f418163882037d6ea99f755", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647407915, "uuid": "51a29914-ca4b-4e12-91e7-c309e18ebc08", "value": "12288:VVVbuS5TINcLD3JPm5d/Um8bBr8lokQQThKaNwgt66JJI3vUtG6y:VVlxVPmTJe36G6y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647407915, "uuid": "11ba0aa0-bb8e-4792-924b-61fb70a5620c", "value": 925696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647407915, "uuid": "c322d818-b3ea-431e-aabe-00e9dc00d312", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647407915, "uuid": "01972965-33af-4fbc-9e4f-ae6f7ae0dbb3", "value": "emotet_exe_e4_61c0f7cd9ee01e7adb98dd9ea3168486d334d2412e2de841fe65fbe3e2260418_2022-03-16__051829.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b9d6e42-a50d-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1647423840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647423840, "uuid": "d53cd35a-bb0e-46ae-8a73-f23ef8215cfd", "comment": "Malware payload (Loki)", "value": "d340b97b38286e2277375dac1faae77a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647423840, "uuid": "7dff316f-2acd-4b38-8fbd-792c5214fcd1", "comment": "Malware payload (Loki)", "value": "61e998d798b13588fe42f6057a1589b9b60730d36e532de75456a587bc05eb1b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647423840, "uuid": "38b0bd65-ebae-46ea-b1f6-4e9095cc6449", "comment": "Malware payload (Loki)", "value": "0f8bcf72d6c1c01a3bc3912d6e6451ca5a81bd75", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647423840, "uuid": "dd60be01-b639-4a07-ba6f-30b5a4eb2176", "comment": "Malware payload (Loki)", "value": "b9ba09a6efeb50027161fd209776e95f16fbb3c0903e9785fcdbb89dbb483f54134b6e00e6c261d4ca508736ed5e25f6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647423840, "uuid": "9a5deff7-6920-4fbe-b25e-a470450f7efa", "value": "T10954120511C1EE6BD4A1C6B60EF2FAF7F3F6D6450361A6532B084EBA2BD49C7C90D225", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647423840, "uuid": "b4e7f879-64f0-4a10-9f3c-66ccb8a575b2", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647423840, "uuid": "33d21af0-2a51-4462-bcc9-fe532fde4be9", "value": "6144:rGisyu5tfkyyeC5X4v/v2ymnGzbrh6ROlLckob:ofYNIvRmnGsuct", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647423840, "uuid": "b924edd1-148b-4f05-9978-7133141156f3", "value": 302644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647423840, "uuid": "e512254c-12d8-4317-8659-ed79bca4d2e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647423840, "uuid": "56a3934f-50d4-4fe7-864b-e4f7f922be06", "value": "d340b97b38286e2277375dac1faae77a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfebb57a-a55f-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647459147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647459147, "uuid": "b78be5ee-0bb7-41ac-b76b-0b7e4cb82d14", "comment": "Malware payload (Heodo)", "value": "9552278d59fb5401728c240e65bd9024", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647459147, "uuid": "d137fa81-6e13-4da2-9a90-16d7c1813daf", "comment": "Malware payload (Heodo)", "value": "61ef5f81e474bebdd0f1fbd1810cafc1523c48ea0f5b26371fcfb061ebd85362", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647459147, "uuid": "6bbeb661-cb3f-4b3e-97d5-0497555ee63b", "comment": "Malware payload (Heodo)", "value": "1818d3e3a23ee589bf53e3b9fb4a281454a2b501", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647459147, "uuid": "c513d2ea-34e0-403f-a3b1-21fc54cc0eb9", "comment": "Malware payload (Heodo)", "value": "490f16302dde322f328a009d52cbb88aba7e8f354d052e6a25830b305b8b41415617c69d3c3b1e440cd0f4272b4d5d93", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647459147, "uuid": "271693b0-ba0e-49f6-aee0-d91ea3a0195f", "value": "T197F4DF1176E1C076C1BF12304956A38D23FAFD509FB986976FD02A6E3EB41828E34767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647459147, "uuid": "f4fb9c11-d74f-4004-9a0b-0859ec4a2913", "value": "66a21a1bcb4077b3ed89c00ee693486b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647459147, "uuid": "0a76c542-7d84-439d-b096-2ca7728eba46", "value": "12288:g6O4TpP0XjxCCFJuf07j+Xk7h98rLneTfABCJoWRWwfpW:BeCCF88j+XY8OTYA7pW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647459147, "uuid": "e32d9e12-376d-43b2-bcff-7f3f08bd38ac", "value": 749568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647459147, "uuid": "cd3ea76a-1c98-40a5-9578-41c1c9a711ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647459147, "uuid": "dd351e61-4282-48a4-8cfd-46c82136df96", "value": "9552278d59fb5401728c240e65bd9024", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75cb1922-a547-11ec-9275-42010a9c0029", "comment": "Malware payload (NanoCore)", "timestamp": 1647448687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647448687, "uuid": "9cb5d0f7-eef4-4c64-89e2-26b94d683fda", "comment": "Malware payload (NanoCore)", "value": "f487beb669c4cccade11b095090478eb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647448687, "uuid": "a55e81df-0f03-4f0a-98e7-1308047c4bd3", "comment": "Malware payload (NanoCore)", "value": "62cb486b54247e61986157ccd85361327b06ed60fe384afc9c8738fee1588c8f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647448687, "uuid": "6de002ab-a8d2-47e0-8cc8-2ed2a1b36b91", "comment": "Malware payload (NanoCore)", "value": "3eae3f269286b92186b01e6d3c1d9d8d0ad7f281", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647448687, "uuid": "ced05fde-8c51-4438-987d-cbfb2002d006", "comment": "Malware payload (NanoCore)", "value": "2fa3c914840dd8b752e5ebe7c631a8468bb5b2cac9f0c81fb807d4557e9b96fe7193695435b6fbdc1234b4eeb7def5df", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647448687, "uuid": "5d17ad46-4c54-4a0f-a69f-6b269552ec91", "value": "T1C90501EA214D5B93EC65E3BC98BAA50543B2BCB59192E1099CC53CCB31B6FCD2425F07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647448687, "uuid": "df3befbf-5ec5-4b4d-8e17-ddc26de5d1a1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647448687, "uuid": "45d5503f-e921-4959-bdbd-6bbec80650de", "value": "12288:ZPIuwOEgNiFxfUx1h5x7pR8BXeQlDVFhWxs2vRWWNajMogd0PVlOXk:yuwOE2xtlpuBXxlDFWW2vRWW8P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647448687, "uuid": "72050461-7895-4b96-ac2a-6162f6098df1", "value": 816640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647448687, "uuid": "85f92aeb-5678-48c9-bd66-03683472f8b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647448687, "uuid": "96ed5755-38f2-4aaf-8df9-e567d92535fd", "value": "f487beb669c4cccade11b095090478eb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "783b3fa8-a4ff-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647417768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417768, "uuid": "f583aff8-d470-45f3-89f9-8dd0e17f9dc9", "comment": "Malware payload (Mirai)", "value": "53b1f49a73a2e05739e7eeca1ebcd5a0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417768, "uuid": "58fa5bfe-6ef7-46dd-b27d-c71ab4cc7caa", "comment": "Malware payload (Mirai)", "value": "62fc838a80736886c5d0df9a073214774e6c11ef73ad1c168a59d766034b3c81", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417768, "uuid": "a35a1fe9-cffe-4083-90cd-cd04389e4a54", "comment": "Malware payload (Mirai)", "value": "5419a45c0ef1985ccf184cbe745d9d54896fd76e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417768, "uuid": "3b582a46-005e-4ec9-9ce2-2d6bed8de546", "comment": "Malware payload (Mirai)", "value": "913b82ddad7f06443451a8d60c6b49b1d897bdb93bc9cdbf1e43ce95db045a8a83ca844ca68da4606d6d60147fa7ba51", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417768, "uuid": "cfebfcc2-0c0e-4f2b-b0a1-2bfd2136eb52", "value": "T1D5F2E076515409F7E45E8CF91AFE1B6213BE0FA7A8B768834811F4634E81590FC1A6CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417768, "uuid": "ee486f16-63d5-4b4a-84b3-a4f70a83f8de", "value": "768:OHL0U51CY9SzFLNIYnNoZFyiR78XzupREhpVEOQt/PybbNAllvxfrPeZJgGlzDpG:OrTLD96JNIz0S8XzG6hpaOQNPgNAtjei", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647417768, "uuid": "8a78b11a-5305-415e-af47-8b9d521c9c15", "value": 36400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647417768, "uuid": "6a325add-54ff-4c20-b1c0-6496892f9c98", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417768, "uuid": "7d863401-6439-4e4e-ad40-828950dc3a9e", "value": "53b1f49a73a2e05739e7eeca1ebcd5a0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "813af9eb-a51c-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647430238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647430238, "uuid": "36e44d78-5f9c-4509-b1c1-c9448c31b226", "comment": "Malware payload (Heodo)", "value": "3d483de834ff12823ba6f05c6ca711b0", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647430238, "uuid": "d657e792-efc5-42df-956d-ee663fdee996", "comment": "Malware payload (Heodo)", "value": "632078e320ecc0aeea0625fb9f8d809645ec1e9a08938e942abfd23e210805f7", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647430238, "uuid": "a408fcf2-8176-48bd-a80b-792deffee875", "comment": "Malware payload (Heodo)", "value": "296099a1152e31905c90640efdbfb5f66f4a3a0d", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647430238, "uuid": "4657631c-3957-4173-bac3-bfccb85f5924", "comment": "Malware payload (Heodo)", "value": "397731b704f8e2bb76eb32fa95ea68c626b26fd8a19a3e70978031eecb2b31ddd2643dc72baff6c826ee82313c65f8e9", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647430238, "uuid": "f1b8df52-167c-42ac-8422-b376d079eec4", "value": "T13AE2C02DB370EB1DC21EEC3944A995DA825A74268106EB4E6C6CFB0D2F456C2730F1DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647430238, "uuid": "9705cc54-fe87-4bca-ac4a-4b2c26762b45", "value": "768:8jFH4QqFhN+DizXT2RdFfPdkqstJkjE6oB:WS7TkgXendkqJE62", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647430238, "uuid": "485fd655-46b0-4e10-aac4-fedf2701de2a", "value": 33758, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647430238, "uuid": "98205080-51b2-4c4d-9239-83073f495b9a", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647430238, "uuid": "13b79686-bbbf-46e7-b65f-1a4c1a7f6f76", "value": "OwM_16032022.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a66409ec-a56b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647464231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647464231, "uuid": "c1d94a26-6c9e-4c4e-a13e-569cda7a939f", "comment": "Malware payload (Heodo)", "value": "71ed95904b81df3289c38afec756a69e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647464231, "uuid": "c990599e-9975-49fa-b5e2-da2c6782f719", "comment": "Malware payload (Heodo)", "value": "635a0d2cabb1bbfcbb7c98aee925e46c5225ef71c6e9250b30dcf69a69cc1606", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647464231, "uuid": "efad3573-b889-4db0-bbb7-f034626488b4", "comment": "Malware payload (Heodo)", "value": "3f8ce4adf152c45b641bfc27a2dd58afaf3a47a7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647464231, "uuid": "26398514-20d5-4c68-b8c9-70bee92b61e2", "comment": "Malware payload (Heodo)", "value": "c3dd918cefecd27481c21511132375132d25c7b735704cb340cec777b2c63190600713193f4893fbfc1ec63b3fdc223a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647464231, "uuid": "54e0e84f-355c-4315-a7b2-3cf04a12c90e", "value": "T164F4DF1176E1C076C1BF12304956A38D23FAFD509FB986976FD02A6E3EB41828E34767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647464231, "uuid": "21bf1be3-2b9b-4f4f-bf2d-efc50d251261", "value": "66a21a1bcb4077b3ed89c00ee693486b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647464231, "uuid": "727b087a-cff1-41f8-9f46-e2dfbed87ea3", "value": "12288:g6O4TpP0XjxCCFJuf07j+Xk7hi8rLneTfABCJoWRWwfpW:BeCCF88j+XX8OTYA7pW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647464231, "uuid": "14c5e89d-acfc-459c-a28d-e5844134bc4a", "value": 749568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647464231, "uuid": "26abd228-e0fa-4b47-8823-984ae47c6a60", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647464231, "uuid": "f2bce39d-dbf5-4c2c-93bc-74d26f4ff6e9", "value": "71ed95904b81df3289c38afec756a69e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e356ace-a500-11ec-9275-42010a9c0029", "comment": "Malware payload (CryptBot)", "timestamp": 1647418234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647418234, "uuid": "e7cbb622-049e-4d1b-80ac-b5aa8ece40b8", "comment": "Malware payload (CryptBot)", "value": "a71d02103179706bdb16d32c4a635d4c", "object_relation": "md5", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647418234, "uuid": "09a8e8e5-a9ee-4443-960f-3994b6088ad5", "comment": "Malware payload (CryptBot)", "value": "636409b4be606209facf48c0672621c8e32f846c36c4914ae43354a6138bc2cc", "object_relation": "sha256", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647418234, "uuid": "03027ed1-3513-47a1-9dab-2606b0e3195f", "comment": "Malware payload (CryptBot)", "value": "83f2683ad6b1bdbb17cab1fb6d23a49661c73250", "object_relation": "sha1", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647418234, "uuid": "cef396f1-2656-46bd-a1e9-961bfb52f6bf", "comment": "Malware payload (CryptBot)", "value": "86990f1ef9b886ef411e5867339994aee16c2b40f422e52ac778e06630a6557e0fac877d1fa015ef36cb4a1947100e2e", "object_relation": "sha3-384", "Tag": [ { "name": "CryptBot", "colour": "#EB0B67", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647418234, "uuid": "991d61db-8fdd-46ae-91a0-efb3e2a9d5f1", "value": "T125D533F60237947FF78234FA836EE4530171D2E4E711D2D82D3BE14A0125F8E2E69AA5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647418234, "uuid": "8d7a0606-83e9-4a40-95c9-822a91e570ba", "value": "6985c05c81106254b2fb2149ec38edcf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647418234, "uuid": "12decb08-4bf8-4949-bbc3-1651595bd0d2", "value": "49152:0xXqoT4Noplzi3OQUH0iSclcfrjWRW8Gj8hXeWQpgUq398zG7F7dWR:0xDZpxVNSc6fRMteB4N8oFdWR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647418234, "uuid": "5f1b532e-f61f-444a-9fd6-be370c5a5afb", "value": 2788864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647418234, "uuid": "8f1ebc66-3bb5-45cb-8074-70b1748c780a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647418234, "uuid": "d199581d-9bf6-45b0-9ee1-50a862af644d", "value": "a71d02103179706bdb16d32c4a635d4c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49557398-a572-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647467081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647467081, "uuid": "b5ce25f3-9ace-4fa3-afe3-b736e9d637aa", "comment": "Malware payload (Heodo)", "value": "6ee45454a8cc27baaa39adf5eea74575", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647467081, "uuid": "65d08393-67c9-4077-b1b9-c425563afc65", "comment": "Malware payload (Heodo)", "value": "6365ebb5bb59871142cfbca1d9b37c1aaea129447c446c3768188bf3b85d8f89", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647467081, "uuid": "3f662213-0b4e-4801-b54d-70189c85e96b", "comment": "Malware payload (Heodo)", "value": "f50f1be4a96acb5edac6c3fdf03c69c614cb2644", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647467081, "uuid": "034dd335-4c26-48a1-836a-58b0f8777ad2", "comment": "Malware payload (Heodo)", "value": "e7e0f156cde0329c2bf28dda31a894e24d04aa7769e7a0b0dbb7a6e34fd53d8d686e4732a073f29b24497a5529332032", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647467081, "uuid": "1d9bd8d6-0f14-44e8-857e-e317930e4ead", "value": "T173F4DF1176E1C076C1BF12304956A38D23FAFD509FB986976FD02A6E3EB41828E34767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647467081, "uuid": "80d72b7c-04a7-4387-8533-44bacd926715", "value": "66a21a1bcb4077b3ed89c00ee693486b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647467081, "uuid": "796ad59d-8de6-405d-ab6c-26ca5a7241ab", "value": "12288:g6O4TpP0XjxCCFJuf07j+Xk7hR8rLneTfABCJoWRWwfpW:BeCCF88j+X88OTYA7pW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647467081, "uuid": "2e41cd5e-fa11-4796-adad-1d1bfe99d217", "value": 749568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647467081, "uuid": "6bfab276-8f3d-412a-b903-0a5148a20399", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647467081, "uuid": "daef73e5-4a57-4b51-a790-ecdb72831a48", "value": "6ee45454a8cc27baaa39adf5eea74575", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97103d0e-a522-11ec-9275-42010a9c0029", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1647432852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647432852, "uuid": "f490fbd8-6dac-4b7c-9059-8b00a2260487", "comment": "Malware payload (ArkeiStealer)", "value": "527668ca00d78443ad1728fe95077605", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647432852, "uuid": "64862879-a8eb-40b9-a12c-11a2f562aa9e", "comment": "Malware payload (ArkeiStealer)", "value": "63f45a23af2ced7e5d9ed762aa706d25278a453bfcb0da2bd6f9ade2626acfec", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647432852, "uuid": "fa4a1cb7-7f9b-48d5-809d-0448c4cc1839", "comment": "Malware payload (ArkeiStealer)", "value": "151232c31b2d012cec6b1aad93d6fab834d63ddc", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647432852, "uuid": "172b31fc-1af0-4f7d-8d0a-e6851af14d3e", "comment": "Malware payload (ArkeiStealer)", "value": "01376afea1260fc085dc928cb81cf3ab529b346bbdc62f0dde5aa315f13ed9698043c3c9118d83e15e856cd2f6b25747", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647432852, "uuid": "c190cd08-4fd5-4ddb-be9e-258f5773e44b", "value": "T1F8B48A6B29A60F91D859503880DB4F9337AEBB1B5202D76B47A1F22F3FF67B48865401", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647432852, "uuid": "4245534b-fe27-4eb0-9afe-811a29aee34c", "value": "6144:B2UiUewDLHWtKxct3Gy+T4t3m7wKks0Tf9U9:gU1eYLHEGSoEKwKkTTf9U9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647432852, "uuid": "a3172e83-53c8-44ca-8ee7-bb5904c5222c", "value": 533219, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647432852, "uuid": "9cc66552-ebd4-41a8-9507-3b03159e7bca", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647432852, "uuid": "d9747250-077b-4e81-829b-ceed26504042", "value": "Appraisal Properties document information.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb8f064d-a573-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647467702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647467702, "uuid": "ec100344-f1e1-4280-9880-39a7496e16a3", "comment": "Malware payload (Heodo)", "value": "7d4be3af21a2ec40297e472a641a4fd3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647467702, "uuid": "ffb6e50e-cad6-4de1-a2e3-23382e3c6a67", "comment": "Malware payload (Heodo)", "value": "63ff24af968e0ce1e1b7d5f903cff531c18cc0ca46802045ab01c21db5a64587", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647467702, "uuid": "d721bc78-8c83-420b-a0db-590f8f07d5f3", "comment": "Malware payload (Heodo)", "value": "b57a300e5bda96e63552289656ea965d4e98f291", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647467702, "uuid": "1a9f6bce-b4fd-4d03-b93f-65fcfbf9590b", "comment": "Malware payload (Heodo)", "value": "55cd487f2c26b7b28ca4d3024689e031e9cb915810f76ed05a40c797d36af5be49a729fe97b4b66726cec6a85411f0b8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647467702, "uuid": "a87e2d5a-6001-45a9-ae00-2bff3a63c6d5", "value": "T13CF4DF1176E1C076C1BF12304956A38D23FAFD509FB986976FD02A6E3EB41828E34767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647467702, "uuid": "59f9aa49-137d-4cc7-b25c-5a1e21dfac9d", "value": "66a21a1bcb4077b3ed89c00ee693486b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647467702, "uuid": "858021f7-c77a-4e70-8e37-60a7507ca561", "value": "12288:g6O4TpP0XjxCCFJuf07j+Xk7hk8rLneTfABCJoWRWwfpW:BeCCF88j+Xl8OTYA7pW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647467702, "uuid": "cbd45b1a-9e71-48cb-9693-f16f6c79a89d", "value": 749568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647467702, "uuid": "e0ef5ee1-3a3f-4b1e-910c-2b2ddc19becf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647467702, "uuid": "ae301a4d-158e-4e52-91eb-cc00747af474", "value": "7d4be3af21a2ec40297e472a641a4fd3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9562c7a9-a510-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647425118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647425118, "uuid": "dbc94156-8eeb-4a9b-9414-cfd4d32521d1", "comment": "Malware payload (Heodo)", "value": "b720b11db2e21bf3cacb772ebc023373", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647425118, "uuid": "130a733e-a54e-402e-a0bd-86e447a6197b", "comment": "Malware payload (Heodo)", "value": "6546324bb03aebc6e3b3986ba0c6cd0e7e6ee8b7710b4e25a468aac01dc5d5f3", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647425118, "uuid": "4eb7719f-1c73-45d8-93fa-9451f4d9338c", "comment": "Malware payload (Heodo)", "value": "6a9d360bcfe1e1f59b4c0886f319526dac23792c", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647425118, "uuid": "a0793599-5f68-42c0-b6ef-38fca2c155ef", "comment": "Malware payload (Heodo)", "value": "08d9c9cef2cb18f955e146532db55fd9da52863866859ec90289a558b74e3f1e798e807a332730738c8cd4fcba7891ad", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647425118, "uuid": "a0355bdf-7ccc-4d57-aa08-1dbad99db379", "value": "T107E2C02DF2A0EE1DC21EE939446895DA421DB4558502EB4FB95CFB1D2F0A5C23B1F0DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647425118, "uuid": "1b63712c-76d4-4e30-b7c7-cfab28eb4793", "value": "384:QjzZPFhNjqEBOA7iEibbwBLg0SCdiVXUKgUrNU/qWhZOdBNPJM+kqr9eCgh0k5lY:QjpFhNNlizXT28dFfPdkqstJmE6/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647425118, "uuid": "10f30b69-1852-4084-ba4b-1fec9fb25747", "value": 33750, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647425118, "uuid": "dbfdd4b6-8a88-41e1-bba4-bc6768747f21", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647425118, "uuid": "0a69306a-7839-49ab-a5f9-89d949b75cbf", "value": "RechnungScan 2022.16.03_1028.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "924903e8-a4fb-11ec-9275-42010a9c0029", "comment": "Malware payload (GuLoader)", "timestamp": 1647416093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416093, "uuid": "9854e458-1434-4444-ab23-251b1a63efba", "comment": "Malware payload (GuLoader)", "value": "89c05249253529e94c381a100ccc5847", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416093, "uuid": "06d887a3-8e2d-4ab1-a02f-180ae64365c1", "comment": "Malware payload (GuLoader)", "value": "65513d201d84f45efcd45a1e8c97b60cbaeafb75fb0fd0006be72f8169e1dc4e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416093, "uuid": "7e5deea1-8e2e-42d8-b96b-e0f701e80e72", "comment": "Malware payload (GuLoader)", "value": "3820aa2c1e420b625aa997c9c555c3dc470e2a6b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416093, "uuid": "fea86998-35e1-4434-99fb-d72b73732188", "comment": "Malware payload (GuLoader)", "value": "09f47efde66165ea2f87fac3a8c179b745bfaa70866fa2359657d9dd5b19d7607237a37d7cdf66570cfdf5a0b69741a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416093, "uuid": "cd561e7b-23b2-41ee-b14d-31f838f77422", "value": "T1DAC423616A68E027D0E71A706F7A0EB55AA8FD24F064063B5F927B173CB31437C18B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416093, "uuid": "412649f2-61fb-4f4d-9a32-1bb0ffacda29", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416093, "uuid": "ff548a15-29b6-4ada-b46f-f7bf9de81218", "value": "12288:mYJ5ElpHu5pvumEDtRamyhbkBtPIeSHScP+RE5595IHF7baLLDIxnEh:mYJ5aZunvxUtRjyhyRtcc8H6aM1m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647416093, "uuid": "9a1a8540-cdef-4065-8168-0415f310a563", "value": 596064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647416093, "uuid": "a751f285-3250-4954-b04c-3a538c7ac385", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416093, "uuid": "f6593fcb-9db9-455a-9cce-3a64f47e050d", "value": "PDF P.O. # 348790563678101-Alazzaz.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d3693fa-a532-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647439627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647439627, "uuid": "c056eaac-bda1-41d7-b76f-8d51da928103", "comment": "Malware payload (Mirai)", "value": "7375988de20075cf4704751353a9c46b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647439627, "uuid": "93357cdf-7721-44b8-a4b0-bebe7e9e6197", "comment": "Malware payload (Mirai)", "value": "6584e4f55b083b37d36dadca2383879ea668f08246a2b528d1bc02335055ad5b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647439627, "uuid": "0ea8709d-3970-41b0-b1cc-1cf63d3cea9f", "comment": "Malware payload (Mirai)", "value": "0a5fbe8e904df4384024f25e7dfc8f045a0e2f60", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647439627, "uuid": "8c68c87a-16a1-49b2-8eb5-c5d7bc7c383f", "comment": "Malware payload (Mirai)", "value": "8a596f678a9f648e3c71b5b903c3f1b2a1b9f0fe5a92021829fe513d90681068377270c13d9a0c36ce508ae42a01d985", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647439627, "uuid": "3fd15150-72ba-4eec-9400-d9d2983584a6", "value": "T165431B4DFD419B10C8800076FE1F2A4D3617D7E8E3DFE3265A24AB5067871678F6BA29", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647439627, "uuid": "822addff-539d-423e-b36b-a0db00708472", "value": "1536:YInO6qK9/zlHoQ+IIKiPk/IoLWlUAUZZMDcEK2:HqoUzk/IoLWlUAgaD5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647439627, "uuid": "0a60ad6f-79aa-4729-92e9-4b0b2476ef4f", "value": 57168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647439627, "uuid": "d34adaed-8735-49f3-ae37-1b5d6ce02c59", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647439627, "uuid": "7a505d27-3d33-4311-9c44-5ba732afeab6", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9b36a71-a568-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647463082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647463082, "uuid": "1cd1c032-b1da-44de-b4a2-a55ad286120a", "comment": "Malware payload (Heodo)", "value": "6f137761bff06cef9a3a331870b79658", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647463082, "uuid": "b87bf8b5-9ace-4dff-9fa8-70022d5ca261", "comment": "Malware payload (Heodo)", "value": "65dfaed8f83489436e9cf30bce7cb1f90133f3e2a84c1c2dd9a40870a0313937", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647463082, "uuid": "cf683384-34cd-4a2b-9b09-5fe41f441888", "comment": "Malware payload (Heodo)", "value": "8a1c827b3d733ecfb0ee7335189326d36baae851", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647463082, "uuid": "ce09c2fd-414d-486d-a77a-0318a0d929a2", "comment": "Malware payload (Heodo)", "value": "2ca4d678a6defdde23f69f160bb12f82839df1f19e79998a5ee250192e3a0782bec39eed5eb67e53ad42354b91f272a4", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647463082, "uuid": "00a455c2-f9cf-4b5d-9464-7dcedc155fe1", "value": "T198A28F2DD511784DE37A6C3C820940FAD28E5C023147A9EE3490B7BD6B76A5707CFA9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647463082, "uuid": "a4f70a12-afb2-477b-81d6-6f3455894379", "value": "384:NDfknuAi/NjA2S8EibbwBlwW5SYrLb5CzgObff9kC+xbX7sbEtF:R4sN3zXuFCBn9kC+xbLb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647463082, "uuid": "b296960c-2604-45bd-bea9-c853bb0bbfc3", "value": 21641, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647463082, "uuid": "79b2b462-aeb5-45bf-b136-dac49e5b6e0e", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647463082, "uuid": "fb7d5d7f-5740-4843-bf5e-e04c18c8eceb", "value": "Form.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2d8447c-a55b-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647457407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647457407, "uuid": "5c13db96-7551-45da-be28-9e44199c776f", "comment": "Malware payload (Formbook)", "value": "5a644d930cb20172c1d7479ed4c5ce64", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647457407, "uuid": "ea12acef-e518-441d-97bf-c2e50b51aa55", "comment": "Malware payload (Formbook)", "value": "65e4e564b8d0f3b181058ed54bac710b63862b172362c0c7fabb4750a80ffe97", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647457407, "uuid": "c8dff668-eb03-4f39-8b77-57c1b6d5383c", "comment": "Malware payload (Formbook)", "value": "f217351f03d4888efa5f4c72539d98b71c8459fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647457407, "uuid": "dcc302fc-c69d-4090-b77d-3e574922c25e", "comment": "Malware payload (Formbook)", "value": "a3cd61399cd284b2f027416715c846fc3ff368f16fd0f74b55ab5cf7f35960936dfa76385f44455c1a60aca54d4e1715", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647457407, "uuid": "8197c09d-ee2e-402f-8920-effa2c7050a5", "value": "T1F0A4597E186D5337CE7BD27286501419F6A1D1EB3902AD29EEC31B810D136CA7FCA92D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647457407, "uuid": "3175029b-7174-4a68-bebe-72cb9c3bbcf6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647457407, "uuid": "ee5b19b5-3646-4c45-a0a5-af3181167a06", "value": "6144:yeZFEoXdmwqkqt9lTyoJDj5kt4QhxJUQQ8m+t0xjfRfnVGJwUuw+oR56oPO:BKYmwqXlmphcQJmFfdEwUuwZ36o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647457407, "uuid": "696c4b88-5b02-4311-b4de-e0a89b10b4a1", "value": 462336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647457407, "uuid": "960a58fa-0687-4f21-b930-8c9107d131a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647457407, "uuid": "7f375457-8692-43e2-9880-9bf319d94be9", "value": "PURCHASE ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb2d42ce-a562-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647460400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647460400, "uuid": "26cb8974-5ee9-4bf6-9e02-baf06bbc53e3", "comment": "Malware payload (Formbook)", "value": "b456871aabd8079d247a1176339a9b9a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647460400, "uuid": "eea24720-4a7e-40a6-b8ac-905f6e8862fa", "comment": "Malware payload (Formbook)", "value": "65f8083112b5e3e0b00010fa21b63d4bf4be73e0cc347dfa3afdf93e200a827b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647460400, "uuid": "e4f56b53-5b03-4a91-9134-d72e4a3a5b1b", "comment": "Malware payload (Formbook)", "value": "53f0df0cf8be680c5f9c086f177bbc4de6fd1d46", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647460400, "uuid": "6aecdb73-6f85-48a3-a857-5c4d2ea60550", "comment": "Malware payload (Formbook)", "value": "ec440ee99807239f3bb5a3b930f63fb6269696dc7e32b7a85683f31e391c381010c868be049e926cfdc56df8fb89fc2b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647460400, "uuid": "500568fa-728d-4094-b099-0a2ffbff589b", "value": "T124C4125E39DDE42BC4788AB26D7BD2A9FF71605481784B633785DFEE2D880FC9805281", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647460400, "uuid": "9450e5b9-3d58-40f6-8b9b-638ba0a4ced6", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647460400, "uuid": "53083412-3bf9-41f2-9c19-8dd19f78648a", "value": "12288:udJUvLGqiPvGIBla2YnkCoZEpNsmWdmCYUVqPcvIg:uQsv9CkCOEpNsmhng", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647460400, "uuid": "94a69b40-64e3-42d9-b65f-414f98c45720", "value": 581409, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647460400, "uuid": "b8a4848b-6316-40fc-9c4a-93956ebcf2bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647460400, "uuid": "dffe866b-a6bf-4fab-aea1-526fcd069078", "value": "RFQ#002.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdffd2d0-a52f-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647438608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647438608, "uuid": "18ddaab1-9bf6-4582-83b6-ae91a37ea55a", "comment": "Malware payload (Mirai)", "value": "cf6eccdacfa1f8eac59f8041bfb9653e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647438608, "uuid": "6597d5aa-2745-44aa-9cbc-0ce01c2280b3", "comment": "Malware payload (Mirai)", "value": "66c85d1b726983ce2c0f8206c6e0928d422e03eeee8d57683d8c6a6e15d80bf9", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647438608, "uuid": "f947ff81-0cbf-4200-8a1a-1789977054d7", "comment": "Malware payload (Mirai)", "value": "8abd7f71a8f995b936ddb883651886337a0debfb", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647438608, "uuid": "b6723806-34e2-4768-bec6-8d8af6cc9456", "comment": "Malware payload (Mirai)", "value": "3a3dc7529301844f80d21f43fc22d578e1754caa29cdff6a7458ed065308a9d05c1e41e10b994ea0cfd7734b63e5d10e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647438608, "uuid": "18f1611a-13f2-42d7-9424-4e80f83af375", "value": "T1A6131940BF4AAE49C1C03073FE2BC389B629DAD4E1E9BB974A156B44197F4270FDB109", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647438608, "uuid": "669253c0-8e83-4eef-854e-ad8102341bb0", "value": "768:57S2hwP9jEOZqtvNNvEwY9Q+UHNlUZyjJLHTQPaAz7:82hY9jzZqx9sJilUAFTpAz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647438608, "uuid": "0ed2bc77-c1a3-445e-88de-032a3f69b698", "value": 43724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647438608, "uuid": "11cdf740-75af-4576-939f-e20cc0cd6a75", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647438608, "uuid": "b48dedce-1adb-45e2-b210-9dc98f565958", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7aa094b2-a584-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647474895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647474895, "uuid": "e01d3fb5-092b-48c1-a749-f39281042ecd", "comment": "Malware payload", "value": "e581b8fa658e39fcf9bfede0726fcd57", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647474895, "uuid": "897c1e5c-2abc-4982-873d-6d1f7f0d0ac8", "comment": "Malware payload", "value": "675e77d54a3d0b879137745f038c41bd0874cdccffc7f7b09a4dd49e0b235ed7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647474895, "uuid": "e5534f4a-0244-4c4c-be43-9c3faf4736b0", "comment": "Malware payload", "value": "dba51b27da80052dd9eb60f9e8693b6ec1e2e214", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647474895, "uuid": "eb6e177c-9190-47e3-806d-6035a6188fe0", "comment": "Malware payload", "value": "ab264f4ab0991a6c7f4e6d1b9642e7475748d91d7fc788740c7ba1ea01f3ef4f7f808b93ac6a61e4f8529a407868a08b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647474895, "uuid": "6e0db5db-d062-4906-8d95-b45e7cc3b9b8", "value": "T19B759DA1A014C488EC6BBE3B2F3598AC04B23ED06534DD9E0D5F3AE605395A6DD54FF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647474895, "uuid": "9114c0eb-163f-4e0d-a70f-88265b3b14c1", "value": "a1eb2984f047ec1e746b257aea11c6b5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647474895, "uuid": "e6b8c784-fec4-4ab8-ae14-3cc7ebf40e5b", "value": "24576:9OsZcGNaifx8QrECKh0u+bpK1EzvNo09305zLq8J06ZvX+UhQyRN://KKzV5UPJGEXMyz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647474895, "uuid": "06fd2eed-c6a5-4d0e-a281-5213f5f3c289", "value": 1625024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647474895, "uuid": "ac71d1d0-8130-4fb5-ac9f-34ce9f9f2d9a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647474895, "uuid": "e433ebd0-8c64-4c6b-b502-954a18b38a82", "value": "e581b8fa658e39fcf9bfede0726fcd57", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61744594-a51c-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647430185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647430185, "uuid": "0da8f45d-68fd-4e77-8d13-7cb568edec37", "comment": "Malware payload (AgentTesla)", "value": "3c718912e6724d7f8e17d01d1d2ba68a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647430185, "uuid": "1c5d74e7-3f57-4ac9-972b-41d7807b00bf", "comment": "Malware payload (AgentTesla)", "value": "6765379680d824bcdd7eaaa0d66b98e8f73bea9c949edea25a4a5ba19c7f9c7c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647430185, "uuid": "422de614-be0d-4197-a71c-3e0b631e5f63", "comment": "Malware payload (AgentTesla)", "value": "83355f1410a0b7700452c4fb32e3964097574912", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647430185, "uuid": "5b646423-55b3-4e29-bc98-ea537fdefe62", "comment": "Malware payload (AgentTesla)", "value": "a24a25294d7180a70dfb622248a3acd9d0c65775034620fd0c5820abe983ce8956668b8c5750ebcdbbcb4a76402da292", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647430185, "uuid": "099aa949-7281-4292-b58e-ccf85dea202d", "value": "T1E29423E80BBACD57CFCA7392979D15535922CBE3C0B4CA6858DE442FDAB7270215236C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647430185, "uuid": "6fc1f9f4-f90a-4335-9d22-ee6696fbeff5", "value": "6144:P1h+f3Lj+RWL6lOVpYyvj/VJ7cXm2KeNyJ1T723cjyYdsq8qXfrYheuYd6QjjY:Pv8LyRVlCpYqj/VOBK7b3gsygBU9QjjY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647430185, "uuid": "32e8e578-d497-428c-bcad-9e70a9e45e7f", "value": 423733, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647430185, "uuid": "a478a2f8-0f00-416d-b640-bf8b50f5a7ce", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647430185, "uuid": "e30a76b1-a821-4c5c-90b4-c1cd818ae2c9", "value": "Shipment Docs.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00f5d1a0-a556-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647454934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647454934, "uuid": "042718a7-7246-42e1-acab-16dd14cf8dff", "comment": "Malware payload (Heodo)", "value": "ab493b86e54130b3f42d0b7fa9a6a319", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647454934, "uuid": "b9b4bd32-45af-4910-803a-8b813ff5c28f", "comment": "Malware payload (Heodo)", "value": "67e568e41a4c200377bab172852eabc4dfd03a0ebc9b4a02418c1ec64e44e5cf", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647454934, "uuid": "cc0aaba4-bcb0-45c6-8aab-00d38314a493", "comment": "Malware payload (Heodo)", "value": "7359a8bfc3bcd0c90df9ba264e68e5fa77c18299", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647454934, "uuid": "114109e9-645e-431c-84e8-4564b902558f", "comment": "Malware payload (Heodo)", "value": "272451adebd98568fd73557d8a5a550611e5703885957d4ef72b2a8535832d01e48d3a53ad8aa5bdbfa00e7ca135b67e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647454934, "uuid": "1d1a72cd-3a22-4608-b4cf-816647aa7f0c", "value": "T19EF4DF1176E1C076C1BF12304956A38D23FAFD509FB986976FD02A6E3EB41828E34767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647454934, "uuid": "17e29903-e4f5-4b4f-a40a-01a559e635ae", "value": "66a21a1bcb4077b3ed89c00ee693486b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647454934, "uuid": "0b56dacc-fabb-460e-971b-03c71c5488eb", "value": "12288:g6O4TpP0XjxCCFJuf07j+Xk7hO8rLneTfABCJoWRWwfpW:BeCCF88j+XT8OTYA7pW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647454934, "uuid": "472abc40-58ff-41be-9358-3487f622581a", "value": 749568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647454934, "uuid": "bb9805cd-14d7-4f5e-a5f5-d4015fff8e0c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647454934, "uuid": "95e7a06a-01d3-4cc2-85a6-b92cf251b652", "value": "emotet_exe_e5_67e568e41a4c200377bab172852eabc4dfd03a0ebc9b4a02418c1ec64e44e5cf_2022-03-16__182206.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a55c07dc-a4f9-11ec-9275-42010a9c0029", "comment": "Malware payload (NanoCore)", "timestamp": 1647415266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647415266, "uuid": "34d03a89-63e5-4258-aa30-3bd4c6e1052b", "comment": "Malware payload (NanoCore)", "value": "82abc1a7fd472765d3412b085116e46c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647415266, "uuid": "95a957aa-86f4-4bb3-b8d4-abd01bd2717e", "comment": "Malware payload (NanoCore)", "value": "680237e724bbf29fb991ad2635d6476c48d6881c9604b0fb8d91e20ccd269e2a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647415266, "uuid": "69e57120-953e-4d9c-b23b-9ea74963e015", "comment": "Malware payload (NanoCore)", "value": "9b79fa897e7d1f1a93ac6c5c58d981db7bce419b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647415266, "uuid": "d49c2864-7fa6-4f1b-bb16-9690b91e99af", "comment": "Malware payload (NanoCore)", "value": "2d579c6059fe047b7e540084616339a5a10ea1fe21e2c78bc5014378b9d3b9ee3690b2f7c41d859f70db9f33d5126ad5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647415266, "uuid": "19a56491-0526-4b24-9715-6232fc9d78ee", "value": "T10005125E33A4CE82CAFE8E37E860511607F2F97BB563D38D5E9524EE0987B05851039B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647415266, "uuid": "5a2670b7-2220-487f-8f33-0f41923881e8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647415266, "uuid": "a64d7352-a6e8-44d0-87bd-b68c6d595722", "value": "24576:mQwOxVmtqp2Qr3fPLJ+zrqCEyU/EvWSQwFW:mQfH6qLr3LJQBeEvWSQwFW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647415266, "uuid": "2cc8a800-3e2b-4613-931b-a10b7a22bcbd", "value": 827392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647415266, "uuid": "aa22603b-68bb-4c1c-affb-36faf942c61d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647415266, "uuid": "183c1d87-bf23-4607-b25e-018a496d9420", "value": "BOQ for PTPDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2a60145-a4fe-11ec-9275-42010a9c0029", "comment": "Malware payload (Smoke Loader)", "timestamp": 1647417544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417544, "uuid": "669cf455-408b-494e-b38e-d82925858d01", "comment": "Malware payload (Smoke Loader)", "value": "29e8b819a54637a0b550c8d680c9bf3b", "object_relation": "md5", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417544, "uuid": "f867c349-a006-48ae-9497-cf4352449dd5", "comment": "Malware payload (Smoke Loader)", "value": "6818b517efdacfd1d0862de4ef52c1f6a88708fa156352290b6673c394f37645", "object_relation": "sha256", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417544, "uuid": "555bd381-5eda-4d78-899a-b3bbc4bf53a5", "comment": "Malware payload (Smoke Loader)", "value": "dc47e84791b6e7f7d8b494b3a64b35ab0456dd1e", "object_relation": "sha1", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417544, "uuid": "67fa632a-a48f-4897-ab50-03445975927b", "comment": "Malware payload (Smoke Loader)", "value": "3fd601819264498473fdcff529a4ce099553e9a44016a795c31993291f0ebfca09ea8af22d9699defc9cbb944ad866ed", "object_relation": "sha3-384", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417544, "uuid": "b2bb274b-18c0-4ca6-bbf9-c2a7ef80f125", "value": "T170E46B56BEC66EA2EF7F55B783A0EA3D1156336D03A18ACF760305993911FD2413EA03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417544, "uuid": "16f8474a-ac65-4a9e-bc26-a67070438f06", "value": "0d1c2e8773adbfbc64d57aab36998066", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417544, "uuid": "e50d821c-bbef-4650-8173-e973fdfd243d", "value": "12288:7fBUkVbwLSI5/Q8OF8bzbBSreSOi1uWD242S6+4zfam:dUrO2X1ZDWeS6ZzS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647417544, "uuid": "09c7ca68-e98d-464f-83e4-32424fded5ff", "value": 664064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647417544, "uuid": "4f322b3c-6dc8-4e62-88cc-345b33f1be83", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417544, "uuid": "69e41cb1-b177-43f8-933d-96c6838492c1", "value": "Statement -February 2022.xll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae3dbe78-a53b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647443628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647443628, "uuid": "79f63133-a9b1-4716-a34c-61e86de03ab2", "comment": "Malware payload (Heodo)", "value": "d851838f0c92e28bef5032c5b615ccb8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647443628, "uuid": "f0da31f4-34ca-4350-a3d3-3b4971af72c5", "comment": "Malware payload (Heodo)", "value": "686ba3f7d1013cdcd43a59110afa40d2ca05fd8b68e4f7f03445980b680561e5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647443628, "uuid": "139fa592-edf2-4567-b667-a2bdebdba7a4", "comment": "Malware payload (Heodo)", "value": "5a87a551448384cde34fa65794119c13d5c90fa5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647443628, "uuid": "d9db78c2-41a4-4741-9702-563b004f928d", "comment": "Malware payload (Heodo)", "value": "2c1f67e0b35d1e770d3f549b02f5839246fcf5e9bc35b9745c4c2cf3042b21520be62bb0d7e4a02c0eb7ed2ec2641e3a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647443628, "uuid": "f09925e4-538a-4941-9772-43f4180bc214", "value": "T156E47C12F461B2B9D04B04741F1723A86EEF5E518629CA13AFA8ED5E1F31251FC3FA16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647443628, "uuid": "59837a44-23f1-4543-918e-49b30add3be6", "value": "066d4e2c6288c042d958ddc93cfa07f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647443628, "uuid": "8b4166c5-8455-463c-936b-798cc06f3322", "value": "12288:DtAanana8Meee0GBGu3qI+3DNJ3vE6v5ejxS332d7t5hT/hexLx:Kanana8qGBGuoNxEhxCM7o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647443628, "uuid": "e93fb1aa-faad-4560-aab3-0a4227a71387", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647443628, "uuid": "eedff179-0a45-4845-a913-b36b61a92f17", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647443628, "uuid": "cf0ba87b-eb01-43b1-a207-82442e2085ce", "value": "d851838f0c92e28bef5032c5b615ccb8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a5c874d-a50c-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647423355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647423355, "uuid": "2bac0b76-c48d-43d0-83dd-89a58607823e", "comment": "Malware payload (Heodo)", "value": "f9e06d5b59d5d780cd4fba783ccaf1cf", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647423355, "uuid": "c973e17d-8329-43dd-8cbf-cbce6403d546", "comment": "Malware payload (Heodo)", "value": "68b823ea644d72c65e5e8f478a391cd84fa451a7b6483547c42e9b8e5f6314ab", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647423355, "uuid": "a8d3f8a0-9f19-4afd-8c30-be8d75f9d3c7", "comment": "Malware payload (Heodo)", "value": "b7a6c70127bcbe4e8e0d6153e36590b8d2d8a565", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647423355, "uuid": "b7a4c5a3-ef9d-46e5-bc96-bb5b62fd3d8b", "comment": "Malware payload (Heodo)", "value": "35e4cfcd26ccf4a3463fe4dee6c61cad5d5b56aa3bcecc785ed4fcc9b500cfcd5a1c7533435cdc91ebcafbbd35e66289", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647423355, "uuid": "6ccea82b-1678-44a3-921f-463640dbd175", "value": "T179E47C12F461B2B9D04B04741F1723A86EEF5E518629CA13AFA8ED5E1F31251FC3FA16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647423355, "uuid": "2d38a8db-579e-4f31-ac89-a57a0abf9b82", "value": "066d4e2c6288c042d958ddc93cfa07f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647423355, "uuid": "1287c15b-389f-4672-bb69-4449054d9cf1", "value": "12288:DtAanana8Meee0GBGu3qI+3DNJ3vE6v5e8xS332d7t5hT/hexLx:Kanana8qGBGuoNxEaxCM7o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647423355, "uuid": "d4aed4b4-24ec-43aa-8750-c8e2edf2c547", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647423355, "uuid": "fb1a8b20-c844-4032-afc0-7a423cdedeb3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647423355, "uuid": "7b6f0f8b-d940-4a9c-9f93-1b81e09b53c4", "value": "CDp9Yhpt.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7e890fb-a548-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647449308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647449308, "uuid": "881d6927-6146-4ec6-9f03-d32def92979c", "comment": "Malware payload (Heodo)", "value": "2c5815e96ab483024d61c7a3e04e53eb", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647449308, "uuid": "4440f66f-e934-4249-baa2-cf0e6b290c07", "comment": "Malware payload (Heodo)", "value": "69564611bc5f4280f8d419533a77548aa9a45cc024e926b502e214ca0ade8a7d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647449308, "uuid": "b0f17559-4362-4129-9936-abbfb2943682", "comment": "Malware payload (Heodo)", "value": "5afeae17fd88831bd3f8fda5e6d71a051cbe4007", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647449308, "uuid": "be6a55ed-1d91-4c8a-a553-ec6552b4ab3e", "comment": "Malware payload (Heodo)", "value": "47f7aaf49a096645e725db7386c20bfda90754eef1469ca17deb0ae0eaeeeee5f238b725942606de63b2f6cb4c643ef8", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647449308, "uuid": "ceb644c0-b039-41cd-a089-60982b5c7ef0", "value": "T12BF4CF11B2D1C076C1BF06741916A35D63F6FD608BB9878B6FD02FAE3EB45828A34356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647449308, "uuid": "08dfb123-1441-4bf6-b861-46055ba3bfaa", "value": "66a21a1bcb4077b3ed89c00ee693486b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647449308, "uuid": "397579ab-d599-45ae-8369-e0a7396e1e01", "value": "12288:WZjb8BOPxue5dKV9M/98f0koPbXvkgKtuBdfMAofD:WCBAdKV9Xf0k03KMBdkAofD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647449308, "uuid": "6e5f278f-c1ea-48eb-af6b-1cb831fe7f4f", "value": 753664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647449308, "uuid": "9eae44ed-2747-4fc2-b956-2775ae63e84e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647449308, "uuid": "220618ad-b4e3-4411-9440-4c2c538b5e54", "value": "emotet_exe_e4_69564611bc5f4280f8d419533a77548aa9a45cc024e926b502e214ca0ade8a7d_2022-03-16__164822.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a36e49d-a534-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647440454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647440454, "uuid": "f4f7a86a-f28a-478d-8735-d7da319590d9", "comment": "Malware payload (Mirai)", "value": "51961f2cf1bae3ddb8112e925df0c73e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647440454, "uuid": "63476e3e-69b1-4c6c-9802-7cf551d797d6", "comment": "Malware payload (Mirai)", "value": "69a01211f5b19d220e809d638d1d86a71025a6ea489b3e3b1b559e826b6a1995", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647440454, "uuid": "7aaae9f3-6a82-4567-a150-63ecfbf70ba4", "comment": "Malware payload (Mirai)", "value": "d51ec2f5351ebd9df7667c84da9d3d878a13fc89", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647440454, "uuid": "5a56e328-4ec9-45b5-875d-2feab455320c", "comment": "Malware payload (Mirai)", "value": "62acfa806dd880f6a23deba9dbe79abd90e1d5390767183f7174018988b5d55d5e97bfd59b9221269c65392cf8904b16", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647440454, "uuid": "3c204a42-524e-4242-b33b-4d6331ca933b", "value": "T11633A4482F218BEDF2388374A3B34B34976862D167F0D7D5919CE4044E64A8D646FBEE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647440454, "uuid": "6a7276e3-669c-4807-991a-d47bbf21ea2d", "value": "1536:vgj4AdPlc6JH37QH3803L6T41f9L77DDzxS+lUAM91gwI:GX41f9L77DDzQ+lUA+rI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647440454, "uuid": "8ebcbd99-464b-4878-a699-7b871456befb", "value": 52888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647440454, "uuid": "a3383bdb-8753-4c99-a460-8c205284a3d0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647440454, "uuid": "4952d283-c8e2-4a50-bbbb-1318b9a20bbf", "value": "mips-20220316-1420", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bb214cb-a4d6-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647400191, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647400191, "uuid": "cdca08fd-4239-476f-89fd-683af3c32169", "comment": "Malware payload (Mirai)", "value": "f027baf22c89d44a83536bb977c2a81f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647400191, "uuid": "dd066912-ba7e-452c-a118-55d5ae7b7e5c", "comment": "Malware payload (Mirai)", "value": "6abc67c7825ce068b41f0cd9a15534d82f3601400a42f0186a7f232e18e8c4ff", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647400191, "uuid": "3238c711-3151-4b8e-955b-303ea2b5b491", "comment": "Malware payload (Mirai)", "value": "f3861750d0dbd29ba51391636ccf21293a59a1a7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647400191, "uuid": "8762c025-f1d3-45c7-9b51-f4dc46b477cf", "comment": "Malware payload (Mirai)", "value": "d5142140e1f9270594bde6137349625e60020025388a1a4dca07f9e947051b09dda87bd8c0d64cb2f038194d5067325a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647400191, "uuid": "d83a78db-d17f-422b-b0f4-fc3dcaafc00a", "value": "T164634C1372280E07D0A30E70253F4BE19BBEDFD121E0B686695FAB568536D371586F8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647400191, "uuid": "c39dbda9-9574-4dc4-9b7f-aeac8791c978", "value": "1536:qJapXArz8gz+gyD9jZQXpanf/Ip2bI+VLtJa10v:q+QvNrypjZQZanIp2bI+VJ4U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647400191, "uuid": "666ebad2-e733-46c4-8edc-253076e80767", "value": 67956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647400191, "uuid": "35f04231-00d3-4019-a281-d730b19f9232", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647400191, "uuid": "31c469ca-e1c1-413a-94fc-de79483b52e1", "value": "f027baf22c89d44a83536bb977c2a81f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cdffac3-a519-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647428916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647428916, "uuid": "97ea52f0-c821-4db4-863a-744fa4b990e7", "comment": "Malware payload", "value": "d2e760c1d11cbaddc5b5a207523a18c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647428916, "uuid": "fa411d1b-ce3f-4401-ab9d-46babdc8e8ef", "comment": "Malware payload", "value": "6b09030c84e4caeda33f8ae6e8ab3c4433517022722185cba1090690e2abadbd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647428916, "uuid": "c35a7097-8009-4443-870d-d828e4f609bf", "comment": "Malware payload", "value": "c879021487e5bbb48c80db1aba03d6a2fc3f6590", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647428916, "uuid": "abc230e7-092a-4d6d-ba14-430e5c59f64b", "comment": "Malware payload", "value": "ff6d2592be8eb55c0d399ce0056fdf06dc4845bfc5a6bdb17c2b74d8a3ad01bb6cfa243094edcdaf5fbf5c1e5f494389", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647428916, "uuid": "6220b08f-89ef-481d-bb5c-9c6dd173c7a3", "value": "T1062512EC139C8EB3D7BE093BE80095D54FB8C6132E12DF435EC528E9C98B7A514592A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647428916, "uuid": "19682d51-c341-494b-ba82-e3f13ea1b5cc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647428916, "uuid": "f429f464-104e-49c2-a12f-f441e39928a0", "value": "24576:GwOQxQENWe+DpE9ZzxTHd5R8N84u5hfJWzA72Esv:GfQa4We+SDnM8r5hRXKv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647428916, "uuid": "fae379ab-7bd4-4b6f-b0b1-f2a50ac789b2", "value": 1049088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647428916, "uuid": "5aca31ba-137c-40c1-b4c4-db89688ed0ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647428916, "uuid": "7d88f581-2861-4d68-89f2-7c52b54d4c05", "value": "reg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ed81976-a50c-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647423309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647423309, "uuid": "ab576510-22e2-4a64-885b-8a77c4794648", "comment": "Malware payload", "value": "3288bb99c9bf4030e842bef815c64d6e", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647423309, "uuid": "62303025-5b69-4dd2-9f00-f2d6ccc1ed0e", "comment": "Malware payload", "value": "6b8c52a0b2922d0671e5138938b7a9cc0b79a2c735dc2e4f482e01285ac473a8", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647423309, "uuid": "208644c8-4fe7-4c52-8bf6-0c8fd5dc4713", "comment": "Malware payload", "value": "ecdadede627d7b517b0c36247d108192b2f0073d", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647423309, "uuid": "46711431-0f5d-428b-adab-b6f2b7399006", "comment": "Malware payload", "value": "0fe67107aac7df35c0a42c70000472c9498c06b6bfab4157c32ef75c3b72f6391706a9d26bda12283c260f970c53bbae", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647423309, "uuid": "2a78b6ea-ec2b-4bcf-bfb7-38e70889ff96", "value": "T1B9653385535569ADEA4203B0F810900117474AA2FF6FFF494F9DBE6BC293BF648E5B02", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647423309, "uuid": "f4ed5d7d-78f8-42a2-a4a7-ba1d848fee09", "value": "24576:lbCXsK5ZEGulNgcSNxCL+uzrwJQOEjBBbcHlatFn1aKoJerq3EsU:5CcS0DS/Izrw2OEjBFcFo1XoEM9U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647423309, "uuid": "0108fb90-9d9b-4da6-8747-3e1a4370c40c", "value": 1503113, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647423309, "uuid": "03786937-2cfe-4cbf-9864-9f32d669d204", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647423309, "uuid": "8813aef0-3f40-450b-99bc-fc0d4ccc38d3", "value": "RFQ-1SCP2022.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be954d1a-a53b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647443656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647443656, "uuid": "285c3b61-f64e-4d92-9178-ec2cb85ab206", "comment": "Malware payload (Heodo)", "value": "d009776a1710401c316d6df9ab422ddd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647443656, "uuid": "d6ffdb8b-b40e-4ac7-b0e3-a2e0d7ffcef1", "comment": "Malware payload (Heodo)", "value": "6c042d1f2b9cde72fe731f80cddfe09e78841795d1ba1d0b9822fecf2df2cd79", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647443656, "uuid": "216bf02c-08a0-4d23-baf8-e39e691e89b1", "comment": "Malware payload (Heodo)", "value": "25ac30480974b887ad1bf7f0514a8fb998947fd3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647443656, "uuid": "72b3a884-e04f-41ba-8d66-c9298af74050", "comment": "Malware payload (Heodo)", "value": "3701c5e76bf6b1213a6819d056f4010be8e208fdbee97920a880073bb33778478d1cdfcf59d1f4652ceb6f3ea14f9e89", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647443656, "uuid": "a9ef228a-05f2-4293-8ce5-4d55a7d7d943", "value": "T1C8E45B06AF22A1F0C06B03B40555125AC2EF7ED0A72ED657825DFB7EDD339977A30226", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647443656, "uuid": "adcbd7f1-219f-4ecb-a16a-9f977a20981a", "value": "066d4e2c6288c042d958ddc93cfa07f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647443656, "uuid": "9ef3b4f8-632c-457c-bf98-36e0c7370007", "value": "12288:jc899XKPmN4WMkoe6ZPJSFTdtXlcIL9v6O8:7GP7FgFTdFL9v6F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647443656, "uuid": "d89d7703-393e-46ae-b980-48a9b5fabcd8", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647443656, "uuid": "e8b2310c-f9f8-41dd-ba6e-804a8e43daea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647443656, "uuid": "700c6053-ac86-4c5b-a0ee-ef84fcffd329", "value": "d009776a1710401c316d6df9ab422ddd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f28c0430-a568-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647463070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647463070, "uuid": "a365c118-c45d-418f-b989-148fd5246f29", "comment": "Malware payload (Heodo)", "value": "99f0691cb8e03e8c99dd9ec21ecc2584", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647463070, "uuid": "221910dd-3d1a-4d30-91c2-607466f4b5b3", "comment": "Malware payload (Heodo)", "value": "6c75cedee537aa61b76a4f27ab7bd1f954c6840cb57bbea32c820970b44f1b6c", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647463070, "uuid": "afa0c6b4-9945-4865-b57f-54a50560aeab", "comment": "Malware payload (Heodo)", "value": "605bb693cdbb51e4bb977794394bba8d5a36b1f5", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647463070, "uuid": "1d698411-e72c-429d-8fec-42d5f2f3199d", "comment": "Malware payload (Heodo)", "value": "f712877fa294b6718a08e79d98a0a74fcc47325d426bc0d2dd5574fe927ec8a0cd3333ffe112791642b5f0aed2f07a3a", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647463070, "uuid": "2118d4fe-0895-48fe-8a84-6b74b107980d", "value": "T166E2C02DF3A0EB1DC219D939446981DA420A74258506EB8FB95CFB1D1F4A6C2770F09E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647463070, "uuid": "fac35e37-4325-4c8d-a566-4c950d32012a", "value": "384:sjxzKpZPFhNjHEBOA7iEibbwBLg0SCdiVZKgUrNU/qWhZOdBNPJM+kqr9eCgh0kB:sj1uFhNClizXT2tdFfPdkqstJOE6K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647463070, "uuid": "a0ec044b-bb70-425b-8e91-073559967e1c", "value": 33745, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647463070, "uuid": "8a71de10-96a9-4410-8d98-3f3d4bcb1e25", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647463070, "uuid": "9d9d2e97-6009-4155-80e6-c55a16cdbc69", "value": "38_065.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04f5bced-a526-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647434325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647434325, "uuid": "2630586c-4ca7-4401-acd5-8e9af6827091", "comment": "Malware payload", "value": "03698509376aacc7c2c4c7a8e4e77ea2", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647434325, "uuid": "170a6455-71b0-4ae2-b504-202b9eaea60e", "comment": "Malware payload", "value": "6c8b5955b2a0fbfc4212e4d3ae01f1b079195df6f669c5a3ecd7459f6ea43606", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647434325, "uuid": "4678843b-d060-4a5c-be01-05fb2e7d7072", "comment": "Malware payload", "value": "0aa1d89a460f9661c586c833f652e9f442d97a9d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647434325, "uuid": "28e78214-4bba-49e3-8e04-16edf73fa623", "comment": "Malware payload", "value": "137a30e24b8e8f6589fe7a5320c99d6636ca6c0be5b00026383c7878d4f6c8783df5999d56140df737e6f0a8ee80bbaa", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647434325, "uuid": "654e4fe5-b706-4c2f-95f1-319655ea709d", "value": "TNULL", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647434325, "uuid": "d8726286-eba8-41ee-a692-6c64e0606b15", "value": "3:HOWAW:HPAW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647434325, "uuid": "04577812-dcb8-4ea3-a26e-1b351cdc8105", "value": 11, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647434325, "uuid": "c1412fe1-7a0b-4819-8e3f-bf9474dea0b2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647434325, "uuid": "135314ea-58c7-45dd-92f4-a4dd8db70e04", "value": "4.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10a35e42-a539-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647442505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647442505, "uuid": "2532e933-7251-4738-b3f3-0a82062b480d", "comment": "Malware payload (Heodo)", "value": "217a99434e68c6839832bb3381fecedd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647442505, "uuid": "1bc498eb-81b2-4494-91ee-c6ad13b9b610", "comment": "Malware payload (Heodo)", "value": "6cd07b67d26fbc609e1fb41cd76937cc5e8c6e718d2735a562a164be3a20cb14", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647442505, "uuid": "41a638af-78fd-4b5a-8ec7-925b148440b9", "comment": "Malware payload (Heodo)", "value": "1240509bcba993a24de8ac21e2ee768805953bda", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647442505, "uuid": "c9e4bc81-3d71-45f8-990b-bbed00d2d12b", "comment": "Malware payload (Heodo)", "value": "f31ad2a83bcbcc75e4e6b238bebd8829ac46c7613b95e6f92dcbfe291279a39cdc7212a466aa8e05d7f05feddc5c87b4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647442505, "uuid": "3b445746-226a-4da9-bdec-3869c0615508", "value": "T105E45B06AF22A1F0C06B03B40555125AC2EF7ED0A72ED657825DFB7EDD339977A30226", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647442505, "uuid": "fc2c2823-880f-422f-ae6f-c2561ff04109", "value": "066d4e2c6288c042d958ddc93cfa07f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647442505, "uuid": "32df2125-614f-42c4-86f2-bf616d555fe9", "value": "12288:jc899XKPmN4WMkoS6ZPJSFTdtXlcIL9v6O8:7GP7JgFTdFL9v6F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647442505, "uuid": "d87d0780-e574-4935-a7b5-1f807df59bbf", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647442505, "uuid": "0548d8e0-04a1-42e2-838a-e3a6020f10a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647442505, "uuid": "f57ec1d3-7790-4294-85e1-bdab45b16012", "value": "217a99434e68c6839832bb3381fecedd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c317023-a4fd-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647416754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416754, "uuid": "c05188e3-f6a2-4f14-92be-8d2c2efa396f", "comment": "Malware payload (Formbook)", "value": "7f90caf01ca6411e06316d298c97710b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416754, "uuid": "ba0b5266-db3c-48ca-b083-a792b9249c05", "comment": "Malware payload (Formbook)", "value": "6d1b5d02ac804560ee8d86aab2544363dbd2d4f6cc8adb9c77b249dec2df7945", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416754, "uuid": "8aed7ba2-cc10-437d-acb7-cf68e495a8f7", "comment": "Malware payload (Formbook)", "value": "6a33f67424ce760102da2d5f7bfca4ff3051a203", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416754, "uuid": "207a6091-0a62-453f-8930-48c4d1c8fadf", "comment": "Malware payload (Formbook)", "value": "df7895c3bc833b35c115c9c6b6a8269d5fd13b0dca1b143fdd314dff4daa37820465db6036da49aa7def8d1977cc3edf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416754, "uuid": "7888ce74-6784-468e-b84e-945beb81e772", "value": "T1F654122E37D49AFBE3CD0A792134A7BFAF7D88142206184727508FAE3DA17E71694057", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416754, "uuid": "6c1a8bc6-67c5-4476-95a1-5a8e576d8dab", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416754, "uuid": "94b35426-ee02-454a-be1c-5ac31c475df8", "value": "6144:rGirJDnuuVhZek8ZYAX4nUBlKsg26QZZWh9fSDzD8mQ6mBCVkvmHvYQ:RBVhZen3InQwGD353ECVFvr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647416754, "uuid": "291fe298-7f96-45b9-a09d-735864d4f6ba", "value": 305441, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647416754, "uuid": "9ff1e678-c951-41f1-9821-913ef6f8c67c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416754, "uuid": "8a21668c-55c1-4159-9cfc-55a6571740d2", "value": "IRQ2107799_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec3dbbf5-a4fe-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1647417533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417533, "uuid": "a30651cd-99b3-4f2e-8995-1ce399e112e6", "comment": "Malware payload (Loki)", "value": "94c8b0ffe110bf2ece2121813d62aabe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417533, "uuid": "71e13c97-9453-4004-b456-f0a8d0326799", "comment": "Malware payload (Loki)", "value": "6d488a5d2936cea6ebed664c513ec1ab0e7788e1a07ac6a093e5a7a9ad2c96ba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417533, "uuid": "22c0773c-251b-435f-bc6f-9e13da8b9331", "comment": "Malware payload (Loki)", "value": "b071b3a3ab5097dc0cc00e878b53b8385b1a0a67", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417533, "uuid": "122f9c59-e020-46f9-bc0c-564263e2a876", "comment": "Malware payload (Loki)", "value": "a2bb3f5ea1c92751d6f20c620d35f5179dbe2fd88bb9fa7fe7f18a265525c1533c20eba9a457aff1d211dfa2b7036cf9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417533, "uuid": "835752ab-36f6-4bc1-9e4d-d566d2f80271", "value": "T14ED44A89F11025DDCC1ACB318932CD38DEA27DB9973AD11E24CB3D6B3BBE6974914462", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417533, "uuid": "3fdb34ce-0238-4139-8a2c-c2bcd88a7794", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417533, "uuid": "60f2d9c2-541a-4348-a061-60184da67d36", "value": "12288:ZS0tVAbdCeCmbPgo4clW4bplU41hD6r2TGQmzRUcZ64OQlRpKO+7GdP7r9r/+pph:bAQmbPgo40WcpOzUG1q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647417533, "uuid": "c3089f67-5a8a-4961-a438-49bf85f1852c", "value": 656896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647417533, "uuid": "77d5eecb-5f00-4c9c-974b-14b2970ff181", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417533, "uuid": "40dab9c5-c8c4-432a-ac8e-4939625d403d", "value": "TNT EXPRESN\u00cd NEVYHODNOUC\u00cd PLATBA.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d974ef8e-a4c2-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647391732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647391732, "uuid": "66949081-301a-46cc-8d39-fde999e18aec", "comment": "Malware payload", "value": "db6e414cb662d43317f56c1702bb7725", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647391732, "uuid": "a437fa01-0a59-4165-8c54-7330cf225969", "comment": "Malware payload", "value": "6d656133f5bac8282f31cc82ca0e3869692164a6907037aabc134736adc87b35", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647391732, "uuid": "c863a091-bced-4859-8999-c56517eaa3b4", "comment": "Malware payload", "value": "43cd7266a8b4f2f8d75195fbfde1ed443a588cf4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647391732, "uuid": "e306e3a5-dba5-4e1f-8495-926438fb592b", "comment": "Malware payload", "value": "5fa83f5993045cd7e94e3423ef36aefb5c0ec553f46dc9f0d2d671f90931a4e0b6f64dde8c1270ca6872ea8f38e2af04", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647391732, "uuid": "61572aa3-25d3-4312-822d-2faffec1a444", "value": "T19213C5256FFCDC51E11990B5E663C4FC4868EE06D52EEA33DAE63C26B27D652241E203", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647391732, "uuid": "aa160b37-1d84-4780-917b-af47baa30bc2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647391732, "uuid": "6d715134-e458-4181-a324-a101f086f907", "value": "384:6i5D8YvUQRVpF9orMvRNC+0gkInBHRrfE6RwaO4VWpIW:6pCpFpy6n56qQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647391732, "uuid": "cd92f57f-5f6b-4964-ba7a-8f06628fbc86", "value": 43520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647391732, "uuid": "c462255a-a39b-4c8b-a3cf-605bfbc20b2a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647391732, "uuid": "b2e91085-6d0f-4781-8ebf-96cdb94c704a", "value": "db6e414cb662d43317f56c1702bb7725", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34a64ec5-a53a-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647442995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647442995, "uuid": "0e904775-eae6-4b84-92b4-85ff653534f1", "comment": "Malware payload (Heodo)", "value": "a93fa122f3ea8c9f23eec6a2c0522937", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647442995, "uuid": "b661b68b-b92d-4a51-b4e8-db6cff732bf5", "comment": "Malware payload (Heodo)", "value": "6db9312ea6ab7cee9a66b50d897b0975abfea06409ba07c176d5628b8c4a3104", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647442995, "uuid": "8df15469-97c9-437a-8468-6bf688b29cb7", "comment": "Malware payload (Heodo)", "value": "021936e0ffa9d1a980b62b93d47d29168bcaea2f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647442995, "uuid": "ce31a9b0-9ba8-4e1a-ad66-ec5be8a8f36f", "comment": "Malware payload (Heodo)", "value": "ab27a42d3a7b25771534fdd1599b2c5ef104c8c371637eb327391d1ba565035c983f99330503a1befd8901ca97863fc0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647442995, "uuid": "26260ef8-550e-4f99-8b17-8020590af99f", "value": "T13AE47C12F461B2B9D04B04741F1723A86EEF5E518629CA13AFA8ED5E1F31251FC3FA16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647442995, "uuid": "598122e7-2eb0-4b34-ab5e-0f0a9a4043c7", "value": "066d4e2c6288c042d958ddc93cfa07f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647442995, "uuid": "0291e8e9-b6c1-4956-9eeb-cc6fc3f065cd", "value": "12288:DtAanana8Meee0GBGu3qI+3DNJ3vE6v5eRxS332d7t5hT/hexLx:Kanana8qGBGuoNxEHxCM7o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647442995, "uuid": "4da683b2-faf7-4d50-9a41-3d731b193154", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647442995, "uuid": "1c1169fe-8d42-4fb9-bf9b-c20a58c655e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647442995, "uuid": "ee39b065-ea38-416f-9a25-0b8d4fc32cae", "value": "a93fa122f3ea8c9f23eec6a2c0522937", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bf4ad28-a56b-11ec-9275-42010a9c0029", "comment": "Malware payload (BlackCat)", "timestamp": 1647464025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647464025, "uuid": "4a5c9b8a-8e32-449f-a83d-f686d5fe28a2", "comment": "Malware payload (BlackCat)", "value": "701b4b004eecb69046c210237846d46d", "object_relation": "md5", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647464025, "uuid": "a7975ba9-a213-4a86-96d0-f19246b3bdac", "comment": "Malware payload (BlackCat)", "value": "6dd995d896a9a593b2c48d09da60bd83866d8577273f36d38788d83ad8173e68", "object_relation": "sha256", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647464025, "uuid": "4039d5a9-5298-4b49-a562-92db60a696a2", "comment": "Malware payload (BlackCat)", "value": "8c70191b12f14eed594388c8fbe05efe6ebaa564", "object_relation": "sha1", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647464025, "uuid": "5330fbe0-2cd4-4b62-ae13-8a0995a1bd98", "comment": "Malware payload (BlackCat)", "value": "41daffb23d53dae0bd9e82c310b1e9033f3e4c4c676a58c15846ac08e0385133084d8130561dfb838fbb533ec21af5b6", "object_relation": "sha3-384", "Tag": [ { "name": "blackcat", "colour": "#AE994E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647464025, "uuid": "3ee6df61-e25f-4aad-8124-cef33cc701e5", "value": "T10CE5AF95FB43E2ADED6B18B0305EB33ADE34481C00199FA3DBE45D71B92EB115E4861E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647464025, "uuid": "09a6a8e2-cec7-43db-9258-53e5e48a3261", "value": "b995e2d96ad0643b2e68e3050c3eafef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647464025, "uuid": "dcbcc1c9-3f2b-44aa-a0e4-22e1baedb9f0", "value": "49152:OQMStZChL9rV/HFHVnR3/sTUfCgUdbdNALjnzVghyW9itX6e/7SM:HghLfH1xR3/ZqgL3mtitX6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647464025, "uuid": "e1b9fccb-88f4-4ce1-b8a3-561ce9747657", "value": 3077632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647464025, "uuid": "62a14462-ecc1-46ff-8aa5-2e131743c374", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647464025, "uuid": "8c3001ce-4987-4856-8a24-622a508ddec8", "value": "6dd995d896a9a593b2c48d09da60bd83866d8577273f36d38788d83ad8173e68", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff40dafd-a4fd-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647417135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417135, "uuid": "88a1be9c-60ac-4ca4-92c1-e4e4f337c745", "comment": "Malware payload (Heodo)", "value": "c1c13e4b355b919558d15a58be810530", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417135, "uuid": "a0df298f-bb05-4c69-b28c-667f7f763a97", "comment": "Malware payload (Heodo)", "value": "6e7a613ad749154e2c8169ef8d95be911e266a6d24083e8237ab55db5a4f35b0", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417135, "uuid": "211bdd92-708e-44b2-9b0f-6d64f29e8af8", "comment": "Malware payload (Heodo)", "value": "51ca330113308da57bd7ef8c93bbe1f590ac89fe", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417135, "uuid": "c34b8526-a9e4-45b6-b41c-233616feadf2", "comment": "Malware payload (Heodo)", "value": "00566a0500849f0939aaca8bacbaf0ee057fe8f30fe66e61a892b5b484169aff23eb33f65547e2fc400e26e2cf9a4836", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417135, "uuid": "008244b9-cc96-456c-a654-29fd0590f14c", "value": "T13DF2CF2DA3A0EF5ED61DED38849881EA421579154506EB4FA85CEB0D6F493C33B1F0DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417135, "uuid": "43f5e94e-612f-42c5-b8d0-ee4ba5132311", "value": "768:ojFhNKbeXizXT2LxdFfPdkqstJ1goE6vS:oBTGeXgXUndkqegoE6vS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647417135, "uuid": "551a314c-30df-45ce-b219-322ebee0433b", "value": 34391, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647417135, "uuid": "18034882-275b-4737-9224-678f320a9a10", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417135, "uuid": "2be3d34e-9cf0-453f-8867-36e24d87ce84", "value": "P72697815218_202203161054.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21770f33-a532-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647439527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647439527, "uuid": "f014d9fe-7dbb-4c0c-a8f2-90dd0156a41d", "comment": "Malware payload (RedLineStealer)", "value": "55660d41c1b83e5ffff09d8355b55209", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647439527, "uuid": "257b6803-eb39-4711-8699-20786bdbacdd", "comment": "Malware payload (RedLineStealer)", "value": "6ecc7de3bd2ed51805c471b6ffe60dd70f4ea1b5fcd0cd0fc2187eb0767fb8e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647439527, "uuid": "e623aead-309a-44b8-8d72-d0c4e75218d6", "comment": "Malware payload (RedLineStealer)", "value": "55a5e7d75cd8d7dc56d398b80faf566bdd28964f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647439527, "uuid": "572b72d0-db12-4cbc-9150-1008e9bbc6a9", "comment": "Malware payload (RedLineStealer)", "value": "d50cd7b81480ca37618e6ecdf9822d8d5e5ee4c3a4a38fe0c7ee4228f2bf95338bcca7d3df34925f873f90645401a896", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647439527, "uuid": "0c2496f7-c5bc-46ac-a1d0-69cd1e1a5951", "value": "T11C44AE2D3AB0C432D5A359744874EAF06E3BBC226B76C17B774817EE5F322805A26357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647439527, "uuid": "4c262665-44cc-472f-b540-98891d569ca8", "value": "d9430a21caf8f698e2680c3051417cb9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647439527, "uuid": "d0238c7e-52ec-4dc7-9287-16f3c9224c86", "value": "1536:AQfhtfRJKo5L/nQmWP4kGizqFfbyJyhsBrkauOCFDnLUa97CyUdahsJs:AQfhNLphiqpOyhCOOCFDLN97zhsi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647439527, "uuid": "034580eb-a494-4893-bcd8-d473066ce859", "value": 272896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647439527, "uuid": "e5d7a224-266c-4c31-8f13-c6a58949a949", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647439527, "uuid": "3e595c86-0f07-4c66-98aa-3da49bddcb2c", "value": "6ECC7DE3BD2ED51805C471B6FFE60DD70F4EA1B5FCD0C.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c296a52a-a537-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647441944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647441944, "uuid": "3e0069ba-f181-411d-ba18-ede8df12da18", "comment": "Malware payload (Formbook)", "value": "12219c4fabbdd80d75841e2e6f5dd223", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647441944, "uuid": "a5237a46-58c9-49e4-95a0-234dd39c028c", "comment": "Malware payload (Formbook)", "value": "6f5316d545b70fb89c16a62a2b8abb39da24fcd983d274e7069db39344ec36be", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647441944, "uuid": "e52398a7-5496-4867-9796-dbda631198da", "comment": "Malware payload (Formbook)", "value": "be194b42c77dff30497e64c5054f5d1fa3b8e4a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647441944, "uuid": "5d9aee87-0087-4770-9a60-3eccb91179d9", "comment": "Malware payload (Formbook)", "value": "0f842c4f0775cd98279e62a7cf1eab0c5f98b29a587c4f960a676c1dafc52b398d8c519108c4618aee90fb6372c9194c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647441944, "uuid": "a995b137-2950-4ead-aae6-34e9890aed88", "value": "T15E159D1577D50607DA0BFDF60B73C515EAA2E963BF10E6032D807568BF272100AEAD7A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647441944, "uuid": "95d61061-ad23-40ae-a80a-bc3d8b2c7ee2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647441944, "uuid": "718679e5-5364-48d1-830d-85c4823ab9ad", "value": "12288:X0q2fCfCACgwnyAVEnz6ii/EmP3NZ3N/TWZFOr/sa+ROUxmNm+aHtUeKl82pxkiR:/2fC6Ayy4/hP3p+cWKIUeKRpxkiR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647441944, "uuid": "7c9d5295-116d-4804-b344-55551f81e7ea", "value": 918016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647441944, "uuid": "0a984ebb-5817-44cb-8c75-3c67e7969c21", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647441944, "uuid": "d0b92765-05c0-4c38-a30e-cad97fda5b38", "value": "COMPANY_PROFILE and ORDER_LIST.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "745e6f1c-a56c-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1647464576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647464576, "uuid": "ba24d389-700b-4b73-87c0-b42151277bde", "comment": "Malware payload (Loki)", "value": "af68fc384e9583b964be68e7f4883a92", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647464576, "uuid": "9eb02262-1373-4e98-8eef-3ab94c7b4632", "comment": "Malware payload (Loki)", "value": "6fbb45194d26be852fa147ca1bbbda6e9eb11cce98e890507b495928e2b2f4c5", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647464576, "uuid": "dd81a5b5-fd8b-4998-8c24-99e26281ac3b", "comment": "Malware payload (Loki)", "value": "620cedd3c0e6ab2b46e5fbe90b16316b638d7759", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647464576, "uuid": "b40f27d9-dcfe-44c1-91fd-adfebb6f5e3f", "comment": "Malware payload (Loki)", "value": "8233f85c3fde5dd0e910e621545cdc577f60522d8b8a653da332bc944008cfc7dba8670a27972cd61704bbc3b9d3223d", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647464576, "uuid": "52d19fe9-7e8d-4a1c-9b6f-ec2f5b3fa374", "value": "T10A14126D3999D60CCE2C727E7B162F29921ADC337D253D0B2146717A8EF1B11843EA4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647464576, "uuid": "500015ae-2128-4d1f-8956-7d1bc3392af5", "value": "3072:JgwJCS+gSKDceoU/IGuOk4mi7dLPMU1MvrlphP3ZWIsVAckkYcXtBmADL6JgZwRq:KwJp+gR4aIB497xkBzlX0IsVzDdhL6Jc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647464576, "uuid": "a309ed26-a07d-47c4-85a3-4f28b750dfdb", "value": 191288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647464576, "uuid": "3def1728-f5f8-4fc9-b584-d7e607e9dfab", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647464576, "uuid": "72772dff-e7c0-4a60-a265-3fc311f9dfc1", "value": "SOA SLIP.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "511ddbb8-a508-11ec-9275-42010a9c0029", "comment": "Malware payload (AZORult)", "timestamp": 1647421568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647421568, "uuid": "aa667a82-6c96-46cd-954e-50afd12c4825", "comment": "Malware payload (AZORult)", "value": "3b753f760f97b526392a2d7cd2f034b8", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647421568, "uuid": "b3464681-406f-44fd-8c6b-630e503a8f0a", "comment": "Malware payload (AZORult)", "value": "6fd11b4a09db2c2713edbe0bb7536402e7e7bf0255ed7b80c6dc4d934938e327", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647421568, "uuid": "4dd6cc91-fa2b-4572-a10c-63657bcfdb2b", "comment": "Malware payload (AZORult)", "value": "c746419307c55d44f9b7341efcaaa4ac1ee6e7dc", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647421568, "uuid": "94eb0cda-9c8f-4731-a983-5533fc159601", "comment": "Malware payload (AZORult)", "value": "669c7acc9a17d1be6940bdf43a2ecdd65411633b87c0f98c517fbdfd47b3422f3fe4f4c983d4253476276e2ae5e1f7c6", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647421568, "uuid": "5922abca-9929-48ca-bb4e-4d54dc3d11b9", "value": "T163F4F1EA318C8B53EC25D3BDAABA951607B5BD659126E20A5CC63CC730B6FCD1409F07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647421568, "uuid": "86a9dd33-9c59-4872-ac62-bd9ffbd4f78e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647421568, "uuid": "04f09209-8229-4993-8978-6830c654369b", "value": "12288:9IuwOEFgJGj51HzsH5AM3QJdZeSueVH++7kCL7tki:6uwOQvXxTeSuEHMQh9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647421568, "uuid": "86706026-36a3-4b7f-9303-7c97782b6940", "value": 723456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647421568, "uuid": "243334ac-3b0b-432e-946c-99dc1590f353", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647421568, "uuid": "e296a828-3599-48b2-8876-a1dabcfbbc12", "value": "3b753f760f97b526392a2d7cd2f034b8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4faaebce-a56b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647464085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647464085, "uuid": "adade705-9c6c-4cba-85e8-446b5d240bb6", "comment": "Malware payload (Heodo)", "value": "b9a666feeea0f4f2d0c002e2d4800af3", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647464085, "uuid": "4de1ff06-a953-40ca-bbfa-6b24e8742fa5", "comment": "Malware payload (Heodo)", "value": "7131c053b13f69deabaa437e857c88dd3d17552c62cd26b035d81fd7683f72c1", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647464085, "uuid": "dc6857e5-9a9b-4d90-a82e-a471af6ab945", "comment": "Malware payload (Heodo)", "value": "4e9e0a378c56eb5dc06a42fafb6a043bfc4d7315", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647464085, "uuid": "b1e41a7e-240a-486d-a3aa-ad32a97b4731", "comment": "Malware payload (Heodo)", "value": "ee3a5289d08772b7c767ee7e12c23eff1e73b297af6f969621b1676fd064b5f7a397bac5a0ea1d0782c520f84fc0d6bb", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647464085, "uuid": "08c0dd8d-7e31-4396-9135-f188a69d79cf", "value": "T1C0F4DF1176E1C076C1BF12304956A38D23FAFD509FB986976FD02A6E3EB41828E34767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647464085, "uuid": "ae48d6a8-fe5b-44cb-967b-862248f54d3a", "value": "66a21a1bcb4077b3ed89c00ee693486b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647464085, "uuid": "8d518037-f17b-43a2-a06b-51769a7cd125", "value": "12288:g6O4TpP0XjxCCFJuf07j+Xk7hc8rLneTfABCJoWRWwfpW:BeCCF88j+Xt8OTYA7pW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647464085, "uuid": "a46a84d8-d5a1-41a2-895f-3a19b835c07f", "value": 749568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647464085, "uuid": "80adfb9d-a013-45f0-8b09-62f5783f37fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647464085, "uuid": "90960fa0-ec76-40eb-a830-ccbc9946419d", "value": "b9a666feeea0f4f2d0c002e2d4800af3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffaf07d1-a568-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647463092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647463092, "uuid": "f3ea64fb-8b79-4d15-ae6f-bcbd2da6bbb0", "comment": "Malware payload (Heodo)", "value": "b05147657ff1b4cb86c6be3275706a56", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647463092, "uuid": "042d2aa0-25ca-4b82-9697-2fb17a729e42", "comment": "Malware payload (Heodo)", "value": "7136539ed293d2a8c5acef37c880ad55b14368369ee746e6b634bbf0a4311958", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647463092, "uuid": "34568a57-d9df-44d2-bb3f-aded9a905b4e", "comment": "Malware payload (Heodo)", "value": "bf5fb75fc0afde977238155e24b7abc729506c74", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647463092, "uuid": "afe38f63-9ceb-4f0c-9842-b4f0ad9bc88b", "comment": "Malware payload (Heodo)", "value": "a821cf94d233bdf507455d537bfa87bf9686b60ecb88c8abb5f4d3930e9cb847840f0c1eaaaeb5f49db03bc3bb3bd4ed", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647463092, "uuid": "08179b1f-d6f5-4a6a-91d0-9bdc9a9e73f4", "value": "T164A2AF2CA521B80DE37A683C830640FAD64F5D023147B59D38A0BB6D5B7769706CFAAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647463092, "uuid": "6c7103cf-a3f0-400a-8224-7967f835c864", "value": "384:yyuAi/NjwS8EibbwBlwHSYrLb5CzgObff9kC+xbX7o1vfD:hsNyzXTFCBn9kC+xbLoN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647463092, "uuid": "a3291a04-fc8a-4503-93a8-794692eac477", "value": 21628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647463092, "uuid": "66d4b6c7-83af-4ae4-9883-6a1bd264e51f", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647463092, "uuid": "3756d5ea-bbd8-4058-a079-17ede28b9bc5", "value": "RechnungScan 2022.16.03_1645.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a4aadc4-a54f-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647451997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647451997, "uuid": "3bdd07e2-503e-40df-b850-c7abd1773e3e", "comment": "Malware payload (Heodo)", "value": "b5c666f6f0f40e0e42bfb7f0d7692b03", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647451997, "uuid": "5efba1ff-3515-404d-bff6-5209ef4372fb", "comment": "Malware payload (Heodo)", "value": "71cd13bddb8a686493e1fd4859d8491082fd33e14a5b1dcc83c691746bb920a1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647451997, "uuid": "e8ff8fc4-45e1-4a90-864c-54c5f2765f67", "comment": "Malware payload (Heodo)", "value": "75bba4abeab408824461a8d73dbfd31bfa5a8b77", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647451997, "uuid": "7d237b2d-0565-4c72-a08b-4ca5b551abdd", "comment": "Malware payload (Heodo)", "value": "4fc17cdc34086172c438b65116598cec96285793974581bd07cfe8d0337d32d3331ba473ed7c0a4926a6322c60a1bfd6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647451997, "uuid": "0fdae3dd-1ab4-4c72-8527-8cdbe3b2e8d5", "value": "T1AAF4CF11B2D1C076C1BF06741916A35D63F6FD608BB9878B6FD02FAE3EB45828A34356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647451997, "uuid": "32a82db8-7590-40ca-b609-8e78aa696fd1", "value": "66a21a1bcb4077b3ed89c00ee693486b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647451997, "uuid": "ef5ccbbe-9341-471a-b698-363c7aa4e718", "value": "12288:WZjb8BOPxue5dKV9M/98f0koPwXvkgKtuBdfMAofD:WCBAdKV9Xf0kH3KMBdkAofD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647451997, "uuid": "5e1a2e1a-d052-4818-a154-99cb3e20a733", "value": 753664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647451997, "uuid": "53e7b476-7cfb-4e60-8c81-c2471bdd332b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647451997, "uuid": "c14944dd-4e54-42a8-bca8-68d51d209046", "value": "b5c666f6f0f40e0e42bfb7f0d7692b03", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32030f42-a531-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647439125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647439125, "uuid": "143160db-8885-4311-96a4-d90aa015744e", "comment": "Malware payload (AgentTesla)", "value": "6d1d3f2fc97b58b4707e6cb781303506", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647439125, "uuid": "8ef06ec3-b68a-499e-9b84-4660cfcba6c3", "comment": "Malware payload (AgentTesla)", "value": "71d865a2b9c10ab567febdc1aef99b830ffff0bee70e1783cb24e07fbcde683d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647439125, "uuid": "e5299b57-2e31-4c5b-97da-d5bf12bca685", "comment": "Malware payload (AgentTesla)", "value": "66518de5c65d7aa3812225c79a92d175743c97d8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647439125, "uuid": "bae183ef-5426-4fd9-9802-da84c99c34eb", "comment": "Malware payload (AgentTesla)", "value": "c219ccc9e7f5b89dd7e8cde25b520948ce75a8f1cb9445f7c94504aec42a84e9fc2ea936e1711d38c995a06627c3257a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647439125, "uuid": "54e4afd1-3693-4232-ba9c-ab223ee10146", "value": "T1C4241A1A6714D551CB5F417FC016821831F1EB07A72AD38F59A2D8FA1F822CEF92B8E5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647439125, "uuid": "b4b6c504-13db-4b56-a3e0-5e139ac95039", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647439125, "uuid": "b0d8602b-5168-4e41-97bf-60ed78c62e53", "value": "3072:WdGVMpxgJl11JDfd3MMPSIdfv8N9wXUawO4Lv+WXmlLXu3PkvElBAjy4Yh9tgkNx:mnEdsgUaUvP6e/kO4YRzbsSDxU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647439125, "uuid": "f36e1ad8-2a57-49de-8d0b-4782a23ea87a", "value": 221696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647439125, "uuid": "4481f2bc-9528-456f-a759-082748828ee6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647439125, "uuid": "7213eb6d-e03d-4c6a-8df8-8450770b995d", "value": "BANK slip.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f379341e-a4fe-11ec-9275-42010a9c0029", "comment": "Malware payload (Smoke Loader)", "timestamp": 1647417545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417545, "uuid": "2153898b-58bb-42e0-8eee-d04608042195", "comment": "Malware payload (Smoke Loader)", "value": "4b23667c0764fe7ecd0171b1eec76e32", "object_relation": "md5", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417545, "uuid": "e22f00c6-6123-4b89-b7cc-92127d0b0651", "comment": "Malware payload (Smoke Loader)", "value": "725ef7921a3bbdcdaab5c323e98a7117e98dc77ec8867d08be590645beffd0ae", "object_relation": "sha256", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417545, "uuid": "b8370d3c-e6bb-475a-b3f5-b49ea3989cfd", "comment": "Malware payload (Smoke Loader)", "value": "a21410605b8fa028552c5ab914fa0bea7b59cacf", "object_relation": "sha1", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417545, "uuid": "05de5d03-9704-4d2b-91eb-063477197c6c", "comment": "Malware payload (Smoke Loader)", "value": "28421b8cc6436e5f47d0bbf416b13fd36343d680ebd72570116f7f687cc174a56feb8de4cd543da2f072c7dcb67663a3", "object_relation": "sha3-384", "Tag": [ { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417545, "uuid": "e4a9d513-a89e-421a-a818-2312d3a336c2", "value": "T164C4AE57F6E77A65E6AFC1BAC6B1C92D62B3309612B0C3CE774055492D22392483DB0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417545, "uuid": "b908c82e-958a-42ad-b23b-efd5153de601", "value": "f20a8db3e4a8c03c1ab177b2660fdd78", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417545, "uuid": "539e268a-0d2a-4269-83ff-bfff278f830d", "value": "12288:qzLjlZHAt+AZrkOCH8bzbBSrejOi1uWD242S6+4z:qzLhltAdkjcX1CDWeS6Zz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647417545, "uuid": "c3570006-e8fd-4d5f-8a9f-df4e7e61d18b", "value": 580096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647417545, "uuid": "e4ec66db-d610-4740-93d1-6e29acccbbde", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417545, "uuid": "4af646bf-25e6-49dc-a324-9d4dfd1b9276", "value": "Statement - February 2022.xll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f53e6268-a568-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647463075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647463075, "uuid": "a2758ed5-07cc-40e6-950a-f13c6022366d", "comment": "Malware payload (Heodo)", "value": "081279fc0847ee199c3aa30436729149", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647463075, "uuid": "6682e3a6-0e0f-4fc3-a924-2540c210cf65", "comment": "Malware payload (Heodo)", "value": "727c65d5c661da04bed64f0a4dfd0fd51cabed420e4f15be5aa308effe60f00a", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647463075, "uuid": "67540199-94eb-4f45-8475-2db2462d4e85", "comment": "Malware payload (Heodo)", "value": "a04b9f47bf92af525b453bbc6bcd26ed9def3db4", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647463075, "uuid": "78793ead-48c3-497a-a577-3faa26a8e7c5", "comment": "Malware payload (Heodo)", "value": "c48509e6add75f2fc2dfe3c99ca181d0144c4af9aec4841809138a3f474a4c8cd736b2ccc99a269841064e1b16be3ca4", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647463075, "uuid": "ea06460f-4992-45f4-9318-857d90973d53", "value": "T164E2C02DF3A0EB1DC219D939446981DA420A74258506EB8FB95CFB1D1F4A6C2770F09E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647463075, "uuid": "792de03d-d0d2-46cd-8a25-ea5ec1e5a134", "value": "384:QjxzKpZPFhNjHEBOA7iEibbwBLg0SCdiVZKgUrNU/qWhZOdBNPJM+kqr9eCgh0kB:Qj1uFhNClizXT2tdFfPdkqstJOE6K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647463075, "uuid": "ea2741a5-c638-4fe0-b654-addb5e564acc", "value": 33745, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647463075, "uuid": "780e4a00-bee6-4da1-95a6-032086f917aa", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647463075, "uuid": "17e2eed0-e6bd-4b1e-a665-2cb4dbe22919", "value": "Datos 514.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cf34dfd-a4bc-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647389053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647389053, "uuid": "22f6cf20-e3ad-4b4a-a682-dfeaf8f914e4", "comment": "Malware payload (Heodo)", "value": "7b44e12d7bd184e5007e17dba2d23759", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647389053, "uuid": "e8c63754-50a7-4acb-9352-0d583c231f0c", "comment": "Malware payload (Heodo)", "value": "728addb1e70f807e6dee45078511b77b977e1a04892d532ceebc4be49c5de763", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647389053, "uuid": "f0979196-3216-4556-b196-21279871b769", "comment": "Malware payload (Heodo)", "value": "02f6f4df0bb619bd1adbe32fc7245d31377280d5", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647389053, "uuid": "fd422e08-e9c4-4671-9eae-0adf474cbe95", "comment": "Malware payload (Heodo)", "value": "e3bd99df3718215d75d98ff02a99688aadca7aa4b79f55a0154807ec04530452ab7344252dc6e9a71979e0f4c5a6eb34", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647389053, "uuid": "6f4a7290-3ef4-4843-9905-6f90b0565b84", "value": "T152E46B0124A29C71C3E7C9756BD91E1539EAEA92CFF7800BBAE06B7CD874942C337516", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647389053, "uuid": "df59f93b-6490-48bd-9ce7-8dcb7b9e707d", "value": "a38617efee413c2d5919637769ddb6a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647389053, "uuid": "1ef2407c-5d5b-4e47-bea1-99f391f0b70c", "value": "12288:KFxGsTPy4BHT4Sj1zfFf7ABqDLkWynCsZ:obPy44Y15f7VDLkNnh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647389053, "uuid": "e3b879cf-64c6-4994-a6f4-0bf9af4cc0b4", "value": 704512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647389053, "uuid": "f98cb644-8fb2-4637-933f-e0eb6cc2842e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647389053, "uuid": "60148655-ebb3-4a8a-854d-c91b312bd3b8", "value": "emotet_exe_e4_728addb1e70f807e6dee45078511b77b977e1a04892d532ceebc4be49c5de763_2022-03-16__000408.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44e3637e-a4fd-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647416823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416823, "uuid": "1dfe3846-64c4-4e06-951e-9f53fd380b7b", "comment": "Malware payload", "value": "ed6ecd3622aba6662cf6041cb50a80ed", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416823, "uuid": "9b6c44a3-4e47-4011-8ae0-9a3d3a7035f2", "comment": "Malware payload", "value": "729ef9f8389551c4bf33347905d8f7bfbd1d505426a9e8cbbda9481243cfe116", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416823, "uuid": "c4999333-82d7-400d-bec7-1b438a20eaa1", "comment": "Malware payload", "value": "86564f9c33d25cba177c4432187ea7c0599023bf", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416823, "uuid": "b7018aa7-8f61-4a20-8d0e-a8c4367eaa7c", "comment": "Malware payload", "value": "ce1181a9341b1320073454c98024e3883b87f3347091cf7ef50cdb6e6a8ec4cf4cf1a3eae4de3f2f47b45552791aa9c8", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416823, "uuid": "b764df3e-0098-480c-9981-fee3fef37b9c", "value": "T12614124E7B79AF45C1A5F3F69DBCDB4D33268F82DF4481661868F91009B2B929434F18", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416823, "uuid": "18fd2f4a-d7eb-4659-8066-cebcef6d6781", "value": "3072:Zug9vKHVpyr+IfBrJlmcZ/CurfSRTa05bnfmuNvAR58XHEAjlOybK2OUa3krpJV:EgU1w/fBrrmcRdST5bucq8XkApN9blX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647416823, "uuid": "df82bef7-b229-438f-a664-f5e304da1fb7", "value": 191000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647416823, "uuid": "07b130a5-5e17-4421-b869-6d0b09efd179", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416823, "uuid": "f22a54bf-3b54-4073-8127-914360470def", "value": "sample.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad658751-a4fd-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647416998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416998, "uuid": "b92c433c-56e1-4ea7-8d64-d3fb2aae3e46", "comment": "Malware payload", "value": "64bc09409d551b8731f3c670416fc5fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416998, "uuid": "f89ff844-a100-480f-98f6-1f151d8069ac", "comment": "Malware payload", "value": "731355759034e0ae5cff6011792f40d5154dccd99fac792da878777bbc532ce2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416998, "uuid": "5954d323-23ff-4976-bf0c-4abe5469d9db", "comment": "Malware payload", "value": "18f981929ba72e9ce719a404df7b584b54f4492b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416998, "uuid": "882e1e94-bbc6-470f-9d72-4fa5ccb1751c", "comment": "Malware payload", "value": "9b96149e1a071bbdf47378da7766b80191d8fa7535311377647a079551c8bfb77e2be8036458a93b7e5af1186c36a16a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416998, "uuid": "93182017-5543-4bde-b132-c26d933f302d", "value": "T10A05125833EC8F93EABE4D37E9A5841557F2F9767523D70D1AA428FA0A93B5085003CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416998, "uuid": "a3214886-9e5b-4b5b-82c2-ddc36dc4e719", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416998, "uuid": "62578d53-e417-43b7-9913-3d99a5906c60", "value": "12288:5rzh7CwOEF0+Kw6cG8i/kralSSX008Z3+UDWvKwg3z+qOeNCvHXqLFkKUuttpQww:RdCwOwnZG7olc00GVAKaVMAww", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647416998, "uuid": "a785d7b7-ffb0-4558-819d-5c1c975c957d", "value": 797184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647416998, "uuid": "d847d942-58e4-49be-8784-4c95458807e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416998, "uuid": "0ef5d5f9-da0f-40dc-85d3-da7706649365", "value": "CITA_45893216_33661100.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "101bcf05-a52e-11ec-9275-42010a9c0029", "comment": "Malware payload (njrat)", "timestamp": 1647437779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647437779, "uuid": "309f41f1-65d4-4a84-a318-e9eedc5c8254", "comment": "Malware payload (njrat)", "value": "405379647bc8e3416804105d72fffd34", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647437779, "uuid": "386f540d-5182-414c-af43-98039fd9579f", "comment": "Malware payload (njrat)", "value": "73489b558cbcf01f2bda533f372c0dfed9c225f789b17a109b76a52b99413fb0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647437779, "uuid": "ccd407fe-c2e1-44d5-8f04-e9c49102d4c1", "comment": "Malware payload (njrat)", "value": "4d0192bb0605c25e52909bbd23ca72207ac6754b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647437779, "uuid": "078aedaa-cd12-4768-a0dd-8fab72d9626e", "comment": "Malware payload (njrat)", "value": "380cfc29065a149ccc7329c11861e2b7839cd632678e4f17e8f9cc0e773851e5fe74b98bc1387791e37c9d05ec3d1f95", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647437779, "uuid": "fe550f52-d1b2-41e8-85e7-50c4e40214b2", "value": "T10DB58A5D95061372C2DC213C87E569EC02FC9B823177A95E6B6EF98A2371FDBD00AB11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647437779, "uuid": "495d7692-1388-4508-ba68-d1f778397045", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647437779, "uuid": "2396dcb0-1a9a-4717-bd06-a8c4650a721e", "value": "49152:Qt+3GQqzpZCwESvFUUoIvQ9QPyYhk1kTZfpK:QtMI3CwT9UUo59KyYKIZfpK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647437779, "uuid": "28290f83-dc9c-4ea9-ad5a-672630c7b85b", "value": 2275328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647437779, "uuid": "44e03537-d50d-45d5-8c96-2a2b6d995dba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647437779, "uuid": "51433cbb-4206-4b53-ae3c-26a111a671eb", "value": "73489B558CBCF01F2BDA533F372C0DFED9C225F789B17.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75aec48e-a50d-11ec-9275-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1647423776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647423776, "uuid": "f67fbbee-8e27-4b5f-ba87-6a1b0cfaee82", "comment": "Malware payload (Quakbot)", "value": "7f26b75d77d6f0c0f20c6b61ca47857f", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647423776, "uuid": "a86fe373-3da1-4eb0-aaf4-fa80a70e7442", "comment": "Malware payload (Quakbot)", "value": "735f7a4bed9f52384cf1f5ed2dbf6aef5081253bf39b978e24297508fa8cacad", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647423776, "uuid": "83575500-7e6e-472d-ad3c-fe69103737cb", "comment": "Malware payload (Quakbot)", "value": "750decc4831f0c84aa6500ac55e9e0d829f1912a", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647423776, "uuid": "bf5039eb-ae75-4bb9-bf35-1a26111a37fb", "comment": "Malware payload (Quakbot)", "value": "fdc73acd512c70c946ce23a1ea5d6f42a6e4e762d1737f07dce4afcf58abff2d867632b066c79a6efdf038fbd257d32f", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647423776, "uuid": "6d51693c-b971-4292-86dc-2f7e35c923cc", "value": "T179C3BE5BA0155F42D66946B4FF071DE81F01235EA8C2B6AE12562C8A3F663B32FCC35D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647423776, "uuid": "0f593335-76a1-4867-8980-a8c389ae49c5", "value": "3072:0Az2AAfDixLbLdbLwgmfMBs+KjHQzVZcNB:0uwbiQPEBs+KzQLcNB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647423776, "uuid": "35e4e093-444a-4526-a156-53e17b80fb9e", "value": 119977, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647423776, "uuid": "34f575fb-efc2-40f6-911f-3cd88342f407", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647423776, "uuid": "8a8893f9-3bbc-46f5-8de8-969449288d6a", "value": "REF-428208427-Mar-15.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8351e4b5-a4d6-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647400177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647400177, "uuid": "1695fee5-3312-432f-8ccb-da067102ba76", "comment": "Malware payload (Mirai)", "value": "a58b1a190c2685a0edb1918f7d1f5aaa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647400177, "uuid": "fd228fe4-b04e-4604-9226-497e53ba57fb", "comment": "Malware payload (Mirai)", "value": "7388d9ba19fb6ba4b58693d05c10e12b02216535f3ec56e2b8f15d4b7c24a070", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647400177, "uuid": "74e1551b-7aa1-4437-a557-822a92c08963", "comment": "Malware payload (Mirai)", "value": "58f433cde01cf04a98bd5c1e65a6d714acb10ca3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647400177, "uuid": "a8f31c79-6fda-423d-8557-2ce36a73a8bc", "comment": "Malware payload (Mirai)", "value": "4a20793496e99563fffcc8b6a8d5c2da7d6874e78822908ec0f9abba8517d9c28667919df0c0c31af545b0ab3abfee72", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647400177, "uuid": "07358dd9-acb6-47a7-be38-21442faf23eb", "value": "T1256329D6F8029E3DFC0EE67A94550E09FA7163D112830F2A67B7FDA36D720966D02D41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647400177, "uuid": "50b6d914-362b-4180-a96c-ac0c3c6674c3", "value": "1536:S6MsPpLDQxnFLVDdJBQzrMNoR5SFY9M/dJ8vNLZ:AJBQzoOPrMla1Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647400177, "uuid": "8283b205-34a8-47fb-8b4f-da5ee8c71d7b", "value": 69116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647400177, "uuid": "4a46f12d-bdce-4c9d-b3b0-86ab5f6ce0ee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647400177, "uuid": "281d4364-c85a-4a0b-8eaf-23b5b936f347", "value": "a58b1a190c2685a0edb1918f7d1f5aaa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "634a0178-a4d6-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647400123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647400123, "uuid": "60cfd6de-4e72-4466-a581-65b93a6a3ee2", "comment": "Malware payload (Mirai)", "value": "5a4ec717915cc1b8b7e655c8ea3da2da", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647400123, "uuid": "0c4abb96-cba5-4a29-b48b-6ce6c5143874", "comment": "Malware payload (Mirai)", "value": "7443e98ff4934e817ad5c8d26eb06dc8adc917f3052f033dde70aa8e54b18143", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647400123, "uuid": "18a0cd67-fa39-40c5-88bd-f14fa26f3f3d", "comment": "Malware payload (Mirai)", "value": "b94cc0cd334b756e07eae49729ef37b01948940e", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647400123, "uuid": "2c0be06f-90b7-4f18-b3f5-ea3d8ff00bfe", "comment": "Malware payload (Mirai)", "value": "b13246952f3d38ab5c856bdb762aaad798266be9a51d07c69d43dd65ed27b53f436251ea6634f88cec7d3eb8997c7298", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647400123, "uuid": "36e5bd05-c63b-404d-b0bf-bcc30467aaad", "value": "T1D0431917F94685FDC089C234177EBA3AE92331FE1229B26A67D4FB263DC6D611E09D04", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647400123, "uuid": "7a383689-065f-4b2e-b684-4877240fea8e", "value": "1536:1XIY73si3qEToSRhINBQ/K6C8u50pfEHwNLW:2Y7H6ETRhIw/Kn5qEHw1W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647400123, "uuid": "e9b115c2-696e-469a-ac8d-1d0dd7892e8f", "value": 58480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647400123, "uuid": "c965179a-600b-4f21-ae10-ca04e38a905b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647400123, "uuid": "825dd9f9-ce56-4aee-8486-1a953b08fa90", "value": "5a4ec717915cc1b8b7e655c8ea3da2da", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d437be0-a534-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647440459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647440459, "uuid": "1cb7b2ac-8f60-44aa-8c18-2bc58ea24181", "comment": "Malware payload (Mirai)", "value": "03f181eb7a8e282b67c7b27196d17f59", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647440459, "uuid": "c59815cc-2e1b-48dc-a044-2032da6e7f26", "comment": "Malware payload (Mirai)", "value": "74640e8b9cb096021592a769e1fff47156a9985717b476ceafb106026e3b94d9", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647440459, "uuid": "1533685e-7278-44bc-8484-dadf86b658d9", "comment": "Malware payload (Mirai)", "value": "9a13fe769e29f0ee89e4123d65dafa5e0eb07bb7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647440459, "uuid": "e7f0f648-91a9-4cb9-b06d-213c6254e922", "comment": "Malware payload (Mirai)", "value": "bb89bdd85a3a799c3ab3cabb30ac25357e69f08df8ee614ea009b0992cb010666f99ee523ad603b6c97274f069fa4cbd", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647440459, "uuid": "b37b9f51-2687-4f00-a8f4-8f7445403f0f", "value": "T18C130855BE8E9E09C5C00072FE3F4389BB26C3D8E1FABB174E15AB4829574661FDB409", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647440459, "uuid": "ce8b834b-e484-41e8-b20e-adff632f1534", "value": "768:T/SyyAmP2vMHvNgNBHSJU5NlUZyCQ8eqZpUYiFhUz:ufAGs9k0lUAhFqZuYifK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647440459, "uuid": "42de5e99-ca67-4ad2-9caa-57627abe3ecc", "value": 43980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647440459, "uuid": "d03f5e22-053f-4b79-8d64-b8bfd9eb2261", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647440459, "uuid": "07322463-e442-4851-8d12-cbe9851ec228", "value": "arm-20220316-1420", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ad8662d-a4fb-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647416027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416027, "uuid": "3c002e2d-6541-4bb9-abfd-54ece6019caf", "comment": "Malware payload (Heodo)", "value": "0ffbc836e5a60906c8cbebd877cb8c87", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416027, "uuid": "444342f2-641d-4114-a17f-42c363970b95", "comment": "Malware payload (Heodo)", "value": "746b02706449ae4b6d86c99ef07bf04228025a56d5d70a1255a840655aa53e1d", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416027, "uuid": "ca783bb6-9199-451d-9a30-a5ba84372777", "comment": "Malware payload (Heodo)", "value": "4ca44c47dace23538ff10018ad0a34d3497ffb1c", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416027, "uuid": "ada19f2f-7ae4-42e3-b2bc-e3337be8c4fb", "comment": "Malware payload (Heodo)", "value": "4d606c59ae15ed76f333d6ce805783b9a53f7c83bf632bd1266d3d749c40dce5289af4bdf3c5591013c7b1fb56aefe3c", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416027, "uuid": "e4241755-8105-4d4f-8c39-394c6af01124", "value": "T19AE2D01DF3A0EE69C61DDC3944A841EA425A74258506EB4FB99CFF1D2F067C2270F19E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416027, "uuid": "116985e8-9b97-4674-b012-e23f9e31d0fc", "value": "768:Qjf8WFhN7beEizXT2LxdFfPdkqstJVE6D:qEsTXrgXUndkq8E6D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647416027, "uuid": "edbb1abf-b3ee-420b-a592-485fe4ed0529", "value": 33737, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647416027, "uuid": "845a0961-c667-4674-a312-a242e142e5fb", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416027, "uuid": "810651c8-b7c8-4fcd-bf8f-1dcd0d10ea2d", "value": "Contract - 2022-03-15_1727.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "823af604-a4fb-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647416067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416067, "uuid": "d5831391-ac2a-4824-9a0f-e33916ef2989", "comment": "Malware payload (Formbook)", "value": "57052a9240375f8eb1bef7c1d7be82f9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416067, "uuid": "7f05f726-cd06-4d9b-9560-7fdec7c97650", "comment": "Malware payload (Formbook)", "value": "747f948dea9afe0caf124dfbda7a3dad32851baf62d502ded5d6d0b560bca033", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416067, "uuid": "7d1329c3-102e-4ca2-a435-a14ccd976f5a", "comment": "Malware payload (Formbook)", "value": "39df92e18907dfa20cddadb88174d9d2242b6802", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416067, "uuid": "66ca1b3d-2aa4-48bc-9101-22df8687c928", "comment": "Malware payload (Formbook)", "value": "d94d88565c62e36b23aa1aa1c3e2c280ae27a5396ce42427d282b2ea4940ab6d4dded35086871b6cb66309170fc4e393", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416067, "uuid": "c73507f7-b01c-43ed-8215-1de5d2531148", "value": "T1EBF4131533E49B62D6BEEE37F4B0800A03B1F62B6951E74E4FD469FE16A7700856039B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416067, "uuid": "6b0ec05f-d7af-49b7-a0d5-fd17bf4ea8f4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416067, "uuid": "988b3664-ad1f-4f95-b555-7769a4776bb5", "value": "12288:BhKwOEFXPhNCHUT/SR1rhGJya/VvMILpE1tmplancDiyf4RQT+Y/zYgEP5q:jKwO8KHUTarhGJJ7q1tmpl1iyfuQT+Yv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647416067, "uuid": "064f95ec-7006-4b91-b174-e7e8211e2798", "value": 764928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647416067, "uuid": "9737a000-04cb-4542-8ccc-55a4a72416e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416067, "uuid": "33877186-42cd-4cdd-b1c0-81386d29125d", "value": "New Order 5902137.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b9bf6f0-a4ff-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647417800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417800, "uuid": "9f9975a9-86f0-4733-8bff-37130ca3d630", "comment": "Malware payload (Heodo)", "value": "22f0928570a5675b46c4d6cdb1b9d9b3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417800, "uuid": "e1ff636e-8e47-4c40-aae9-d999ab46d7df", "comment": "Malware payload (Heodo)", "value": "74871b63b97a223debee7e49b1e2d60b7b4d988ed6b8fb19909f1864e5b0c2a3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417800, "uuid": "722436b3-2e75-449c-a4ad-9659e56aced0", "comment": "Malware payload (Heodo)", "value": "07bb605e3dba45b829a3168806a5ec29fed2f45a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417800, "uuid": "b9686483-e0fc-4058-a1f6-5bcf789ebbe2", "comment": "Malware payload (Heodo)", "value": "21213a1d35b5c5caaa3eade5be7a9fe62c91cfe9d7f6aab451556c49bf2b957c75ab001459ea5f025c494744e1df0aee", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417800, "uuid": "a187d268-ca17-4530-a412-f5fbaef2ca63", "value": "T179E45B06AF22A1F0C06B03B40555125AC2EF7ED0A72ED657825DFB7EDD339973A30226", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417800, "uuid": "bb557996-3c7e-4b48-9b35-d10e1c7959b1", "value": "066d4e2c6288c042d958ddc93cfa07f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417800, "uuid": "4355c417-6a42-468a-bbc1-32b6a1df181a", "value": "12288:jc899XKPmN4WMkoZ6ZPJSFTdtXlcIL9v6O8:7GP7KgFTdFL9v6F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647417800, "uuid": "da0e0b6a-1117-4a5e-929c-32ae28ec0fb2", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647417800, "uuid": "f9e7a5e1-a8e4-4456-8201-5e135c770eee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417800, "uuid": "9261c01f-15e4-4f2f-a7e1-bd11ed5067c3", "value": "22f0928570a5675b46c4d6cdb1b9d9b3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f4c2bfb-a565-11ec-9275-42010a9c0029", "comment": "Malware payload (Hive)", "timestamp": 1647461561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647461561, "uuid": "1df20c78-cf20-4475-bc57-00d89dabdcbe", "comment": "Malware payload (Hive)", "value": "56069652e0a95bb25da5cad6ac8e070e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647461561, "uuid": "96109845-42f5-4dbb-94cf-0206670a2bec", "comment": "Malware payload (Hive)", "value": "74b45abc573e70827acfea4bba7a4b0e16cac7756e542c9bcaf3b8fb81394579", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647461561, "uuid": "b598e1c0-a40d-4f9c-a088-e706da2b02ea", "comment": "Malware payload (Hive)", "value": "bb5256404aad145063d7aaebb94a1eb655dc5d91", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647461561, "uuid": "0a9506fc-3d1a-415b-9ee5-3acff831163a", "comment": "Malware payload (Hive)", "value": "806fe6ed28f8b3d03bb5533a79dd7f41eda653fbedb64a1fa8a70aafda574bc773330a9c9c3a5d583fbb0f4afc91eb18", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647461561, "uuid": "96d6e90e-239a-4290-960d-010920c9f2d8", "value": "T10546332E588230B8B5A17D34232EF8E5860A39235ED738B10D4BC9DD897BDD2E6D1747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647461561, "uuid": "0e61891a-5d02-4332-9ebf-003f65cc1180", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647461561, "uuid": "9643ce9c-6a8f-4ced-960b-eb4011c607b2", "value": "98304:z08lQCAM/I+BZLfCL5SrgM62WJ/7PcRBwFXDbabmqKtvtmMmIi7zo76PE78OIKnC:z0p6bW6RWFzs41hmpoJ7kY69nz5RC2Zf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647461561, "uuid": "7913d2d0-b04e-4c4a-b103-8b4fb9b21949", "value": 5636608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647461561, "uuid": "29b7c1bd-0081-4f1a-953a-45f5975df56e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647461561, "uuid": "31077ccd-4d7e-42ce-85b6-19e953f8258d", "value": "10795314.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71381209-a4f5-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1647413461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647413461, "uuid": "62c89e8c-7c85-4c75-a2f5-801af16dd328", "comment": "Malware payload (Loki)", "value": "21b88a4eb16a39ad06c1d23bd05a15bf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647413461, "uuid": "b561f73a-0fb6-4e56-b3ed-c43b50416202", "comment": "Malware payload (Loki)", "value": "74c8bf494c768e73e7c656f976515e15466ab5921d63fe185a65510cf2db7627", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647413461, "uuid": "5fc44e26-945d-44b2-b4f2-c175dd840de3", "comment": "Malware payload (Loki)", "value": "623a8932a84f174326d4e72f82e4ebcbd9ace338", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647413461, "uuid": "33b932e9-6ae6-42f4-9a24-a92cb669e4af", "comment": "Malware payload (Loki)", "value": "e079944a4c4f2db81887e51bb33b5eaf8e9126e6f5f1ad7c0873fbad189d8d0319d1068d02277fac03e856382e2eca5a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647413461, "uuid": "cc24163a-276b-4962-ade2-5299db87e066", "value": "T1FB144C449E4C821CDE69F9B104B3D170CE79FF967A0CAA49D840F7DA3A3267146CDA35", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647413461, "uuid": "f25d519a-db2c-42b3-925e-3eecbfbd62be", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647413461, "uuid": "11ec9fa4-cb1f-4b12-b952-403bfe37b0c8", "value": "768:5L+TWO7VzvA9uq8P8z4ID3EE4jPYyIlITlt3y1HSxpTkVZ2fmLvU:2FVzvC4TE4jJTKlmUZ4mg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647413461, "uuid": "46dfc10d-d73a-4a6c-a597-b3acf03c140b", "value": 205312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647413461, "uuid": "4adba688-9c38-43b0-8c23-ec71003626db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647413461, "uuid": "c19a8127-b0a5-4529-82c5-14bc00845a4b", "value": "IMG-1078541090.scr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03d01ce3-a514-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647426592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647426592, "uuid": "03bf6c33-2839-46b2-9369-c3da25cbf658", "comment": "Malware payload", "value": "d7193cf779391f45f3c2b656a1419841", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647426592, "uuid": "f8278c13-8d30-4118-bfb7-3789ef22ea6f", "comment": "Malware payload", "value": "754c115e7eeba83ef460e862d43a6d602d047690432e6eb472c38a691eae5c9b", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647426592, "uuid": "a64fc7f3-af8b-4e0e-9deb-d0261b66bd63", "comment": "Malware payload", "value": "dad7fa8da2956be777e2bfb1bac26357e7c51c88", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647426592, "uuid": "a1b26115-7556-49a3-aa2b-9a8031174aa4", "comment": "Malware payload", "value": "176c84c4c101f1dc53301639899b4f5db90d0f168d9b3c27f98dc9908013a99df27d7f3539af52ae406d02641b138178", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647426592, "uuid": "76a77b37-0f51-4b99-a37b-27bec4f6c364", "value": "T1181402205772AA58F7F34A3ECF703DBB09566CC3A16620529297BF387A3383654246DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647426592, "uuid": "49eba9bd-b43b-45be-b6bf-376b01cfd8ba", "value": "3072:kCf/3Mem+7b66Vswz8uNGriBRz7FM08/zdBx5WrCSr2ni7juwCTnMMK05MPy+jsx:T/39H7+6GwFBRzex/zbWrCi2wjuPVr5h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647426592, "uuid": "0022dbf5-b3d4-4a6d-9ea6-aa2099268018", "value": 191208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647426592, "uuid": "ac47df29-8449-460e-8414-debd788f543d", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647426592, "uuid": "64892860-6ac6-4c34-93d2-5351c8a41a92", "value": "TT SWIFT.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6a00724-a500-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1647418356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647418356, "uuid": "ad9815c8-4968-4bcd-978c-7a70264546be", "comment": "Malware payload (Gafgyt)", "value": "69b0fe676b63a8b1fb32390c8088d991", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647418356, "uuid": "4b7051cf-e5ae-49ac-8457-3db0a6dc7c54", "comment": "Malware payload (Gafgyt)", "value": "7590dfa8b5c992f040b0f3bdf0c79414f56cf44f80b225879e342a1aa0b94764", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647418356, "uuid": "3d24722d-7c1b-406a-9b09-aa4e0cf9efe5", "comment": "Malware payload (Gafgyt)", "value": "ae1c00135758e69f91c95ee3239ee31c4c13f2fc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647418356, "uuid": "583cf24c-28a2-4e5e-916b-e5e939bc6ce1", "comment": "Malware payload (Gafgyt)", "value": "ad23661cb959c294747149c4f2352924a6ae3ff8026dc1c864da26324a0aeb7d14551c7836b801e1328aa50a1dd076a6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647418356, "uuid": "55871704-9d49-416a-afb1-1c7877703059", "value": "T101F2E1A18DF88ED4C42892BECCEF780E1835B74DDA5822246385571B4FF4F670C2AD69", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647418356, "uuid": "ff5f4996-893e-4d4a-9218-796c4bc2ef79", "value": "768:suXQRH6lLCbVWLC51vC+X2YEBKrN3gBK5GV/yVnbcuyD7Uiyqc:TXwuLCbVW+PvDX2eg9hsnouy8Zqc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647418356, "uuid": "eab660af-6942-47be-beb8-d9f1ccfbce48", "value": 34532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647418356, "uuid": "f3dff3c2-b430-402b-aa86-0eaa12c50efb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647418356, "uuid": "e839cd73-de87-418b-8790-21be820be431", "value": "69b0fe676b63a8b1fb32390c8088d991", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbe8c502-a55f-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647459113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647459113, "uuid": "5f7af91b-0672-4238-8c02-68b1d9177f7d", "comment": "Malware payload (Heodo)", "value": "568f156d9bfa25200d706ea1b035c640", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647459113, "uuid": "d2f72a5c-a7f9-4646-a791-18e48d6ee848", "comment": "Malware payload (Heodo)", "value": "75ff8380c2974b63fa699cfc0e704c208f98545421696e02c232db7d53ff0333", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647459113, "uuid": "c13a8b49-e4ba-4f8c-8101-4018b45d170e", "comment": "Malware payload (Heodo)", "value": "6d4381b185649654296d51722a8ef4574ffb9955", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647459113, "uuid": "1f23d9cc-bb87-4dc2-a955-4f03e602ded5", "comment": "Malware payload (Heodo)", "value": "6e61228b1a6c6e05db84629655612d9340769bdef25854fd1c9398fffcce1028e1b9618d0a3a5885df07d379b1368f58", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647459113, "uuid": "f659b52d-0bf4-4ac1-b18d-05b3590f0317", "value": "T17BF4DF1176E1C076C1BF12304956A38D23FAFD509FB986976FD02A6E3EB41828E34767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647459113, "uuid": "e9cea39d-8426-4dd7-a43d-5c0d074793be", "value": "66a21a1bcb4077b3ed89c00ee693486b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647459113, "uuid": "b4d37414-6ab6-4ccc-b266-3650690f1b87", "value": "12288:g6O4TpP0XjxCCFJuf07j+Xk7h+8rLneTfABCJoWRWwfpW:BeCCF88j+Xr8OTYA7pW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647459113, "uuid": "a938113e-06da-4c36-80a6-6f9e28e57754", "value": 749568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647459113, "uuid": "d6371580-5ee1-4f4c-b274-4dd15f2c2d88", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647459113, "uuid": "ac4a22e0-9934-4a73-afea-2ad374510e85", "value": "568f156d9bfa25200d706ea1b035c640", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01742f4f-a518-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647428306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647428306, "uuid": "4aba4a69-aa3f-4571-b72b-6db5becce96c", "comment": "Malware payload (Heodo)", "value": "1395417c9a3e37110ac63d906f26d0c9", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647428306, "uuid": "4ef61ebe-30da-4738-a0f9-b532ae5a91e2", "comment": "Malware payload (Heodo)", "value": "766cb4fddce9681ff36e4035654217fdcb03023770a55e320ae9dc50e993015b", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647428306, "uuid": "0855a774-dd6b-4393-bf05-a46e502eacac", "comment": "Malware payload (Heodo)", "value": "d7e86df8fe1de25be8e8af80c8c563e81bb1f140", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647428306, "uuid": "5b5b2a61-f5ad-4342-bf50-6a6c0eaa4646", "comment": "Malware payload (Heodo)", "value": "ef24853b708f4179949fe459ea7e1b0a2702800c63eaad739201e5e1eaa83ad7e44479878a07b576bea95a2013bead42", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647428306, "uuid": "77a6c870-9ff8-4e17-aad2-7464f6810386", "value": "T1BCF2CF2DA3A0EF5ED61DED38849881EA421579154506EB4FA85CEB0D6F493C33B1F0DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647428306, "uuid": "8a4c5142-9a6a-46a1-843b-00e7177aed46", "value": "768:IjFhNKbeXizXT2LxdFfPdkqstJ1goE6vS:IBTGeXgXUndkqegoE6vS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647428306, "uuid": "ba243197-516f-4495-8487-aa3ecf1a3bab", "value": 34391, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647428306, "uuid": "15c39843-8285-438f-9141-d19dc7fe9c03", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647428306, "uuid": "0f809c36-be81-4de0-b995-09d1b5063697", "value": "20220316_96447_002.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d8a7ff8-a56f-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647465746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647465746, "uuid": "985fe952-6b8d-45cf-8952-b84ce5386611", "comment": "Malware payload", "value": "61a27c06e7100be759a1ccc25bace734", "object_relation": "md5", "Tag": [ { "name": "Beacon", "colour": "#3CE751", "exportable": true, "hide_tag": false }, { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647465746, "uuid": "175119cb-8be8-4367-8009-7bb9235ac211", "comment": "Malware payload", "value": "770ac3a90a0c3975889907c03120e836400da7109aa544e475bb6351e6f2fd19", "object_relation": "sha256", "Tag": [ { "name": "Beacon", "colour": "#3CE751", "exportable": true, "hide_tag": false }, { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647465746, "uuid": "b5a2620a-8c9e-4c78-8a03-3c402bddbe54", "comment": "Malware payload", "value": "527a146e4a978ec4be2c30dfaacccbe727bd0557", "object_relation": "sha1", "Tag": [ { "name": "Beacon", "colour": "#3CE751", "exportable": true, "hide_tag": false }, { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647465746, "uuid": "b8a2094c-f6b1-4ca8-8a0f-49a4996a4ed5", "comment": "Malware payload", "value": "23b6a1883f63444ae49cc95fc25143b128f7c2feffee2c838a0a3f7627612829bd6554e925f6b3d9e7a376237baadbcf", "object_relation": "sha3-384", "Tag": [ { "name": "Beacon", "colour": "#3CE751", "exportable": true, "hide_tag": false }, { "name": "Cobalt Strike", "colour": "#47EF09", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647465746, "uuid": "9cd6059b-6538-42f6-800e-dbca085b7929", "value": "T11065AFB9537909E5F0A21C3088905A438FE17C7165B25599DEA3314ACE3EBF26E34F1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647465746, "uuid": "cadbcd4f-617a-4dd4-8992-75951280ecad", "value": "8873400025fdf588991ddfb219c9e375", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647465746, "uuid": "8365154d-12c5-43b8-ba92-f2ed1ed07d6c", "value": "24576:g9oRrJwqxycvNCpsslaX/Ra29nwBE3UlR3YMVFfI4rUkeZP:QolLxz6yGEuDjcZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647465746, "uuid": "734381a2-ccdc-4207-a66c-016a05a91a0d", "value": 1409024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647465746, "uuid": "ac675bc6-cbf7-4d71-9558-fd39479330ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647465746, "uuid": "3112d956-2581-443e-8ccd-af08f4808b48", "value": "cuazokrpdfdfc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b9161b8-a548-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647449180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647449180, "uuid": "591929a6-a2a0-4eb3-b030-85c303528b6a", "comment": "Malware payload", "value": "f02a745d75cb7c8561e8dfad37d73234", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647449180, "uuid": "e6cde6e5-cd01-40a6-beae-52d254aab942", "comment": "Malware payload", "value": "7746116ae343b76397dc5f94e65cb9b6147385d8cff941c7245305c3b6148468", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647449180, "uuid": "58f6a2aa-beea-43d2-a7dd-44595c176fa4", "comment": "Malware payload", "value": "e388faac364b3545ad30bdb6a1ea00b413f7a97f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647449180, "uuid": "2decdcdc-14c8-4a65-a8cb-4303c21a5e25", "comment": "Malware payload", "value": "dca3c0940f485598776c6231207be6b12894529d7f8eee18974b7fdb0dedefd33e486d8a68d32203d73bfd84c479040e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647449180, "uuid": "6aa11f78-2c89-48bb-9d19-96b88c443752", "value": "T1481512FAD7004A37F39E057AE58482C47BB5CE63F623DF426AC825BE4C977445829392", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647449180, "uuid": "c9600223-bb60-47d9-aa9f-00ec487e63c8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647449180, "uuid": "444203c1-fa8a-4327-9464-a8c0236cbf95", "value": "24576:fwOBHhQv4EFQ5A6RlGOSdbe6C0LFeX3N8FeExp1vd:ffDy2A6HGrbe6zLIX98IC1V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647449180, "uuid": "fde3b3db-a477-4c33-98aa-b2b82f7050d0", "value": 957440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647449180, "uuid": "aa368a0b-647d-4608-9b81-9d4e0a4ba36b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647449180, "uuid": "99cf33b3-3ad4-4603-afa3-6f04eeb613f5", "value": "YTyrVZ3LApXFvxf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdd6d81d-a56a-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647463841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647463841, "uuid": "b172eaa3-5a4a-43be-a52a-105363a8488f", "comment": "Malware payload (Formbook)", "value": "157588d638c8463f52edd2d419ca2b1a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647463841, "uuid": "583fb078-72dc-449f-9791-3c2f48502d58", "comment": "Malware payload (Formbook)", "value": "780e7dce2d7bd0d03577dcfaf9f2c52a6cb755e1efb3213516c3159a2a324f3a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647463841, "uuid": "5da1f8a6-afe4-42a9-9f1d-acf3d47cb6d2", "comment": "Malware payload (Formbook)", "value": "9b7236130e0c48b123abafd7b91de5d6dd0375fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647463841, "uuid": "b1870735-33ed-409c-9815-f2850c71a6a3", "comment": "Malware payload (Formbook)", "value": "39af1f7bb0ac82999c77ddff848011bc2ed245a8fd29346ef80412d96eaf77a230ea640b4d36c9e9d50e8570d9c6831c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647463841, "uuid": "92bc0254-ba1b-4c2b-b69c-0d016a5bb911", "value": "T1BBC48C493D313DDEC42ACA30856C9CF8DE936C6A931BE2271C9335AE557CA578FC4862", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647463841, "uuid": "715fed85-730d-4643-bfdb-9a91ca9425c8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647463841, "uuid": "d6ccd5bc-1f52-4590-846c-00d9828d32cc", "value": "12288:MNz0ce4Bwex+jL07+S8b15vrlfHDn9GwUVj1saQD9evRUcZ64CQlRpKO+7GPZ:MNAcnBN+v0Y15vAUKZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647463841, "uuid": "bedf5dc7-ffa0-435f-8092-7e2159864e41", "value": 586240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647463841, "uuid": "42788a7d-4e57-4475-878b-02a627135c68", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647463841, "uuid": "92013705-48ce-44ba-bf0a-31140749c515", "value": "POS22459-227.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d19cb648-a50e-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647424360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647424360, "uuid": "a9b06844-5171-4ea5-88ea-788a754c4009", "comment": "Malware payload", "value": "41db52b25c1541a8422cbc1f903a41e6", "object_relation": "md5", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647424360, "uuid": "5ce7eb00-8e5f-427b-8149-54050cfc7558", "comment": "Malware payload", "value": "7970441ae3fc680119cd70906fc8eb18fad568017461eeaccc2752b32fd0c0e2", "object_relation": "sha256", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647424360, "uuid": "3be4f2a4-eca8-4ee1-a99f-1b143e3cf85f", "comment": "Malware payload", "value": "e2fef4ffff3a38e4c03053bc6b88851cae0fab5b", "object_relation": "sha1", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647424360, "uuid": "bdf6d436-372c-42f9-99f7-ebf14c1e9e65", "comment": "Malware payload", "value": "f34831fca60932b28a543d478348950267a859c8c6c6265d14cadcf5f0e809d70a0cfce2ba7f7d87ec99614abddc815c", "object_relation": "sha3-384", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647424360, "uuid": "51cf2fc9-788d-422e-948e-4ba2c888dd9b", "value": "T166156BACB22071DEC817C572DD645C68EE9177BB930F9253906325AE892C897CF25CB3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647424360, "uuid": "eb8a12b0-596e-41be-8a21-e516ff26cef9", "value": "12288:UED/LSIBwe7RBeaQzOUZxzerrN54xZMKgUmcM5ofX02nw3ykNV6ONe/QcOMxuLYR:TSI6OMaQzBzencxKUJbLIusQUHm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647424360, "uuid": "423d52ab-8f20-4fa0-81a2-32a6744801b1", "value": 916750, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647424360, "uuid": "00b03379-862f-4ba9-8aec-e1693597e605", "value": "application/x-ms-wim", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647424360, "uuid": "849f72fe-7146-4213-908a-39207cc1f317", "value": "Payment_Swift_Copy.wim.001", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f62c22f-a4fb-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647416089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416089, "uuid": "eb79f578-b093-4a6f-9aa1-0302ff840dce", "comment": "Malware payload (Heodo)", "value": "1a25259c1c751eba83f0f367ac472a1e", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416089, "uuid": "724b0993-6d66-425b-88ec-1b489c146b27", "comment": "Malware payload (Heodo)", "value": "79a9bd1e4bcba22a4fa410d555babbf68040ea9ada2c683a595cc460f515803c", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416089, "uuid": "59238ba4-0506-4dcc-a438-9bfe9c74e929", "comment": "Malware payload (Heodo)", "value": "34c5d496d3fbaaa1ea39cbeac7bd8766132c3033", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416089, "uuid": "22d5c3db-6ab4-4742-9b26-01779efc215a", "comment": "Malware payload (Heodo)", "value": "f7b86be64a20357bc3914e5743657609e70ef27a92f1ba268982c9b83f3155f6d717a0c9e3b6119920ec2a03ac704b77", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416089, "uuid": "5b3ca4d5-1ce8-4c63-a45a-a4ad444b2238", "value": "T1C0E2D01DF3A0EE69C61DDC3944A841EA425A74258506EB4FB99CFF1D2F067C2270F19E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416089, "uuid": "bd7186e7-1253-4cdb-a6f8-65179d68429a", "value": "768:Ajf8WFhN7beEizXT2LxdFfPdkqstJVE6D:aEsTXrgXUndkq8E6D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647416089, "uuid": "fdb79ecb-bc99-4825-9531-d7e9aa306fcf", "value": 33737, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647416089, "uuid": "ddac4afe-5337-48b1-9a32-d355acb74f16", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416089, "uuid": "b552b709-b4e4-4ce8-8899-d8c7faebc1f3", "value": "Payment Report - 2022-03-15_1702.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c796805d-a557-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647455697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647455697, "uuid": "6d519e04-0cc0-4a7f-b7cb-f2239b67feb1", "comment": "Malware payload (Heodo)", "value": "b64ab165bce69dfbf5b4b9bb4ed126b7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647455697, "uuid": "299805a8-3bec-409c-a376-64b6b266e89e", "comment": "Malware payload (Heodo)", "value": "79d9b9255987aa92e1ddc982cf920357a4f8132ac02253d919833b736900a80c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647455697, "uuid": "196bbdcb-f8dd-493a-8ac4-65e6adcc7a34", "comment": "Malware payload (Heodo)", "value": "6743cc1511881edda8d51e12ad2dad7f6fe202aa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647455697, "uuid": "7dea0ad0-8b8a-44cb-a818-db094f835911", "comment": "Malware payload (Heodo)", "value": "ce3ee7a30576d23e6bb6e04a5d37e892e3f7b0af9d7c92f223fbe037f1c7c12e22858d1e16af5e915789055322c5612f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647455697, "uuid": "dfb4049c-1acb-4158-a1d9-32eb8c12ded0", "value": "T176F4CF11B2D1C076C1BF06741916A35D63F6FD608BB9878B6FD02FAE3EB45828A34356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647455697, "uuid": "f014d7d8-f359-436d-b892-22eddaad581b", "value": "66a21a1bcb4077b3ed89c00ee693486b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647455697, "uuid": "e969956f-d5c0-4fce-8999-cb3d86e4c568", "value": "12288:WZjb8BOPxue5dKV9M/98f0koPeXvkgKtuBdfMAofD:WCBAdKV9Xf0kZ3KMBdkAofD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647455697, "uuid": "33765b18-33b5-45ac-99f5-7f0dab8417dc", "value": 753664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647455697, "uuid": "7504dd80-baba-439d-9546-6e1475de1444", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647455697, "uuid": "554e4c66-21a3-4d2f-9da6-fed51864828a", "value": "b64ab165bce69dfbf5b4b9bb4ed126b7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3aa44195-a4fd-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1647416805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416805, "uuid": "3a483257-9bfd-49ce-86ac-60eabbf97f48", "comment": "Malware payload (Loki)", "value": "93f4b6b78b6c12bac6fa7ad1d26c9322", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416805, "uuid": "720b00c7-138f-40ec-b7d1-22ce38ceeb45", "comment": "Malware payload (Loki)", "value": "7a333dd9e929a51bc838572800dcab294f036118a706d72b06dde6fd2d572499", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416805, "uuid": "8b45a683-26ba-42ec-804c-af690bd515ac", "comment": "Malware payload (Loki)", "value": "c584baf54c7e857c1d5351beebe84cf55666e3df", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416805, "uuid": "47c2aaf9-39de-4666-8422-8c9ed67544ea", "comment": "Malware payload (Loki)", "value": "dee3fa385ea69345edefc8f893f5950f1acf3b921c311dcb5e01bc213487112db94348e9e6cd879ecef69f38f63d53e6", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416805, "uuid": "745d7288-d280-4ef3-bef1-029e9fa754f1", "value": "T14C141238F4ACA158D1D071BE231703632F1CBD926C0A0D9E5C90F34EEBB5B927D15695", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416805, "uuid": "089393fb-0144-4e4e-93de-f1c90517b702", "value": "3072:pRwaVW2mwpUMWcujov+USYXV6wBeYYHRMD8QHzjsohLoJY/BI0c2DIQpD:NIUumuM+U7X9QLWbCWTpD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647416805, "uuid": "641b427e-690f-4d42-b677-c4c02abf5d2f", "value": 190744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647416805, "uuid": "5e47a886-3426-4b4c-820c-953afafe3b56", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416805, "uuid": "ea8bcc67-5548-4a4d-8454-4605ba3b5866", "value": "Cable TT.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2365c965-a50b-11ec-9275-42010a9c0029", "comment": "Malware payload (AZORult)", "timestamp": 1647422779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647422779, "uuid": "94aad429-cf13-4f39-a52a-a7b135b19dd5", "comment": "Malware payload (AZORult)", "value": "566fb9ff64f07845f2c82bfeb5aa2c02", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647422779, "uuid": "82bb7246-b746-4227-a18b-7a56eb79055e", "comment": "Malware payload (AZORult)", "value": "7a9066bddd272c50102198fae4c4bade59f8a33e6c99a5f06330ec0025b2fcb4", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647422779, "uuid": "ea988284-be73-48ee-9ad4-ac7e75114d01", "comment": "Malware payload (AZORult)", "value": "0a135164092adedbbd69ec7a073149e216efae50", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647422779, "uuid": "6f87b0d5-f2eb-454d-bcce-4dbd4aa5a91d", "comment": "Malware payload (AZORult)", "value": "06436a9c6057f393754258736c1e8f278b6c78ce022a9843413b2c5483ba6640350a0a7621c45bc524bc9ec1e5589099", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647422779, "uuid": "c4ae2c44-cb35-4ac0-badc-602b9ba0da04", "value": "T1F4D4FB2A287A110EF2619E6C6BBCB071911EF7F266364CB74DF7054A12129F0CBDD627", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647422779, "uuid": "755723ce-85c5-44f2-b82e-203e76b1a977", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647422779, "uuid": "70188da9-67bb-443f-8946-d31350e9dc7c", "value": "3072:7HN3s6hV2zb6nwVSHaO0OKxJ6vdoNGhOzsLc+iYHRAkmtx1uvYsaa8QqbH3Fvz8h:7JzbOKnWHx1a+vz88iCpdHnk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647422779, "uuid": "de9dad75-3081-4203-926c-2832d1aae6c9", "value": 609544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647422779, "uuid": "9f6672ed-2fd6-4a0a-ab3d-15b555b92fce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647422779, "uuid": "05d75874-3e64-4751-beef-cf5aa5afada4", "value": "566fb9ff64f07845f2c82bfeb5aa2c02.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4346dbd9-a572-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647467071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647467071, "uuid": "6357e2e9-498b-4e81-9f67-30600e07f805", "comment": "Malware payload (Heodo)", "value": "1a0d1f61da765c4cb2766c51475f2a41", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647467071, "uuid": "4a8d62cc-6444-4866-afc2-a61dfc416cd1", "comment": "Malware payload (Heodo)", "value": "7ac8ac28538fe980473fb0963678f5b4f07d63918fa8fd4f6fec2ff79c33c33f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647467071, "uuid": "eb6141ca-cd7d-4446-87b0-ec46adc7f3ab", "comment": "Malware payload (Heodo)", "value": "87270e755fbc41b1857cc43bfe68dcae295fb0f9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647467071, "uuid": "9b2ed613-60e7-46a4-89c7-ce7ff1df7e3e", "comment": "Malware payload (Heodo)", "value": "7867e2a7719a8118bc4c497c1c2b90192d21de380e5aafee5cd39d06afb310c704522ec8368d548ca86d8864b894b77c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647467071, "uuid": "9028fdb1-e81b-4b70-9f55-272c6a5bc74c", "value": "T109F4DF1176E1C076C1BF12304956A38D23FAFD509FB986976FD02A6E3EB41828E34767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647467071, "uuid": "b9c7ee61-890a-447c-a46c-388ba0f8384f", "value": "66a21a1bcb4077b3ed89c00ee693486b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647467071, "uuid": "d79d67b2-8366-4291-9178-5023e2782dac", "value": "12288:g6O4TpP0XjxCCFJuf07j+Xk7hz8rLneTfABCJoWRWwfpW:BeCCF88j+XC8OTYA7pW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647467071, "uuid": "b3d2ebf4-a834-4fd4-baf3-4717652a7da7", "value": 749568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647467071, "uuid": "16124940-72f5-4a67-87ea-13d90894e8ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647467071, "uuid": "085952bd-2f20-4cd6-a4a6-57dc49d913f9", "value": "1a0d1f61da765c4cb2766c51475f2a41", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "482db8f9-a540-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647445604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647445604, "uuid": "b977fcfa-692a-4a68-886b-986b539703dc", "comment": "Malware payload (Heodo)", "value": "0fff5986d3a514a559c8d813aef90235", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647445604, "uuid": "7aaeaf17-5300-4a0c-8e9c-3cd54c9ebf7d", "comment": "Malware payload (Heodo)", "value": "7ad2e3f58ed7d6daa0fa7e408989c40bb17d3fcf8ad15edf96fd3847e4f06f6e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647445604, "uuid": "767df98d-7d5a-46a6-9e84-c528eed59788", "comment": "Malware payload (Heodo)", "value": "130642b4c3305e24b47a2df0c8773d414bd90a05", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647445604, "uuid": "86cab1de-6bda-46c8-b1f6-734af18a328b", "comment": "Malware payload (Heodo)", "value": "4d7cab21091c699c230ecb26df847187b640a6f95eee82d1078ad7eedeb4d3009ca91692b1b1381b2e36e83b162ef3b1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647445604, "uuid": "8e9daa3e-09f4-4808-80c3-936453b964e2", "value": "T16DE45B06AF22A1F0C06B03B40555125AC2EF7ED0A72ED657825DFB7EDD339973A30226", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647445604, "uuid": "c08803b7-7d3c-44ef-b3ae-641447abb157", "value": "066d4e2c6288c042d958ddc93cfa07f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647445604, "uuid": "ef9503a6-cf2c-4194-b2a9-42cbd27e081c", "value": "12288:jc899XKPmN4WMko86ZPJSFTdtXlcIL9v6O8:7GP7vgFTdFL9v6F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647445604, "uuid": "53de6038-bfce-4c28-9c0c-378f6902460b", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647445604, "uuid": "f4ca5773-a9e2-4f8d-94ce-c40c1901bf68", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647445604, "uuid": "b4544ce9-2036-47f7-a728-426ea9efa544", "value": "0fff5986d3a514a559c8d813aef90235", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc33a12d-a4fc-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647416701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416701, "uuid": "7d573d8b-48c6-4168-889b-7080fd7edd2c", "comment": "Malware payload (Formbook)", "value": "33fb084d09b77b6dff80d1d79614ce49", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416701, "uuid": "85046ce4-16fd-473f-a2ee-02b7968a30de", "comment": "Malware payload (Formbook)", "value": "7ae6c8904efe7eab6e3ab18e484fd359652ce7945ae67d21815709cc8af81b1d", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416701, "uuid": "9ab4c999-70ee-46fd-a99d-a1b6856835b2", "comment": "Malware payload (Formbook)", "value": "a7897bcd7b12b049172327d47465a85572d13c1b", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416701, "uuid": "53e415b6-0ba3-40bd-a772-583a92f67477", "comment": "Malware payload (Formbook)", "value": "18e96db61347e02d74c6994db51f5ee1b5ca42804999e5ef5b95721fd8521f2988d582b3577e2ae0af6379049011ea2f", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416701, "uuid": "e593842f-6041-453f-a4f8-614e9bd501b8", "value": "T1FF1402AA33135D18C3A7B47814F5680CCF2CDD6CDDA319862CB3775AA8F64CB0A16676", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416701, "uuid": "082430fc-36d6-4515-bfbf-e19876a84bc7", "value": "3072:AfRwPR9Ts1Fa6sBzAswyYzwVOOaw7CNRtdIQdqWbmdmPQXSHF8IXG8IajoAKpLfF:uQR9gszozwV1acqRtOwqW6MNG5qoRpTF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647416701, "uuid": "adee663c-9bcc-42b7-b224-c8d30a2e8a85", "value": 190600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647416701, "uuid": "8ea8ced2-41a2-438b-acf0-217c4a6cbbd1", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416701, "uuid": "ff890137-e197-4015-ab36-4b4103614c47", "value": "Company Introduction.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45ebc005-a51d-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647430568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647430568, "uuid": "7ab0d15b-49f3-45a1-8486-be6570e2e043", "comment": "Malware payload (Heodo)", "value": "39441226f3b4c2a0e008ba20fde12966", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647430568, "uuid": "a5080c4d-a7c4-472d-9987-cb82c0f6bdb3", "comment": "Malware payload (Heodo)", "value": "7b2e30e51e60875dc18668ffad638572ed59f9eed03a53e470ec075172abe344", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647430568, "uuid": "98435f58-7726-403f-beb1-123eb661d91e", "comment": "Malware payload (Heodo)", "value": "49205db613748294bb0016faec9f4a691c9c7465", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647430568, "uuid": "688e5ab0-3642-4e1b-98e0-c0cb73619df3", "comment": "Malware payload (Heodo)", "value": "b6d9fde6eea71b94e0c032ac7294ddc08393e8f81cb4e1db22f9d576d680604e534efc36e84ce920f7406b389f230705", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647430568, "uuid": "34c3c742-4e9a-42e9-91e8-d5075502961e", "value": "T14DE2C02DF2A0EE1DC21EE939446895DA421DB4558502EB4FB95CFB1D2F0A5C23B1F0DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647430568, "uuid": "6833964b-d158-4b00-9724-a02ba94d6a34", "value": "384:8jzZPFhNjqEBOA7iEibbwBLg0SCdiVXUKgUrNU/qWhZOdBNPJM+kqr9eCgh0k5lY:8jpFhNNlizXT28dFfPdkqstJmE6/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647430568, "uuid": "6bf1a0c8-0653-4ed3-a280-1109db0b95b6", "value": 33750, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647430568, "uuid": "82288791-c09b-48a4-b4b0-c914ad458249", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647430568, "uuid": "fcbff728-1b7a-4532-b8a3-e3cc69e2fcbc", "value": "Ihre-Online-Rechnung-812981-vom-16.016.2022.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14985f87-a519-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647428767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647428767, "uuid": "c599df26-cfe7-4bcc-b747-5b2a3595f5af", "comment": "Malware payload (Formbook)", "value": "90ffd183ced2aa2e798a9c7d4f7f5720", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647428767, "uuid": "dfc4b3e3-e6db-4932-9b6a-29e39c8e3d9f", "comment": "Malware payload (Formbook)", "value": "7b7a79d27d21d89be6a1faae7b389f924b5a8a5e016924c3ec6f792c9b65defa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647428767, "uuid": "25dfa7c2-717e-46b2-89fb-86c04c2451b2", "comment": "Malware payload (Formbook)", "value": "1ae2d32885a7bf145f1caa0fbaca25899281804f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647428767, "uuid": "55f89268-722d-43e2-a36e-fdc716aa4ed6", "comment": "Malware payload (Formbook)", "value": "dff8df418470e6d393eb9bd1f876ca0c86abaf9b7ef160c86940fab39352928e03f5d06a632982e12d0a63269991a70c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647428767, "uuid": "79c40dc9-68bf-44c8-876e-fe5dba52733f", "value": "T13AB4AD5D312135CEC82BCB3589719C28DFE16C76931FE22754D335AE6A7CA9B8F044A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647428767, "uuid": "cd2310ca-9bd9-4f7b-999a-88a93ace0c36", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647428767, "uuid": "933fafab-83ba-4051-953d-309f95c1b8d5", "value": "12288:0roYuD/rE8zt2yXQmy3jxT7Y2pwMRUcZ64zQlRpKO+7G:goYuD/b2JjB7VU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647428767, "uuid": "4856e925-a6d7-42a3-8ddf-af8b381e9625", "value": 519168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647428767, "uuid": "03aa1a05-0e8a-44f5-8e6f-32753072c632", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647428767, "uuid": "a21832ff-e1d5-4453-8527-fd3894d50cab", "value": "005432567455.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b24c0fe5-a573-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647467687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647467687, "uuid": "61e65010-506c-4be0-936b-847bf41dbd1e", "comment": "Malware payload (Mirai)", "value": "d90b346b5f2e6d13943d30dd282553bd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647467687, "uuid": "86860a12-06e9-4fd7-9980-62b2015f3456", "comment": "Malware payload (Mirai)", "value": "7bff9aee7d0b0fb0e48c4a1d6aab00241157c76cdd3fd1b669d54f8183ca2a29", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647467687, "uuid": "706882c7-40a1-4ecd-bd9e-2221ee2a61c5", "comment": "Malware payload (Mirai)", "value": "328834ae39833b253de094847c5a56e3682785c7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647467687, "uuid": "b7129241-3f14-47e4-a967-05d5e6517696", "comment": "Malware payload (Mirai)", "value": "dd3e5ef4e17c7e1d0c90e26dabefe9e8f55e9236bb9b99899890480604121537a0a9a10c58aa3b4d25f39df025734f60", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647467687, "uuid": "bb10d90b-ffa8-4d68-a363-2173432e4ba2", "value": "T17C73AD33D1686DA8D0664B75B9988E309B23A28416933EF6D794CB784013EECF509FF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647467687, "uuid": "c9b42735-a422-46a7-8c20-9ce13fb270c6", "value": "1536:9aD/MEGvbwt+i7EhHRkn8C/0rrnmFQlrKkNGIkFgCJl2c:9OkdzeEhxA0rjhlOkQFgLc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647467687, "uuid": "95230b71-d8e6-4ee2-be76-2309114da776", "value": 75888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647467687, "uuid": "3a631cb0-1079-4d75-a7e7-ba55196d88e2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647467687, "uuid": "9fe0f8cf-4d82-4e90-a52f-2aca5a0b4fc8", "value": "d90b346b5f2e6d13943d30dd282553bd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd038723-a522-11ec-9275-42010a9c0029", "comment": "Malware payload (CobaltStrike)", "timestamp": 1647432969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647432969, "uuid": "1a7a0435-5a02-442f-9074-30c760ac4b07", "comment": "Malware payload (CobaltStrike)", "value": "a22869dc4364c56f784aead29a0420df", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647432969, "uuid": "8c0c93ec-e84e-4519-9250-6232873e7b76", "comment": "Malware payload (CobaltStrike)", "value": "7c5bbdb634dd6a1ab8d83a1cb6c2d5b13bfd3088861c85aa699fe71e9b7a0ab4", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647432969, "uuid": "16a36d04-f2bf-4a46-9fb1-7458a3803f9d", "comment": "Malware payload (CobaltStrike)", "value": "17816ffea7dd57e59494e6f08e075273736c33f9", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647432969, "uuid": "a75370c2-42ec-4ce1-9600-7b23701da465", "comment": "Malware payload (CobaltStrike)", "value": "59a366084c936e30c3ec28b4a7aef6218dac71601b07e7ae5f0bc4e9e23239fe7b89717f8513f860172d9bc92f72c008", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647432969, "uuid": "ec5c6160-3373-49bd-a8e1-a8b2313089e7", "value": "T14A546B59B3A40CF9E867A1BDC8424686E7717C060731C6EF0790465BEF236A19D3FB61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647432969, "uuid": "832544c3-bc97-4658-b4c9-e8e9319a3689", "value": "e68ada15984301938eda57b9c89dac7b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647432969, "uuid": "0c5d8e72-5c4a-4af1-989d-31e445546c2f", "value": "6144:FnJRzMgGteaEYT1n1eQw6ljJohAhBHpI/2Av:FnTzMgcT1n1l9Job/2Av", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647432969, "uuid": "7af9e8de-a14c-4356-bfc9-988b23bfe35c", "value": 292352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647432969, "uuid": "85f79e17-de05-4ccc-82ea-40912d473f2f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647432969, "uuid": "53823bc6-afca-461b-9aa5-2245c4384333", "value": "ava.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc1a9878-a52f-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647438605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647438605, "uuid": "e41a1a8e-28bb-4f7c-a5bf-00f38cec7913", "comment": "Malware payload (Mirai)", "value": "1f8fb8453ec35f3c7cca86ca69b756d9", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647438605, "uuid": "3dd39c62-28ed-484e-a66f-711baef9dac5", "comment": "Malware payload (Mirai)", "value": "7c78e4bec9321d817561e5451c331b96c61a5c1f45b4970d9d6818e8be206df5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647438605, "uuid": "e3595163-b665-4c2e-a6c0-0058c8f4ab08", "comment": "Malware payload (Mirai)", "value": "1b9921ca3fd167f2b794fa486e9080b69b24c5bc", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647438605, "uuid": "a949d2bf-4370-4f8b-bce2-18cdfd33aa3a", "comment": "Malware payload (Mirai)", "value": "86c5f7c57c152b6104164f17ba93ad3f999fd25b65abd268a6a7cbcede59f49d2d3ec6f4a8e2f84754cd50a147f4223d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647438605, "uuid": "3e140f0a-73ad-44a0-a4bb-8921d3c4ab92", "value": "T1B5631A5BFD42AB00D49530BEFF0F028D3357C7A8E3EAB3169A245B54968642F4F6B416", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647438605, "uuid": "879c731a-0cd9-47f2-9953-bdc80e5fce93", "value": "1536:LJnx9svSQ7IpbXD1t9lb2iiP1sRYflUABTGjw:r96ScIpbXD6P2SflUA1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647438605, "uuid": "92e3dc0a-d49b-4269-90bb-705410d92b21", "value": 69780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647438605, "uuid": "0e9a85fb-7a54-45c2-9d21-bad2309c91ce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647438605, "uuid": "62de8c22-0a95-4d8e-9a5e-a5227762a147", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "050a374f-a53b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647443344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647443344, "uuid": "143d4447-6bb3-401e-b4f9-756c506fd82c", "comment": "Malware payload (Heodo)", "value": "224b105757d20021446fb7b39ede789c", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647443344, "uuid": "112912ee-42e5-4c02-b994-cec57e307d3b", "comment": "Malware payload (Heodo)", "value": "7ca4dd49a749f5cf19bec4625fa6be63da775559c055f9b3bd9ac39a6c171117", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647443344, "uuid": "8ecc18ae-b516-410e-ac33-8134fbf9d490", "comment": "Malware payload (Heodo)", "value": "c6b93f339e6aba6d8c044fb1b3865d2e35d7d6a8", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647443344, "uuid": "1de63605-39d8-4a36-a971-4d6daff136a2", "comment": "Malware payload (Heodo)", "value": "27e2588e16eb041300e9af13c2863f8a4967364b704b83fdacf93ba38a28e503413ed092610bc5dc531bc3454b4c4929", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647443344, "uuid": "50e1a0ab-1e7e-44a9-af65-0c04d76f64df", "value": "T126A2AF2CA521B80DE37A683C830640FAD64F5D023147B59D38A0BB6D5B7769706CFAAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647443344, "uuid": "8d42bdfb-8a45-43a0-98ba-fa8f98fee3c8", "value": "384:SyuAi/NjwS8EibbwBlwHSYrLb5CzgObff9kC+xbX7o1vfD:BsNyzXTFCBn9kC+xbLoN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647443344, "uuid": "ccd2c844-3d08-43a0-9626-2c4c517c356d", "value": 21628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647443344, "uuid": "1de5549f-733c-4b42-b53f-377e5a8be693", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647443344, "uuid": "3d92a129-3059-42c6-be3e-2799f82241f7", "value": "Rech 2022.16.03_1601.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91bd2571-a578-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647469780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647469780, "uuid": "ef544384-1f93-4fe5-bb5d-84d7868ff086", "comment": "Malware payload", "value": "ca39c916d53d2afbfbb1a5fb92c226d5", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647469780, "uuid": "936727e7-0b24-41f1-947e-3a3d88cb3b5e", "comment": "Malware payload", "value": "7d88c65ddbd9d990ce198567c2cf1a1f49b491ffb105ff14962c6dfbb496cc40", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647469780, "uuid": "e95e0149-3af2-4f68-972e-f1a9dc82aa3c", "comment": "Malware payload", "value": "efa44f0d66578055b50da99262c2ea38da30d06a", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647469780, "uuid": "89fd961c-09dc-4a45-a185-dce2edf268c8", "comment": "Malware payload", "value": "bcfa7c2d3c8796c446628d89d7d1117dc4d61dd8c4752c8573374476c19c61c9aeff087320b9c554d605a0ac31337598", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647469780, "uuid": "084665c3-4393-40d5-a4e9-5ad64c6eece9", "value": "T13895332F0300BA6F58ED7E75B8B2B68D3856455D91285F713856A42B1F2D2CE03DEE83", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647469780, "uuid": "3583257e-c618-4df5-9e02-7330f0478404", "value": "49152:nY7VUtF9UbsEl+UlztqllVh1HRpjhtwfI+Y0iyxyysucXglqP:Y7VUXybhsfljhJRpc5pxMz3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647469780, "uuid": "8d692f8e-0d83-49e6-88f6-22b235f9c334", "value": 1962660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647469780, "uuid": "1c9f1ecc-769e-4a15-91c7-ad3b6c26dd7f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647469780, "uuid": "8007f36b-e5a8-479f-93a4-420aa0447f47", "value": "Open__Full__Setup__Here.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e85662ba-a4fa-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647415808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647415808, "uuid": "58c05578-8f0f-450f-a0c7-4c3c29bc775c", "comment": "Malware payload (Heodo)", "value": "ae136be0ab33729e55ad38979fa3fe25", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647415808, "uuid": "dda73988-ded1-4cb7-8221-1fce2d3de0af", "comment": "Malware payload (Heodo)", "value": "7d9985cfc795224051bbd845d0c80639f6deefa2c9e836e4b0076f1110f94478", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647415808, "uuid": "f878be27-0f97-4aa7-bbcb-e68eb9892f36", "comment": "Malware payload (Heodo)", "value": "33a82a81cd3ba2c122903cffcc38a8507b33ee9d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647415808, "uuid": "c2e9d5be-4bf7-4131-981f-38c101956620", "comment": "Malware payload (Heodo)", "value": "5e04770c7eca5a5ea3483f343bbb222751443a273bc9717a14119dae251f7bb28a6ff483237ae354d3d9adb81d2e7e26", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647415808, "uuid": "b5498c9f-ae67-4fd0-98c1-c899f0bab461", "value": "T1D8E47C12F461B2B9D04B04741F1723A86EEF5E518629CA13AFA8ED5E1F31251FC3FA16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647415808, "uuid": "4884f23c-2fdd-4922-8ac0-7593e6894a12", "value": "066d4e2c6288c042d958ddc93cfa07f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647415808, "uuid": "f0428b74-840e-4f0c-a949-2b7ff6fb02a8", "value": "12288:DtAanana8Meee0GBGu3qI+3DNJ3vE6v5ePxS332d7t5hT/hexLx:Kanana8qGBGuoNxEtxCM7o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647415808, "uuid": "0dc9a0b2-c137-4f41-b679-0b14094aae47", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647415808, "uuid": "4c796fcf-b81b-403d-ae1e-fb7438f2f482", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647415808, "uuid": "eadeb196-5a7a-4b02-b0fa-d6ab5d1d3683", "value": "emotet_exe_e5_7d9985cfc795224051bbd845d0c80639f6deefa2c9e836e4b0076f1110f94478_2022-03-16__073004.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "256ba29b-a52e-11ec-9275-42010a9c0029", "comment": "Malware payload (RemcosRAT)", "timestamp": 1647437815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647437815, "uuid": "734b9a68-4a3f-45a6-8ce4-e46bd0f69362", "comment": "Malware payload (RemcosRAT)", "value": "d303d54a4977fe645b70e22ed085662d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647437815, "uuid": "0b23a196-aa31-4f63-ac40-690c65c0f6b9", "comment": "Malware payload (RemcosRAT)", "value": "7dfc276ce6e60087e740d1cc6a604962228f8551ad36a2d929cd1645307fb438", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647437815, "uuid": "d2c16d6f-2d1b-40ea-b18e-a1a0dc88e8e9", "comment": "Malware payload (RemcosRAT)", "value": "6f6274304f76159c6334e153b6f8bbc493bdbd77", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647437815, "uuid": "a53377ce-7f9a-42b8-8d35-f9b6be54f173", "comment": "Malware payload (RemcosRAT)", "value": "578605582d3436e74ee248a49355e2ed2781d48ddb0ced58dd224f2c1b52ed33fed8c68b9e8738fbf3f3ac8e668713f5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647437815, "uuid": "1b1fc085-94bb-47d1-aa3d-7d8d337a67a8", "value": "T13555DF1FBBC91F54C17E2635E27522A003F8B5DB2521C76F2DD501ECAF2265A2B427A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647437815, "uuid": "e238f6db-a884-47a6-adb4-07300d3a9327", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647437815, "uuid": "a29434df-07f0-44c8-9330-a9b6f3958dde", "value": "24576:OseWSQ8Nc7rHc+6Ux1VaPrpGtxhGTLsndjv:Oy867jc+7x3aPrmvGTod", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647437815, "uuid": "3c3a4beb-c417-4fca-ab12-114015df73e0", "value": 1334272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647437815, "uuid": "42be59d0-e3f0-44a0-9814-1e65cc067c5b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647437815, "uuid": "34acf418-6f8d-4f8f-aa93-932f9d3c1247", "value": "PO8373223 explained diagrams.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8976f4e6-a4bc-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647389020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647389020, "uuid": "e69815ea-6e2a-4321-9ac3-82b0c4ff1601", "comment": "Malware payload (Heodo)", "value": "1854ee6facd8e4f647a3279defac840e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647389020, "uuid": "f2e368e6-ec8f-4298-9364-96122b0baa4f", "comment": "Malware payload (Heodo)", "value": "7e3203a5623cf797cbf65bbc64d0f56935d79666d84c4f369cf4335b5321851e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647389020, "uuid": "fec32c2c-73d3-4770-b916-61ef3ad3e0a4", "comment": "Malware payload (Heodo)", "value": "13a66adc99aee72ea4d27951f280c8994e5e68f2", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647389020, "uuid": "f34d2262-5cc1-463a-b14c-8ff9d65a2eec", "comment": "Malware payload (Heodo)", "value": "560245167c62ce3d591b025e2d903ce3ff9440edf4a96698e6486aba7fe969cab42fb59b076d945f80368991111ca409", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647389020, "uuid": "0692f7ca-2b83-4ff9-af19-d3fe907b69c4", "value": "T123E45B3071F74031C3AA1D3905D2DE64DAF5AD4B87B2F0D32F99AB4E99F5AC12B20616", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647389020, "uuid": "bb15cb13-2e46-4d17-bc0f-15cdf44a1c80", "value": "a38617efee413c2d5919637769ddb6a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647389020, "uuid": "eb1fb7ca-3529-4442-9045-6eef3405212e", "value": "12288:E94YBCR2xP7guDo463OP4eRsiSOZjb2woE+MhJT:2kRAguDogPlddb2woEBJT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647389020, "uuid": "0eea3f2d-a726-4db2-8b4f-4a1f208d839b", "value": 684032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647389020, "uuid": "cc6a8dac-a992-49df-8e2c-2748e4f8a1d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647389020, "uuid": "60c4f4bd-bab7-412e-8462-6aed7d4d3c2a", "value": "emotet_exe_e5_7e3203a5623cf797cbf65bbc64d0f56935d79666d84c4f369cf4335b5321851e_2022-03-16__000336.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3715725a-a572-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647467051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647467051, "uuid": "cbcec942-3193-4d14-8666-946722cd1603", "comment": "Malware payload (Heodo)", "value": "13b259ac4cb03b08fd8a5728257bec28", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647467051, "uuid": "ab001d71-6925-4c66-a88f-b9608d5d2078", "comment": "Malware payload (Heodo)", "value": "7e5ff2f7b149ed1417969e4a1e891b915dac5ac58f7e867da5d80ea9eaf0bb87", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647467051, "uuid": "0a528145-74ff-4a8a-8187-3c310a8339e6", "comment": "Malware payload (Heodo)", "value": "d8ef637a3e2e269c49bea2798c7490b7bfd99e53", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647467051, "uuid": "36294c59-4605-4ccb-8d7b-ced20e7667d6", "comment": "Malware payload (Heodo)", "value": "4220ce6ad35c0454cb7cf02bac541b14ccf65cfb4be79bd4d43f26672d93bf3778ab2ec7751b780df497411d4d0efc8e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647467051, "uuid": "251bd558-213c-4be6-9cc8-8534c0824763", "value": "T1EAF4DF1176E1C076C1BF12304956A38D23FAFD509FB986976FD02A6E3EB41828E34767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647467051, "uuid": "1df693df-4609-4fd9-ae38-1b66c62284a6", "value": "66a21a1bcb4077b3ed89c00ee693486b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647467051, "uuid": "e292f2df-dbb6-4128-90eb-9ab5588c2512", "value": "12288:g6O4TpP0XjxCCFJuf07j+Xk7hE8rLneTfABCJoWRWwfpW:BeCCF88j+X98OTYA7pW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647467051, "uuid": "c3c0e787-d26c-4053-8e5b-41125e2c980b", "value": 749568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647467051, "uuid": "8efe5c86-2ac7-45ad-9d45-76c19062aa43", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647467051, "uuid": "1a32b657-2180-4db5-adb9-c064fdde87be", "value": "13b259ac4cb03b08fd8a5728257bec28", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "910a5a3d-a52b-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647436707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647436707, "uuid": "1a9e202c-c0de-4d11-8dd9-6c1341401cc7", "comment": "Malware payload (Formbook)", "value": "1f42e04ba07cf487e400280cbaa7d91a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647436707, "uuid": "cbe5c387-8814-4748-a304-8a530e6f1c3b", "comment": "Malware payload (Formbook)", "value": "7f04d412f418c0913b623b3cc09aebe6c01f31a6ba18929eb837b573b70b4ae9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647436707, "uuid": "6261235e-bfb5-46e1-98a6-0151b30d332b", "comment": "Malware payload (Formbook)", "value": "9943de96e2d0f3f32b88e20bf6df4f1594090c2e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647436707, "uuid": "403b1b72-85b5-4ae0-bdaa-c1280a35562a", "comment": "Malware payload (Formbook)", "value": "c26097fd0cc51e5459a559dda8afc61965a3b7ec0e7361e1a4047d2884ffd8972a0a57e04d94d2698a82f67a82995fa9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647436707, "uuid": "33d1a040-d4f8-42d2-9288-d03f8dc860e9", "value": "T1C6C44CF6D502E1D0E82B4674383258737D576E2FA8BCB5192E15F11126F30BAB62BC4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647436707, "uuid": "2daba7e7-b4a3-4439-be2e-6f223d3f85fa", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647436707, "uuid": "bdc04805-cd9c-4f4d-9bad-eae821329cb3", "value": "6144:6bE/HUEFIJZ02R1lXk5woq3gk+bKXqkM80K9np:6bCIZ911k5qgNbf80w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647436707, "uuid": "ffc5fa9e-5521-402a-844d-658b8fd040db", "value": 577616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647436707, "uuid": "b7a4c369-cd40-46ad-b9ad-9a13fe3b3c92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647436707, "uuid": "237f34a0-7ec3-40c3-bd2c-c9092571c2ad", "value": "HSBC Customer Information.com", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90def9e8-a50d-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647423822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647423822, "uuid": "41cfdbb2-ed82-489c-bf44-e07a06076dc6", "comment": "Malware payload (Heodo)", "value": "856d0d828472985e507b6e117d63d9d4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647423822, "uuid": "5fe9f81c-0df5-43fa-bcb2-a18532aff49c", "comment": "Malware payload (Heodo)", "value": "7f0a626ed793b3ed3c3cc870b5d794481b57c602b445e9edf07ef70b7e84b48b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647423822, "uuid": "7211fb8d-f1a6-468f-8384-e3479b853561", "comment": "Malware payload (Heodo)", "value": "490ad3116a06d1158c0f009f55e127d2a11414ca", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647423822, "uuid": "2a3c158e-ec77-4e45-a188-937513b99a47", "comment": "Malware payload (Heodo)", "value": "0e444cd21c7ba4e275a3c59571a9e2da771c6c15fb5e47bfd1793bb7ccca07e5eb439d3a3a5047d5d52372d09cb28d87", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647423822, "uuid": "2a261983-7477-4b7d-afc2-084b41e8fa6c", "value": "T196E47C12F461B2B9D04B04741F1723A86EEF5E518629CA13AFA8ED5E1F31251FC3FA16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647423822, "uuid": "5454ac0e-0470-46cb-a9eb-325e711dc5b5", "value": "066d4e2c6288c042d958ddc93cfa07f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647423822, "uuid": "da268dca-c537-46a8-82ba-91703852dfc9", "value": "12288:DtAanana8Meee0GBGu3qI+3DNJ3vE6v5eLxS332d7t5hT/hexLx:Kanana8qGBGuoNxEZxCM7o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647423822, "uuid": "2fb4e621-5180-48cc-a875-308e4edbaa21", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647423822, "uuid": "0022553e-1a66-4ad8-bb3b-e57852341e65", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647423822, "uuid": "554a22c3-6d4b-4cfb-9c02-e1be77c67599", "value": "856d0d828472985e507b6e117d63d9d4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a86c0b55-a56a-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647463805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647463805, "uuid": "79822368-193b-4831-9260-eb65eb9c0262", "comment": "Malware payload (Mirai)", "value": "08f983da3c14c023bd0541909dee03c1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647463805, "uuid": "5589175a-273d-4fdd-8ec4-3f717c5daff5", "comment": "Malware payload (Mirai)", "value": "7f0f0dab4ec7a557e1574b9c4afc3ef319a229181b8864555ddf889cc75829e8", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647463805, "uuid": "706ceae1-a95a-41b7-8718-df9293477a23", "comment": "Malware payload (Mirai)", "value": "8a3ee02e5895afe16d788b0fe03fd91b4a95291e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647463805, "uuid": "295abab1-d0e8-4b58-a89a-08501455b89a", "comment": "Malware payload (Mirai)", "value": "0ddc636b1121a0444655a317fba56ded6c7c7f88dd78ec07e8e7d1e829e3734b9cf7f4fb8ce9385a599db1471baddd16", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647463805, "uuid": "02a4ccce-1c9d-49e9-ace2-dc1b149bfd83", "value": "T113F33C46EA418B13C1D71776FA9F414A33229B94E3DB730689286BF43F87B5E0E17909", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647463805, "uuid": "233d9865-6087-4a9b-b55f-024cf390295b", "value": "3072:dUW6GNytihMwZh4uaWGLKWdwffuSFYEJPdslWM/9OalM:dDVyttSSuaWGLKWefDDJPds4M/9OalM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647463805, "uuid": "40612046-9846-4f5f-b754-8f960be3829a", "value": 165371, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647463805, "uuid": "5d07cdda-b70c-47d5-9b44-bb11a3b5fac5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647463805, "uuid": "1928257d-d8de-405f-acd6-2e7712bebe96", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39a05815-a525-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1647433984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647433984, "uuid": "0bf18321-2938-49d0-89e8-6d3be5868b86", "comment": "Malware payload (Loki)", "value": "15c3fdf17922367be22a7dcd60898823", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647433984, "uuid": "8dbf3b32-2238-445a-8327-981822c180d7", "comment": "Malware payload (Loki)", "value": "7f7a9411623a69a1392031f34ce9fe1608db6b14d660cd58899ee5eba78979ff", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647433984, "uuid": "d1f43e8a-c4af-46e7-821b-7fd698613ad3", "comment": "Malware payload (Loki)", "value": "541eed50009ef2169b03206b626768af450ce09c", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647433984, "uuid": "bb1ac32e-d5d0-44fb-8a0e-d861a74cbb25", "comment": "Malware payload (Loki)", "value": "1119e0de1571d872bd8bfa5d5ac7d66c81a0be9196f932e5ff9256a03249a6a1a47ebe69d1d6a1196793b3295dfeba65", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647433984, "uuid": "7b7af37d-2858-47f3-a612-d9908dc64c59", "value": "T1440412475411FCB1CA62A8B8C5279015D280BA0CD4B5C10D6674A3FEBBF92DF5F97B88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647433984, "uuid": "fedbea6a-0f16-4573-a9d4-ff151cd875ec", "value": "3072:gTFnfM3jQ29jH2tYiUiL4z3o5q1mTBjRDyEwQvqmLAaQutBguM/xSVFW6h+g1n/R:gTloDNMRUiLqx1gBjR1GaBI9/2x1ngM1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647433984, "uuid": "85adb6c2-ec53-4088-83c9-ab2aae3a3f24", "value": 183915, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647433984, "uuid": "74eabee8-5608-4ced-ba92-41c829e334f0", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647433984, "uuid": "d897f714-afd7-43db-9d11-0a7b2c65fe28", "value": "SUN2211011.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e6d7e6f-a518-11ec-9275-42010a9c0029", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1647428435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647428435, "uuid": "02235a88-4858-4517-9009-a8cfbc030516", "comment": "Malware payload (RaccoonStealer)", "value": "cdc6bab4601759945245a503623d9379", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647428435, "uuid": "bd554a9b-aebe-47e8-981f-5f77008b4582", "comment": "Malware payload (RaccoonStealer)", "value": "7f7f3c52fd2bf69c352bf106234604ab15c17ffb950b52fef6c8037ef6510ebf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647428435, "uuid": "d4827ab7-debc-4ac2-8598-8806f8257d80", "comment": "Malware payload (RaccoonStealer)", "value": "d050298780fcd8cf2df8ceda6ff3679d215705fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647428435, "uuid": "f32eb32c-afc9-452f-8f90-8bcaa447a94a", "comment": "Malware payload (RaccoonStealer)", "value": "9afc44601b8b78f6af277e02f909ad32266c2d3d8a046fb818996025dcc4a77bfdc7402d6e61f5f45e55cdead9c13d56", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647428435, "uuid": "cdd88110-84c0-4f6a-9e26-57b4810c1971", "value": "T18BB4E010BAA0D035F4B716FC09B59369693F7EA16B3895CF62D42ADE56346E0EC3130B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647428435, "uuid": "bc3b05d5-002b-4450-96a3-b11e34536e72", "value": "ec534fb98de7e8c1f3b452dd02a2ecf7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647428435, "uuid": "82545e85-a45f-463d-b507-abbefacae23f", "value": "12288:oYtsBXeJiFq8EHHT/Efk0Z433UoNhiqw+G8GHX299r:ZCeJcFqMfvW3liqq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647428435, "uuid": "93cfa4d5-e935-4e75-925c-ddabc8744374", "value": 521216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647428435, "uuid": "465db6db-0cab-4865-8dd3-dd79c3e7cdbe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647428435, "uuid": "ff5d16f5-7330-469c-879f-1cd813c6e37c", "value": "cdc6bab4601759945245a503623d9379.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c26ec66d-a541-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647446239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647446239, "uuid": "ac03e4dc-64a5-4cb3-b268-c9c9168bb17d", "comment": "Malware payload (Heodo)", "value": "0e8ffa0b5b79b3f49b872499e049c96f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647446239, "uuid": "dce347f2-63f5-48d2-9985-a0a3ba480d13", "comment": "Malware payload (Heodo)", "value": "7fd09c4aa219e2973dea02c1839268d7dc1715fafa7b4c81a68748b62872b680", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647446239, "uuid": "07d96bd5-f199-4d7e-b81d-16bc682fc9e0", "comment": "Malware payload (Heodo)", "value": "13ae1bcd284adaa5d2c655fa10c22692a2201eb9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647446239, "uuid": "d0598add-2316-42a0-abc9-6bf5a5fb649c", "comment": "Malware payload (Heodo)", "value": "4466fb6dfb72e2339b8a643836b3571361e22bf5aefedd45a060d68f392554cc879eac43614a8ee8a061265ce33a7a49", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647446239, "uuid": "d905ce18-74d9-4432-ab2b-9a37d53c3a82", "value": "T1FCE47C12F461B2B9D04B04741F1723A86EEF5E518629CA13AFA8ED5E1F31251FC3FA16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647446239, "uuid": "907f17dc-1f99-4ae8-a1a4-81779360e427", "value": "066d4e2c6288c042d958ddc93cfa07f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647446239, "uuid": "2e5bd9e4-9be5-40ff-9fcb-1cf3e77ce1f0", "value": "12288:DtAanana8Meee0GBGu3qI+3DNJ3vE6v5eYxS332d7t5hT/hexLx:Kanana8qGBGuoNxE6xCM7o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647446239, "uuid": "0b7973bd-5714-4dc5-bef7-d6624c131784", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647446239, "uuid": "bec671ab-085d-4d46-862d-3929cfa119cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647446239, "uuid": "a164fc7f-6280-45ca-8fd1-a69811b1b88e", "value": "0e8ffa0b5b79b3f49b872499e049c96f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fe7d121-a513-11ec-9275-42010a9c0029", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1647426344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647426344, "uuid": "fc303cc0-af06-498d-8027-dbf431ae90ce", "comment": "Malware payload (RaccoonStealer)", "value": "a9a12eb0e379236c166fe0bf364d66ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647426344, "uuid": "4ab3952b-424c-4879-be05-de9854c94607", "comment": "Malware payload (RaccoonStealer)", "value": "804cc9e39d3a85a238d99b929bb7a3b00bca29b9945e2909aaa7f2941dff10b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647426344, "uuid": "2399e223-10bd-4538-b3fb-40054c6e31c9", "comment": "Malware payload (RaccoonStealer)", "value": "8ca596079f9184367998efd65c4d4d37301c624c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647426344, "uuid": "f8298644-be20-4004-be5d-6a64fb7a453d", "comment": "Malware payload (RaccoonStealer)", "value": "5d233cf821ff61901c985dc9932edfb8c46759d22faee0118afe559e903a7d3f89f25a02e0b6380706f5af099a1a40f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647426344, "uuid": "18c30695-8a9c-4887-8eb6-3ecd7bb4b629", "value": "T1C5B4E010BAA0D035F5F756F5497893A8B92E79E16B3451CB63D42BEE0634AE0EC32317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647426344, "uuid": "cbe320f5-2a84-4ff7-8478-a2b9cad1cffb", "value": "b1f4d968dd55bfd215498c3ca94c2cf7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647426344, "uuid": "190c0995-f9e9-4cd9-a51b-d91cfffde78b", "value": "12288:rB5zqnaGkq8ioERK9MDdiMKyXQT8F99tsoiGNOw4:L+aGRrRJddom99WoiG0w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647426344, "uuid": "cf15e80a-af67-4a73-ab16-4e2deae16270", "value": 518144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647426344, "uuid": "15d1f91f-b564-4227-9ec8-05102c71e11f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647426344, "uuid": "029c7cb9-92e2-43ac-baf2-1f478ef66ecd", "value": "a9a12eb0e379236c166fe0bf364d66ce.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6e72489-a573-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647467721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647467721, "uuid": "22dd865f-e9af-4878-a485-16ec203765ab", "comment": "Malware payload (Mirai)", "value": "066709b7302847c1cd50b1474a5c6524", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647467721, "uuid": "fd944df8-7ec9-4e2c-809e-32e2dd82b478", "comment": "Malware payload (Mirai)", "value": "805c7ef6838293a3e3ec90908c5edd6735c05c97ea0b1215dd205b37a74fbea2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647467721, "uuid": "4549458d-5eb2-474b-943f-2632222e763f", "comment": "Malware payload (Mirai)", "value": "e5949ab611600721f6d0a1add67f30dce4197263", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647467721, "uuid": "ba0a0537-4969-4440-b75a-9673e98a05da", "comment": "Malware payload (Mirai)", "value": "164ddfb015f831ec4673c549b57d07af81ce381e80a8ff57a875e5f7fd2ec73c126ff5b497533d48e7d647bcc193c2ff", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647467721, "uuid": "e7a9d614-e641-4acb-a131-0e9c8e57ba5b", "value": "T1C2832A9AF400DEBCF88BD6BA41664D0EB930A39016920F367767FE933C23095D956D89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647467721, "uuid": "683b2da6-3617-45ea-9171-f8b08898d6ad", "value": "1536:qLf0+QM5PHyVwi7f29UiEy+DlOo77L3Gfh8FG8fmLPR4oFGBOKEDbF+ym+j:qLaV5fQ+DM8SJ8FAGocBBum+j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647467721, "uuid": "7ab22755-904a-4f41-ac99-c0c8ace81444", "value": 84044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647467721, "uuid": "9b4a1c03-d126-44a1-ad98-a88d5c6ed3c7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647467721, "uuid": "95981165-0d80-4927-9df8-65f30306cb6a", "value": "066709b7302847c1cd50b1474a5c6524", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fce34ff9-a559-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647456645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647456645, "uuid": "ac721457-ee23-4b77-a6e0-5eea2df5d923", "comment": "Malware payload (RedLineStealer)", "value": "53be603fa3512ab07b36316060bd238c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647456645, "uuid": "c24967ed-bdb9-4659-8f6c-3bb99122e93e", "comment": "Malware payload (RedLineStealer)", "value": "80ac7f1f1e05fffa952b65a1c0df8f8239fafbcdc122d4fad9364504e6f0b29d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647456645, "uuid": "08d1e279-4689-4a82-ac4f-076a9454889b", "comment": "Malware payload (RedLineStealer)", "value": "981f367c3edad0191d3d298c8c8aa3ea0a6a5b4b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647456645, "uuid": "e7c1dd52-9faf-4aa8-9247-c072d4bfb7eb", "comment": "Malware payload (RedLineStealer)", "value": "e4cf162f85d7b92c5a3d5b72ed42d657b94e83bf96c402fef8d6b983235576e1bf0393ba42207c1092697e0465e1c1ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647456645, "uuid": "0350e798-5a12-4c54-a346-f13b6740b0f3", "value": "T1431633E416ADB374C3E622771A13D203A5E5ADBDDEC07B99AFA53CF285C154B012C8B1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647456645, "uuid": "cf1f5a92-14ce-4793-9e15-1bb9ecfbee0d", "value": "445554923421947cbff896012e27345a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647456645, "uuid": "3fef3ead-ca8e-429b-88c3-5697609f4d31", "value": "98304:W6uQUfJCbL2cOBA/0o508cEndw/cuvdzhG7RRLaVrEsrq6h:DuQT3Y2/0a0qYcSdzhMRRGEseS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647456645, "uuid": "11fd7752-c19c-49b8-8e85-889017cd3dab", "value": 4143616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647456645, "uuid": "715c027c-1ccd-4acf-bfc9-b54c96efd79e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647456645, "uuid": "0a4bc7b1-804d-48f3-9bc6-a53e36c89e25", "value": "setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a1622bf-a532-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647439487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647439487, "uuid": "5fa102ba-36ca-43ed-b2bc-43d4f94394e7", "comment": "Malware payload", "value": "977b4f1a153e7943c4db6e5a3bf40345", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647439487, "uuid": "06a6a92a-6113-43a4-bbf4-67acc0d2c89c", "comment": "Malware payload", "value": "80d67433b91d949d8dc2b202adea901e3ff21b2859c799955da957272f52d864", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647439487, "uuid": "ab1d2a6a-835c-41f3-894f-bc0f59c8b72d", "comment": "Malware payload", "value": "e6148edba4d6574016473c789c3954f9a00cc759", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647439487, "uuid": "0f186cc4-bc32-4ab6-82c9-2908cc264fed", "comment": "Malware payload", "value": "7a03f80a8f5ef82e7c7f03b025f4aa8263de24bb0f146fcaafac547ca51cd7dda93a31f260096f498f0cdcfea2e86066", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647439487, "uuid": "973a033c-b3b2-4855-9c73-69379aef2039", "value": "T1CF43B51A3E629FECF76D823047778E21579923E527E0D2C5E69CE9001E7434E605FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647439487, "uuid": "4d75e92d-15ad-484b-8ea5-9391915e0503", "value": "768:joMdoz28fYQBCdz+jNfAcFuSbnUgJt7qj2DZqWb1T8tb9VuW7lzRQQu:i28fY68+jZUOnVq6cWb1ES0lFQQu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647439487, "uuid": "67ad670f-980d-44dc-b58a-667ec682fb9c", "value": 55448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647439487, "uuid": "30997a6b-7a79-4a26-bdb6-613f35fc0c43", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647439487, "uuid": "05dcb5df-421f-4316-8656-d2d8c4df2f64", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9ae1672-a531-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647439406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647439406, "uuid": "016a9f86-ab2a-4491-bfe9-7103a52a8703", "comment": "Malware payload (Heodo)", "value": "c330ee50ac3be566d2adbf05c9e38f19", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647439406, "uuid": "b7e04de4-5560-4928-9eba-97cc08cb854d", "comment": "Malware payload (Heodo)", "value": "818aad6fc630d5034acf0e6f238ece096d010b1e88770e599cabd5a20891440d", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647439406, "uuid": "733b795c-7a50-44b3-a9bd-c6113ac7a05f", "comment": "Malware payload (Heodo)", "value": "1ec8d2732282985c31fe90c797a3965fca99760f", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647439406, "uuid": "72880244-ba37-4ac9-84f6-172754243e6e", "comment": "Malware payload (Heodo)", "value": "9227335cef38ed916b193305702353d48d3a96d4fb94109dc4b67ac3762325371089303e2b2fb62fb7cff5464f8cb997", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647439406, "uuid": "03f8cf4d-55ef-456e-a6ed-c954c96a50f1", "value": "T105E2C02DF2A0EE1DC21EE939446895DA421DB4558502EB4FB95CFB1D2F0A5C23B1F0DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647439406, "uuid": "6bdc5881-6eee-44b6-866d-f9b7d2314ad8", "value": "384:MjzZPFhNjqEBOA7iEibbwBLg0SCdiVXUKgUrNU/qWhZOdBNPJM+kqr9eCgh0k5lY:MjpFhNNlizXT28dFfPdkqstJmE6/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647439406, "uuid": "fa7bcc6f-0872-417b-8c04-106b43b8d0a3", "value": 33750, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647439406, "uuid": "2c6daaca-0d7b-47bd-a59c-15403eae6145", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647439406, "uuid": "6c319351-2b0b-4c94-8063-396069f96781", "value": "PO 16-03-2022_1341.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d44279c-a4f8-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647414770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647414770, "uuid": "8a98daf3-2c00-48e0-a8d7-9fd639c90021", "comment": "Malware payload", "value": "a894bb32aff614ab222dd056c11ca226", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647414770, "uuid": "7ce1be2a-c731-4c2a-aa9d-c25fc4380d99", "comment": "Malware payload", "value": "8194eda0378d8cdf584f2721479cb288891e7c5e353228ca98e0c5a503cb5dcd", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647414770, "uuid": "18f930b9-1bfe-421e-8135-5872b9e70d14", "comment": "Malware payload", "value": "d96a3578af386420309a666b662475545832ad14", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647414770, "uuid": "e50e6398-8dca-4310-8520-9f780c5046e1", "comment": "Malware payload", "value": "7262b1c7007dc39680d3f4ffc9396003acff9b9e8b939f3424d3a5d2b1016dddf54bdef9b060cd458322e6f9b3804abd", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647414770, "uuid": "ef03fabb-2749-49c0-a126-9f0940e84fc7", "value": "T1CA65F186BBC5AD2FCC7384350F5AC322A6159C57C687D30769907A3C6DBB7E04E4AAC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647414770, "uuid": "8d8e3862-1990-4dbe-87a0-ca4192c89fde", "value": "24576:CTc/OHXYGxBuHJT3MldsBqQd++U4rR0W62uD49Q6SNV0VrAklkUv4vK1gwb7/S9:CTc/UXzxUMlDQ8+U4SW6o9QxNVGAklkZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647414770, "uuid": "eb6699cd-b67e-4492-bb0d-c6c7def57817", "value": 1441178, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647414770, "uuid": "e54818b8-4e51-43a9-9dc9-7110ac84a358", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647414770, "uuid": "0d610764-19e9-49ec-9614-3e988ab921cd", "value": "postbank.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cb96413-a547-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647448699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647448699, "uuid": "5114bb5d-f9d7-48ec-8da7-ab2c52faee8e", "comment": "Malware payload (Heodo)", "value": "f4e97278ec7e294d273046bfaf75e7ef", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647448699, "uuid": "0418da2a-2918-4f7a-9c8e-dd402a207942", "comment": "Malware payload (Heodo)", "value": "8201622d17013c0ff65093531dc212d1a4c94aa19ed5816202c2b841c34a90c4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647448699, "uuid": "6f856244-5136-4f3f-b7fa-6db5439e3666", "comment": "Malware payload (Heodo)", "value": "3b9c667fe7384ea93171a8f1b31a9d694d9c9d8b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647448699, "uuid": "2d892232-a8e6-464b-8d5c-c2447cc38f16", "comment": "Malware payload (Heodo)", "value": "3be543a5c521a085ed08c4d1111192a9984c083b8617b53545afa66fc911b4db5010016e619da4ca6bb2def40a912377", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647448699, "uuid": "5769aac4-bcfc-4cbd-b27f-4f2847be9628", "value": "T101E47C12F461B2B9D04B04741F1723A86EEF5E518629CA13AFA8ED5E1F31251FC3FA16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647448699, "uuid": "282fed07-e8c6-4811-a233-c8d606430289", "value": "066d4e2c6288c042d958ddc93cfa07f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647448699, "uuid": "96a4c4d2-c291-45d2-90e4-57ffff7a9c29", "value": "12288:DtAanana8Meee0GBGu3qI+3DNJ3vE6v5eCxS332d7t5hT/hexLx:Kanana8qGBGuoNxEgxCM7o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647448699, "uuid": "39b26df9-cb54-48f4-a6f3-12816499e5f3", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647448699, "uuid": "cc06720c-02d5-4cce-9f40-0624d8c42d73", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647448699, "uuid": "e5db3aaa-2bf0-4e81-a864-d26670bd54ce", "value": "f4e97278ec7e294d273046bfaf75e7ef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbc6a6d1-a557-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647455704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647455704, "uuid": "27fb71c0-e111-4884-9b5e-a6acf0ba3fdc", "comment": "Malware payload (Heodo)", "value": "636137b1c58e7556cd82af6b62a8a099", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647455704, "uuid": "b2e273ed-5414-4833-b5ae-7d58586f9a4c", "comment": "Malware payload (Heodo)", "value": "821e0c42326964819dbde48964a77612a91a6c1eecb38b37a25c91fba9e1b277", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647455704, "uuid": "6a254560-a4b9-4fcf-8a67-26e7dfeb4ab7", "comment": "Malware payload (Heodo)", "value": "9249066ac07dd3ab3ad573471c8fb9f4f0654762", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647455704, "uuid": "c850f4f5-aecf-4c46-a58f-28e8149ee0a7", "comment": "Malware payload (Heodo)", "value": "c4e366602debbf70d68fd7c20d4f5aa132b33efe1f2a5447a390bc3397c21f24414e82e5352704ce6643d20f431af990", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647455704, "uuid": "f1c1d6ae-3000-4b40-ba60-46f615e6aa5c", "value": "T126F4CF11B2D1C076C1BF06741916A35D63F6FD608BB9878B6FD02FAE3EB45828A34356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647455704, "uuid": "b06702bf-5b91-4827-acd1-3964376c5bbf", "value": "66a21a1bcb4077b3ed89c00ee693486b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647455704, "uuid": "1080d8b6-171a-4046-af44-f906c83cefa3", "value": "12288:WZjb8BOPxue5dKV9M/98f0koP1XvkgKtuBdfMAofD:WCBAdKV9Xf0kW3KMBdkAofD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647455704, "uuid": "28b31820-79eb-4c19-ba8d-218adac1e666", "value": 753664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647455704, "uuid": "4f608b33-5808-4f3b-84f1-69774d242877", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647455704, "uuid": "b4a29028-a854-40df-ab39-9e8c89f435e6", "value": "636137b1c58e7556cd82af6b62a8a099", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81c7bc8e-a4ff-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647417784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417784, "uuid": "3b74807f-81bf-4eab-ac47-1d1c486a0e3b", "comment": "Malware payload (Heodo)", "value": "68694e0db0dabda8d30fa7c754a088a5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417784, "uuid": "a131f532-a1db-4577-8455-05e394148940", "comment": "Malware payload (Heodo)", "value": "829d82ffd29ca094bb625af95d8a457623d5f4632fdd3b0dac9a4690c40d315f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417784, "uuid": "536f9109-a999-4bde-8d32-da6f0755691b", "comment": "Malware payload (Heodo)", "value": "42e977ebb11ce96e669bee7cd589c797692733ec", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417784, "uuid": "8310cfca-ff23-4553-bb70-4aa2ada7bb4c", "comment": "Malware payload (Heodo)", "value": "544faab3870ddae3f7666298afb00c866f7df65a3c144394a6024b520d853d41f94b0b8c7139eeba363f3ab1c61fdb3b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417784, "uuid": "604ea3bb-f0e0-4d9c-9f57-f8aebb92ac72", "value": "T187E45B06AF22A1F0C06B03B40555125AC2EF7ED0A72ED657825DFB7EDD339977A30226", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417784, "uuid": "3efa275a-c8be-492b-9021-681e128248a1", "value": "066d4e2c6288c042d958ddc93cfa07f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417784, "uuid": "316b876b-9106-4301-9612-84bb35c05028", "value": "12288:jc899XKPmN4WMkoJ6ZPJSFTdtXlcIL9v6O8:7GP7SgFTdFL9v6F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647417784, "uuid": "c15e0c5f-8625-4fb3-bbbd-f6efa7732bf1", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647417784, "uuid": "23d52c19-1262-4d3b-aa69-9e0319da7d49", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417784, "uuid": "96045ec9-f4d6-4b35-a35b-94b0c32d2163", "value": "68694e0db0dabda8d30fa7c754a088a5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24c6493e-a54f-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647451987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647451987, "uuid": "b41ea10c-b5dd-4ffc-a6d2-93906917bddd", "comment": "Malware payload (Formbook)", "value": "8b61df843b6375dd9a9bcbc5b9683b63", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647451987, "uuid": "189468e4-66b1-4cbd-9ff3-f51ba64de502", "comment": "Malware payload (Formbook)", "value": "8309320f8dd098c061358f93cd15da02b81e29797fa1806337a6b91976191096", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647451987, "uuid": "96b91226-3966-4103-9910-02fc87ed3655", "comment": "Malware payload (Formbook)", "value": "3f30437090a2c9289318d0a87d51e86cd3808ba3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647451987, "uuid": "94a4420e-90b8-43e1-80c2-79286425df80", "comment": "Malware payload (Formbook)", "value": "9a37cf628bf928f6030939cf8ae228efb08b334ca26fca77803ea5f1439c409c128f322466cdfd28806391aed8e7b5c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647451987, "uuid": "13560a22-30cf-4d02-8186-0924ded40832", "value": "T163A4597E14AD5337CE7BD6728650141AF691C1EB3812AC29EED31B810D176CA3FCA92D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647451987, "uuid": "6b982635-a38d-4ecd-ada3-8ffd9dde9d35", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647451987, "uuid": "f9655a5b-ab31-4437-afb8-b91a9cd58221", "value": "12288:KHV+8Rnw8CFMshhJ364nFMixpR7qTqOqI:KHI8RtshP3lpE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647451987, "uuid": "6fd0109b-e6d7-480a-a142-786fc73defc1", "value": 455680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647451987, "uuid": "c58c11af-9f0d-4c32-ac47-e48bab41e832", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647451987, "uuid": "f24869e4-10ed-4919-8082-919488b2dc5e", "value": "PAYMENT COPY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "054671b7-a4ff-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647417575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417575, "uuid": "2cea6d3e-d931-4a22-a5db-42ab0f6ebaec", "comment": "Malware payload (Heodo)", "value": "8e7393a06913c8f485553c3353c1ed4a", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417575, "uuid": "9a34fdc6-4a98-49c2-86fe-c858e307ad2f", "comment": "Malware payload (Heodo)", "value": "837d9ad5a8b5df0706e3fd6d66f6300b915ab2b04bcd0cc077ee3a46477b59d3", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417575, "uuid": "b961bf6b-0efe-4786-aec4-39066aea6d03", "comment": "Malware payload (Heodo)", "value": "f1b58e469f32da669527ba5379b9a16b44c26d5f", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417575, "uuid": "24cd2981-23ba-4cf6-a56a-e87f19c76431", "comment": "Malware payload (Heodo)", "value": "d548f17e2dd0918c841ee9b3c709b6c00fe09fca46a9c222441361f97d3bccc2f147414d2ac9e1c50ccc35b3ae1ac7f6", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417575, "uuid": "98f19665-789f-4b4c-8545-ac9fd9733880", "value": "T1A8E2D01DF3A0EE69C61DDC3944A841EA425A74258506EB4FB99CFF1D2F067C2270F19E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417575, "uuid": "f9862bfa-102e-401d-a958-b1380f7414fe", "value": "768:gjf8WFhN7beEizXT2LxdFfPdkqstJVE6D:6EsTXrgXUndkq8E6D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647417575, "uuid": "09ce2e37-b4bd-4a40-b65d-90d924c37e87", "value": 33737, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647417575, "uuid": "913f1858-c677-4c3b-9de0-8bcf4ad4534c", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417575, "uuid": "8a9fbef6-bc33-4aa7-baf7-609d79bfc6b6", "value": "N.753 QHP 15.03.2022.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c63fb153-a54c-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647450970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647450970, "uuid": "5e140f60-b16b-47ea-ac48-1ff96e2953b4", "comment": "Malware payload (AgentTesla)", "value": "46e9bd85d77e118313ff71645847c53f", "object_relation": "md5", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647450970, "uuid": "8e64c30e-8b32-421f-87fd-1c2c464cbb95", "comment": "Malware payload (AgentTesla)", "value": "83e972713e39ede8a9b10084b7c76ac25522359c6f2ee9182904bbef2eb901f0", "object_relation": "sha256", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647450970, "uuid": "b1dfce24-cd5d-441c-af17-1d23a1bd2381", "comment": "Malware payload (AgentTesla)", "value": "aba1f7ad625403c6fac9f3273749a6a99cebcc5f", "object_relation": "sha1", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647450970, "uuid": "6f06395f-a8b3-4d72-b576-77ac1f038f76", "comment": "Malware payload (AgentTesla)", "value": "c3669ea392548fa6bbbc0156a427f53fb62ef3b763970b34610b41739d1d1ba0f7cb2ce628f51e28b6f1299c82a4da03", "object_relation": "sha3-384", "Tag": [ { "name": "001", "colour": "#036B4B", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647450970, "uuid": "002defd9-1918-42b5-af13-0bec6858a78d", "value": "T108059D54725070EECDAA8F729A25DC34DF917CB9D30EA16620DB3DAF75FD9A34A00092", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647450970, "uuid": "737112ea-7fcf-4bcd-af47-547326aa407f", "value": "24576:xlJiVZO5I0Zr4lB6plbBUUD/MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM+MMMMK:xlJiVZO5Iy4IpCUD/MMMMMMMMMMMMMM1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647450970, "uuid": "1c8e8f36-062e-4f45-8c7b-f008a687a381", "value": 815104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647450970, "uuid": "e6d3f99c-8e30-42e7-ad92-94c731f4795d", "value": "application/x-tar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647450970, "uuid": "49ca5158-d832-4035-89f1-27b172f89cf6", "value": "INV01542.tar.001", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5be7b28f-a4fa-11ec-9275-42010a9c0029", "comment": "Malware payload (STRRAT)", "timestamp": 1647415573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647415573, "uuid": "8b49ad5a-078d-4017-a7d3-a80f6ac37faa", "comment": "Malware payload (STRRAT)", "value": "998f631587b8f35ad4e42fb0d21ea0cb", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647415573, "uuid": "89e0127c-50ac-4416-b1a2-669ba74b7309", "comment": "Malware payload (STRRAT)", "value": "84efbf6455a866fae787a597ae5e8f00932d2af52d9713dad896a53c11a0c3ac", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647415573, "uuid": "1626a8d9-adfc-42b0-9ecc-1c60e68e3e1e", "comment": "Malware payload (STRRAT)", "value": "8035af3a6f5c4551681508cf93f8f7d70484cfd1", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647415573, "uuid": "abf0a2b5-2ce9-48ea-b9bb-2ae389ae0cd2", "comment": "Malware payload (STRRAT)", "value": "430bdab39cbfd0125c6ec62ad220632d18f615d5defad51b05e81c1c0a6f9568fc83809f7db0da10965d8584238d6e2a", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647415573, "uuid": "c4054fab-07fe-4f9b-92e1-f95c3fbf9393", "value": "T16EF3E06E3A9B80F8E167A03655644B737B1C65C6E114E01FA4FC990E1E33C6C1666ECF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647415573, "uuid": "3e85a95d-b003-4d93-a609-9f6cf10f3550", "value": "3072:SvBColmMSDP/PQfmXmlp6oWkgyLjqahW6kgprNTnotsbaw5:SIntD3Pimgp6ohgie56kgprNTnoybD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647415573, "uuid": "e66e0713-b7c7-4d1e-aded-8f748236ab6f", "value": 167601, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647415573, "uuid": "bf9cb21e-855b-4b1b-aeb2-2366755e9e62", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647415573, "uuid": "9db8803d-fd92-47e5-a922-6ea4f8acc5bb", "value": "SHIPMENT DOCUMENTS 245687 DOC.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a935d101-a56e-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647465524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647465524, "uuid": "8bb75fb3-c5f3-45e5-b990-bbb0b85d94a8", "comment": "Malware payload (Heodo)", "value": "45c73fa58cf6f4a4e42913537ca50f17", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647465524, "uuid": "4dee8461-19c5-45f0-aad3-43e17950b321", "comment": "Malware payload (Heodo)", "value": "85b546130b877805617b65e696044c023bcce7393d723b957a98bbf66fa231d3", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647465524, "uuid": "e19dbcf4-963d-4125-98f7-c0572d1f9631", "comment": "Malware payload (Heodo)", "value": "a95dd287fa6bad186f36d6237fb8a6e14544b125", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647465524, "uuid": "a67532b9-0e49-4bf0-9e1f-bb7858274c5d", "comment": "Malware payload (Heodo)", "value": "e4a4e2d25153237d8cd51538644715400cb03f962beeae79391854869f5586cb78e49fc12c28fd306c5147229bdd29fa", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647465524, "uuid": "fe2f4ef7-c32a-454a-abef-93e8e26e49f0", "value": "T1A2A29E2DD620A41EE37A583C420940FED28E2C066007B5ED7491B67DA77769706CFAED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647465524, "uuid": "b7c6e9f8-a612-43fd-9152-317195da0694", "value": "384:Y8c5hAuAi/NjxhS8EibbwBlwcSYrLb5CzgObff9kC+xbX7T/1SeyB:YPksNPzXSFCBn9kC+xbLTc9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647465524, "uuid": "355443fd-05d7-4138-a724-19a43ea23e39", "value": 21659, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647465524, "uuid": "bf0ba487-d111-46ce-bad5-c9f9db269663", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647465524, "uuid": "9bfe3bd1-16e3-4218-baf0-ba60c98982ff", "value": "ACH Payment info.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "505e8de5-a56b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647464087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647464087, "uuid": "f12f1194-6a8a-4558-bf58-d45fd8d54475", "comment": "Malware payload (Heodo)", "value": "c9f2c6358711b8d160981274ace4a236", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647464087, "uuid": "dab82b77-b743-41b1-8b75-9f736c6e0262", "comment": "Malware payload (Heodo)", "value": "85e11e24831c84063f31b089540fae907347b4dab32549fc01113552e84dcdd0", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647464087, "uuid": "d2e139f9-5c24-423c-9d43-79c5081e13f2", "comment": "Malware payload (Heodo)", "value": "d23e192a97d44e2172c701e6e7f80f36b780235d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647464087, "uuid": "fa53699c-9a60-49b3-97e0-2adf27ccd9c3", "comment": "Malware payload (Heodo)", "value": "6671887b0c448afb0f38c2748d50102d2df47a809472febe9a83c0438c50a1000c911450d463f70a846bdce7b3ada641", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647464087, "uuid": "aa501dfe-61c9-4bd7-a71b-83f302a67263", "value": "T1C9F4CF11B2D1C076C1BF06741916A35D63F6FD608BB9878B6FD02FAE3EB45828A34356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647464087, "uuid": "3ed2d61f-663f-4a00-8aff-5f40ba039423", "value": "66a21a1bcb4077b3ed89c00ee693486b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647464087, "uuid": "ca6dcbdb-6ac1-4622-b7de-186e94dff303", "value": "12288:WZjb8BOPxue5dKV9M/98f0koP2jXvkgKtuBdfMAofD:WCBAdKV9Xf0krj3KMBdkAofD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647464087, "uuid": "717c3459-545c-4e3c-9aac-5949729e8276", "value": 753664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647464087, "uuid": "83ef9564-d901-44f6-b46c-6ccfbce62202", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647464087, "uuid": "9fab6d7a-468a-4596-8ca8-c859059b810a", "value": "c9f2c6358711b8d160981274ace4a236", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8e1c277-a548-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647449310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647449310, "uuid": "913ed829-514b-4786-ab4e-578071057069", "comment": "Malware payload (Heodo)", "value": "680a810aa81eab421923f02d412c1f3c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647449310, "uuid": "73de31df-12a4-40d5-9a2f-91f53ff05e33", "comment": "Malware payload (Heodo)", "value": "862d0f1ff400884a5b1c03b5e86cf854603c0595ee4b89d0c3d9d0f24a4633e4", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647449310, "uuid": "ce8c5f81-ba29-4362-b918-a8b167ba18a1", "comment": "Malware payload (Heodo)", "value": "9bb13090205b07fbdea6d56a14c8a6064ed80853", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647449310, "uuid": "da3c9c51-02b7-4b4a-b144-b4dc5dfecdc7", "comment": "Malware payload (Heodo)", "value": "bd9e7647fb0f34bc8eb96da32d26979029235e7443db142a91fd74fb60d6b203e0e9ddedf44345eec072165f1d3b5bc5", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647449310, "uuid": "5b37b2a0-5e79-45af-ac08-447754ca520b", "value": "T196F4CF11B2D1C076C1BF06741916A35D63F6FD608BB9878B6FD02FAE3EB45828A34356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647449310, "uuid": "3deae420-3c8b-432d-881a-b2731c9fee5c", "value": "66a21a1bcb4077b3ed89c00ee693486b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647449310, "uuid": "42b73203-f310-4bcb-aa24-1c8413fa9ffd", "value": "12288:WZjb8BOPxue5dKV9M/98f0koPhXvkgKtuBdfMAofD:WCBAdKV9Xf0kK3KMBdkAofD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647449310, "uuid": "d11f3590-0e0c-476f-9608-844f5a97e48a", "value": 753664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647449310, "uuid": "df76c9df-33bd-420f-876d-b50dcc5655b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647449310, "uuid": "6a5b3b2f-195c-420e-8d2c-6df5fbd353b1", "value": "emotet_exe_e4_862d0f1ff400884a5b1c03b5e86cf854603c0595ee4b89d0c3d9d0f24a4633e4_2022-03-16__164825.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e641ae0-a532-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647439548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647439548, "uuid": "b256fa83-210d-4c9a-a56a-523675cdb519", "comment": "Malware payload", "value": "c585f9d1cf27bde20749b9b5c854f572", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647439548, "uuid": "cb3ee851-3e75-499b-a7dd-8c7cd870b931", "comment": "Malware payload", "value": "869c12efbd277144b37b161d76089b0264b6d8f9b7397e5a0757848e2a74e0d1", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647439548, "uuid": "875aebcf-02ad-48a5-84e5-115f98d0cdb9", "comment": "Malware payload", "value": "b83a3f3bce2cf444058e8493c8eb25394ca5ad46", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647439548, "uuid": "deac42e8-56f1-4fcd-b956-8168e0c9d24c", "comment": "Malware payload", "value": "8c7acd03dc381ed0bb9662ba5abfb9520f55ec15b1194a7e64a3f2e3b10f9a60da878d5f6a216cfcb6ee6bb87e3e6dd5", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647439548, "uuid": "7a92ba41-43a2-477d-88a0-d4c778eeb0c7", "value": "T1DE660147F368B96FC8F7C3324A7A2235506A9D258B43E6D76918B33C24B35D84B85BC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647439548, "uuid": "65e90394-81e0-494e-a418-a3ddb948709e", "value": "98304:KqMwrdXx8Yf1lF6WROXbInGds8DikIlSBLk7ak3ElvwV/Wt6e22:KqMwRB8YJ6WRO3s8hIlSBLWEJUu122", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647439548, "uuid": "90a7f4dc-857f-4501-aa7c-6ad992a0c670", "value": 6843637, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647439548, "uuid": "bd52f8b8-1d76-4b22-bc41-ecb97c6b00ec", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647439548, "uuid": "1bae041c-8162-46f5-8acf-5847331109c2", "value": "Time Camera.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9006f523-a4fb-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647416090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416090, "uuid": "a7e5cefc-c505-4458-b55e-3f52fe3e5f8b", "comment": "Malware payload (Heodo)", "value": "fae567eedefbd77ad21170e9801d974c", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416090, "uuid": "02566d44-f103-47e0-b638-020563a44bda", "comment": "Malware payload (Heodo)", "value": "86aca0064d48cc2643cd3a6468ca56ba9b36f70003e637c6971da0621b8378c3", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416090, "uuid": "297a254e-2ef8-400f-a23a-851229369a19", "comment": "Malware payload (Heodo)", "value": "5fd265e44eeebd757dc8836732b7ad2c3e0ebe30", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416090, "uuid": "3f9d0562-94d7-4c8d-be9d-e3fe3a671a9d", "comment": "Malware payload (Heodo)", "value": "71d178199eb1e955991ce529fd2e8e5669f70a6b44d989273e9ac1aba92150f7c174ddb180beef39499ef88ca5351a09", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416090, "uuid": "3765114d-33f6-4173-9a69-bb861d877e32", "value": "T124E2D01DF3A0EE69C61DDC3944A841EA425A74258506EB4FB99CFF1D2F067C2270F19E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416090, "uuid": "47977d26-1faf-42a9-a01e-0c8dc3e9e694", "value": "768:Qjf8WFhN7beEizXT2LxdFfPdkqstJVE6D:qEsTXrgXUndkq8E6D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647416090, "uuid": "7a8c7a69-1800-4762-a0e1-cd082719bd72", "value": 33737, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647416090, "uuid": "8d857d8d-26a1-4710-8dc0-9cf414f668c2", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416090, "uuid": "de20e16d-ec79-459a-8f60-77556a91ea7a", "value": "Payment status.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d219bd36-a55f-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647459150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647459150, "uuid": "981a2167-47a6-4d35-8eda-753143d77ba3", "comment": "Malware payload (Heodo)", "value": "0697fe6c3f3fe302352d8d1bf4b83218", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647459150, "uuid": "d4668460-f9f9-49e4-acab-0690a0fc89fb", "comment": "Malware payload (Heodo)", "value": "86f586bbe04e63b6e2fd257f564bbec010c5e179d99f96797f2d8b977f9987fe", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647459150, "uuid": "4cdbcc4f-cb59-491c-b420-354f2937b36c", "comment": "Malware payload (Heodo)", "value": "25dc462e0c485dc98ec59b464f67b7ff0774866c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647459150, "uuid": "cf466125-6645-4204-b06c-9ad05d4ea82a", "comment": "Malware payload (Heodo)", "value": "72a9d75aa32e753bc26061b2b9b9677e9f131136064bc94b938c9da51331849f861dfc380b251afca39fbdf327701a02", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647459150, "uuid": "70b73133-7f5c-4855-ae16-b94f2475bb80", "value": "T181F4CF11B2D1C076C1BF06741916A35D63F6FD608BB9878B6FD02FAE3EB45828A34356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647459150, "uuid": "57888305-245d-41ca-bb61-6dd0aa3b9400", "value": "66a21a1bcb4077b3ed89c00ee693486b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647459150, "uuid": "36a91be1-1c3d-46d1-87fc-fe91e263ada6", "value": "12288:WZjb8BOPxue5dKV9M/98f0koPQXvkgKtuBdfMAofD:WCBAdKV9Xf0kj3KMBdkAofD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647459150, "uuid": "6c59cee3-9f6d-4f61-8585-43c9fcfd2ff9", "value": 753664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647459150, "uuid": "8fe3c172-e350-4d27-af2a-3d54b3c3f945", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647459150, "uuid": "58fb39ef-8e26-46a3-8557-c0b7acec1a31", "value": "0697fe6c3f3fe302352d8d1bf4b83218", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9ec895b-a4ff-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647417851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417851, "uuid": "c41a3437-ec28-4ab2-aa99-943d84af2263", "comment": "Malware payload", "value": "69d56f40921b38279de5aaca55ef6e18", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417851, "uuid": "48b5b68d-877b-49ce-996c-42714d78289d", "comment": "Malware payload", "value": "86f8160bd4ea06b7cd229cb90ef0126398b478057f1d5aa174900e767ea36141", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417851, "uuid": "80d84149-a25c-4563-9171-795c76f022b8", "comment": "Malware payload", "value": "a80fba0d8a14ec07065b1732b4018670a68a44ce", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417851, "uuid": "04e9c623-fed4-41d6-bccc-65f309b6d411", "comment": "Malware payload", "value": "850ec1d3d4fcc679be85289675ac7cb42c6c5ff3dddb320ce8aee063769a6a2afddead9c6296b3671b3e21fb978f50b4", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417851, "uuid": "65cbc068-f7cf-4540-9393-0de32040ebd7", "value": "T167F46CA04BB01E75EC4E6A47DB5A055E42F6874AF31633CDE2A1F103A5BFFA50A14C4E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417851, "uuid": "68621d29-f971-4ca4-802a-18e4684fd095", "value": "12288:MYlaLQMVI3idb24LxfjAysMyVYSdHN3on6AAIw8P/gq0Hoh9uZPK:oLQMVa0bVZ6R8AIw8P/gq0HohL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647417851, "uuid": "bee3d329-7e8b-40fb-a602-8c323f576421", "value": 787740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647417851, "uuid": "2c770fec-28bf-4486-bf3a-2b08d2357d80", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417851, "uuid": "06c7b18f-2959-4cf0-b5da-c20743655bae", "value": "QT284930015.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab3f0439-a536-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647441476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647441476, "uuid": "bf1d44de-ad04-4faf-9019-c0744da50ed5", "comment": "Malware payload", "value": "629235956ac03aab63cb90565edd8a80", "object_relation": "md5", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647441476, "uuid": "7e19dd7b-0386-4322-957f-6bb5551c93f5", "comment": "Malware payload", "value": "8707a1b82f12d76a34d3260b86c0a8f30d6558fe728525c7021ccf9f007b1a04", "object_relation": "sha256", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647441476, "uuid": "ffc71237-940d-4bad-ba75-90691d0c7916", "comment": "Malware payload", "value": "9a081a7788136264decad354f2e2f645a4316e77", "object_relation": "sha1", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647441476, "uuid": "022b1a0b-4f99-41e6-8f9c-fd4233c0cb28", "comment": "Malware payload", "value": "88923f3f469b3a3562938969ba75b318b2806e31c006d50726200af054488a50c83f1a479edab73befb83e4a8949c580", "object_relation": "sha3-384", "Tag": [ { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647441476, "uuid": "436f783f-1e38-4f33-ae01-11a11c83cbcb", "value": "T1B4562347F36CA4AFCCFB82364E7A416611435D248A42E7A72D55F12C1AB79C09F8AFC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647441476, "uuid": "4af733ac-4359-4df2-abc3-f622cfe4d37d", "value": "98304:4qMwrdXx8Yf1lF6WROXbInGds8DikIlSBLk7ak3ElJV/WtbmV:4qMwRB8YJ6WRO3s8hIlSBLWEFuIV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647441476, "uuid": "507e9a3b-b253-4155-b7b0-973139a87e23", "value": 6114399, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647441476, "uuid": "95ac8191-96e8-4743-9fb4-6eed0f672335", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647441476, "uuid": "9e44ba2c-3783-4be3-9bc8-2e8da5828221", "value": "629235956ac03aab63cb90565edd8a80", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3ec1acd-a576-11ec-9275-42010a9c0029", "comment": "Malware payload (DCRat)", "timestamp": 1647468978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647468978, "uuid": "158164ae-327c-49f3-8b1a-6b80b015bbf3", "comment": "Malware payload (DCRat)", "value": "6d3f72489a85891c0e3863175d485370", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647468978, "uuid": "58ca578b-c378-4419-a9e8-ac3b4741c88c", "comment": "Malware payload (DCRat)", "value": "878797013c31b35d489d96f533cacd26ccd506e3d0d86c12b4cf5428d0be7b89", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647468978, "uuid": "d1ee51b8-67c9-43d2-921b-852bb0b88490", "comment": "Malware payload (DCRat)", "value": "84469977edeb769e9fb90308168c42e8aaedd584", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647468978, "uuid": "d471547d-1841-4e93-a496-5f14cb5f43e6", "comment": "Malware payload (DCRat)", "value": "5edfbcc0219ed7e92ee4b62292aeab7736b374032ab6a4833add1904f2ae8b8b28881ed4e014bea475f6502e38bc4550", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647468978, "uuid": "353cdb4d-6c8d-403e-b128-5285aa6e5528", "value": "T10B85BE067A54CE42D0A9473BC4DFC11883F8ADCA6A26D71A7E9B33AC21513E71E4D5CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647468978, "uuid": "6916f809-d083-4dcf-8caa-5b88f5f123ec", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647468978, "uuid": "af1d6c10-1a24-4040-9ea4-d154905a558c", "value": "24576:if8ct/RBlEk3nG2s6zAK9HYM7GutyiJdyRPN4BnHeeeivfCP0/tcHIBaYQJhyOZb:ozt/RBl/E6sK94MrNzyZyBeUqPico89", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647468978, "uuid": "fc63f31f-02ce-4739-9571-2b947bb2c96e", "value": 1745408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647468978, "uuid": "bd1ac468-3719-447d-982e-8d70b7a0be12", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647468978, "uuid": "f4ad9427-9575-4d77-ac7b-71330df268e9", "value": "6d3f72489a85891c0e3863175d485370.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "966d751c-a56b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647464204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647464204, "uuid": "c9a904a6-e1e1-4cfb-94fa-acc94ce0ee42", "comment": "Malware payload (Heodo)", "value": "2544eba52de8f5ffc90b9b9349a5f6ce", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647464204, "uuid": "5c6aa7a3-090c-41f5-9e9e-b6592c10b31a", "comment": "Malware payload (Heodo)", "value": "87c72a1018e367aa53afc5465418bf90a7aa5a87b49d0ccc3def7181d7bb0439", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647464204, "uuid": "c1d2b1cd-f95b-454a-ab98-360a702ede8b", "comment": "Malware payload (Heodo)", "value": "3ec2784833aa928984815fc6ad373868944e1808", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647464204, "uuid": "c5ec98dc-c9ec-4d64-8a32-7f45815b88c5", "comment": "Malware payload (Heodo)", "value": "99a96485c247164306e4c343dbf30a6ac713bd73fa3860330285ac04306bd981b549adda25f24a5befdc946353d6b179", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647464204, "uuid": "5dce7896-e0ef-4960-a443-4aecee6da741", "value": "T1CBF4DF1176E1C076C1BF12304956A38D23FAFD509FB986976FD02A6E3EB41828E34767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647464204, "uuid": "3b7f9d2e-1d1b-4ea6-bf46-5ca96ba9e145", "value": "66a21a1bcb4077b3ed89c00ee693486b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647464204, "uuid": "09b4f33e-ea76-4653-a52a-7bbc3c9b27f2", "value": "12288:g6O4TpP0XjxCCFJuf07j+Xk7h/8rLneTfABCJoWRWwfpW:BeCCF88j+Xm8OTYA7pW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647464204, "uuid": "a4c28475-8155-4390-b701-883511df7313", "value": 749568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647464204, "uuid": "7a4f2d33-d333-4bed-b24a-1bf2b309900c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647464204, "uuid": "a92b2663-e559-400d-b8fc-69440399c21d", "value": "2544eba52de8f5ffc90b9b9349a5f6ce", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30305eda-a52d-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647437404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647437404, "uuid": "35ef1966-9534-4963-9925-3f272514239a", "comment": "Malware payload (Heodo)", "value": "f1fb143676602a0ff4d06307e2536473", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647437404, "uuid": "6d195f27-58c2-4165-9e83-03ef26bf08b2", "comment": "Malware payload (Heodo)", "value": "88770cb164330ca373558e39b195a846d7d96ff6437995d2497d41fe1d36e153", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647437404, "uuid": "a63d648b-9a77-4d39-a409-bc24517456fc", "comment": "Malware payload (Heodo)", "value": "6440d8ddb7d22533cac91a932fb52c39b6eef99b", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647437404, "uuid": "f23711b6-7b10-4012-8ff1-0f5f6d71bf7c", "comment": "Malware payload (Heodo)", "value": "259fd62574982bb3db04cce29ca1dc7048a71f83598bc1f4ed03d7efdb2ada0696cc71c201201718ac0f5d38c588244a", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647437404, "uuid": "0fb052f2-3e19-4e34-bc6c-0a6e3438db9c", "value": "T11FE2C02DF2A0EE1DC21EE939446895DA421DB4558502EB4FB95CFB1D2F0A5C23B1F0DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647437404, "uuid": "4cac081a-9bff-4190-a8e3-1c86b60155fb", "value": "384:8jzZPFhNjqEBOA7iEibbwBLg0SCdiVXUKgUrNU/qWhZOdBNPJM+kqr9eCgh0k5lY:8jpFhNNlizXT28dFfPdkqstJmE6/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647437404, "uuid": "8d93356c-c6ec-4fc6-87cb-2e2a8cc18999", "value": 33750, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647437404, "uuid": "88cb74df-e157-4472-9c32-0b3eb6b59c05", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647437404, "uuid": "99273b7c-e14e-4688-9585-779791970435", "value": "Details 2022.16.03_1425.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ae4cc56-a540-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647445609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647445609, "uuid": "d3f61599-0df1-4671-a676-9bafefaa475a", "comment": "Malware payload (Heodo)", "value": "f06fd79e5c5e588d6b462ec9bca8035f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647445609, "uuid": "ce465da7-c2db-4983-adde-d6974535dfd8", "comment": "Malware payload (Heodo)", "value": "888a616f8b01e224ef7a80ed1c991c45b99591826907d919de69a39a04ee0922", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647445609, "uuid": "981dc3da-6b4a-4705-8ec6-cfffd5a7f19b", "comment": "Malware payload (Heodo)", "value": "ae9016b38cb32c7e9d1b5f2552731098c4f9a2b3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647445609, "uuid": "b48297b8-2ba4-4f7c-8609-253de113944f", "comment": "Malware payload (Heodo)", "value": "16f7cbe879a22a7e4b0018ea124783e04eb07a0d34496417c6151610030a21b24aa1f74f384a1bf598a429a83f29d311", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647445609, "uuid": "c2bf3ea0-835b-45c3-8d7f-055fe09fbd72", "value": "T1E5E45B06AF22A1F0C06B03B40555125AC2EF7ED0A72ED657825DFB7EDD339977A30226", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647445609, "uuid": "2a20199e-f6d5-4cbb-a602-ba832c62027f", "value": "066d4e2c6288c042d958ddc93cfa07f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647445609, "uuid": "9a2c4c73-32ff-4e17-8d99-0d3f03feb825", "value": "12288:jc899XKPmN4WMkoc6ZPJSFTdtXlcIL9v6O8:7GP7HgFTdFL9v6F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647445609, "uuid": "7b3f5945-c933-4920-8cfb-386c182e75ed", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647445609, "uuid": "bf3f68fa-d394-4653-b87c-aa4927d96704", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647445609, "uuid": "2f010074-8cad-4a6a-8dbe-6e322f22fa9c", "value": "f06fd79e5c5e588d6b462ec9bca8035f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ddd6794-a4ff-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647417724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417724, "uuid": "96917292-f0bd-4038-93ad-fef2fb45a451", "comment": "Malware payload (Heodo)", "value": "0f118e68d475f2c8facf95635d23b528", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417724, "uuid": "fc86721c-8399-4fef-b78e-b83ba81ac1e5", "comment": "Malware payload (Heodo)", "value": "88aa425386da928c53ddbfb5eaa0659d72d2f2740130a44bbab661325450b40d", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417724, "uuid": "aa9ce281-b573-4655-a1a4-5dc6c20ac06c", "comment": "Malware payload (Heodo)", "value": "b068c11749be2a0a456f8057c2e2944171a51e9a", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417724, "uuid": "55c0396a-4072-4507-9cb4-e8afc9f20873", "comment": "Malware payload (Heodo)", "value": "6ea1b6636b50861fc60f2a6536750148b7f668cfd3e268ed610cc99f10c2d2646926c28d49decbcf76a6a81e1e2e7ea7", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417724, "uuid": "59ce1b9a-f101-484a-b897-4366c99cf3cb", "value": "T16733D00FA922F5ACD3136C39C68C5AF5750E59D2D084F62B08857B8CBB1B1E7179F281", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417724, "uuid": "7fccd01a-fb3b-493e-8896-80235fe55160", "value": "1536:IAcEOt24xZdRBzH9hJBrdEwwNXekVIe260:xcEc2Kd3zdtdEwoB2t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647417724, "uuid": "aaaf0d43-94b5-45c7-9571-439a3413c5be", "value": 50523, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647417724, "uuid": "5a7ce50f-22ac-43bb-90bd-c1853927db21", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417724, "uuid": "8227dd74-6a90-404e-9ee0-6e3cd1ff7e34", "value": "Form.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dafad3f4-a4d7-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647400754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647400754, "uuid": "9aa10ab0-e17f-4904-bf03-2acae52b58b7", "comment": "Malware payload (Mirai)", "value": "10932382906f2a51857debb216d6d015", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647400754, "uuid": "47f54494-c293-4606-b1fd-7dafcd624ccb", "comment": "Malware payload (Mirai)", "value": "88fb3c0dc82bb2efb247a56541abc74f21042ffe98d9321f21caba41630812b1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647400754, "uuid": "b7764319-70a8-4dd8-999d-47912d696ec5", "comment": "Malware payload (Mirai)", "value": "a22ed5ab8b6f85f6df4ac95c2eb195abad654ae1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647400754, "uuid": "cea6018f-2be4-4b42-bde2-4ab4e6ff0c0c", "comment": "Malware payload (Mirai)", "value": "f05681377d24c37a410e7c98af1b85588e3d5dcd0780a302b8e35f840b9224950a6708f8d6d56d82ccd9b65373b90d44", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647400754, "uuid": "e468762f-5dd7-481b-af37-87472edeea9c", "value": "T1F0435DC4F243E9F5DC12007024BAEB37BE36E1F51119EA97D3E89B336D52512E90AA4D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647400754, "uuid": "ff07a8f4-71ea-46a9-8f9e-eec5cb542c44", "value": "1536:RgeGfWcBDCAO8Z555rhtD5405FtwUyNLP:2/fWcBD7O8HX5HNy1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647400754, "uuid": "9f533474-9ce6-4841-a0ef-b93ac5afbb55", "value": 59444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647400754, "uuid": "1eaeea25-3c09-4b00-bd22-496d0090562d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647400754, "uuid": "8bff3c3b-12f2-4496-b401-7517f8b82e08", "value": "10932382906f2a51857debb216d6d015", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61eb6dd8-a502-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647419019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647419019, "uuid": "34f2d9d9-f2d8-49c9-bb6d-75c4408ce0f1", "comment": "Malware payload (Heodo)", "value": "966f78dc86681ec2f5cdc99c5465cd6b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647419019, "uuid": "810af7e6-7dea-412e-80fd-96443b6b61e7", "comment": "Malware payload (Heodo)", "value": "892b54939d572d472be11c6808f65f666d68650ae5b4091996ed130e3e5a73e7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647419019, "uuid": "281cd4a5-fdb5-47b4-bf0c-5e8378cc3560", "comment": "Malware payload (Heodo)", "value": "f3c7054d0ef8b5b3a06fe9541dda9fa0a3b3608c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647419019, "uuid": "24ca4375-998f-4aa6-8734-0639dc46a163", "comment": "Malware payload (Heodo)", "value": "c2485f02a8f3349a4d4b49c6191f96f40f89db5de18aaa3a5f2683d0dd7b5ba507e53485dacdaa38f03d9266d8539458", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647419019, "uuid": "524d1171-d088-4bbd-b0f2-ff588a867077", "value": "T160E47C12F461B2B9D04B04741F1723A86EEF5E518629CA13AFA8ED5E1F31251FC3FA16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647419019, "uuid": "13df09de-32d2-4b42-bb51-884bb3d325a2", "value": "066d4e2c6288c042d958ddc93cfa07f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647419019, "uuid": "5f926d18-70ca-490e-9d13-2966e91031f5", "value": "12288:DtAanana8Meee0GBGu3qI+3DNJ3vE6v5eaxS332d7t5hT/hexLx:Kanana8qGBGuoNxE0xCM7o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647419019, "uuid": "ac101187-faa5-4f06-bf4e-d43a0cc17cef", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647419019, "uuid": "05cc51ba-19f3-4f8d-8ee0-cc87e3f4bf1d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647419019, "uuid": "a22f6881-7c52-45db-94f9-a6d9bff54895", "value": "966f78dc86681ec2f5cdc99c5465cd6b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72ba3a47-a505-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647420335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647420335, "uuid": "330d6691-cfb1-42ee-b74f-cd083318cfe6", "comment": "Malware payload (Heodo)", "value": "6476cd03c2fc7cb3a8103b2fe7346db0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647420335, "uuid": "c3cebcc1-cec9-46bb-be28-3b519a25d439", "comment": "Malware payload (Heodo)", "value": "8a956e4c99780c2035311995970d5944f59d0d9bb86187e0d39db26d6dfc49cb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647420335, "uuid": "1417af86-54a9-4a05-92a1-829c025c2c67", "comment": "Malware payload (Heodo)", "value": "0d15326d1a170e3f368232f46b3aad6e9dc7a9a1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647420335, "uuid": "54e7d066-2a6d-4be6-b74f-b9add98c57b2", "comment": "Malware payload (Heodo)", "value": "c9b044fed35626615fe2b4f940a422c52be57f9b667ff235dfc67e8e9b60af9e20ba2bf7877a39efe18431bf5e064f47", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647420335, "uuid": "74aff670-58fc-470b-943c-e5f90b9187a2", "value": "T133E47C12F461B2B9D04B04741F1723A86EEF5E518629CA13AFA8ED5E1F31251FC3FA16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647420335, "uuid": "0b3328ac-c244-401f-8f4e-5935ef0ebf5b", "value": "066d4e2c6288c042d958ddc93cfa07f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647420335, "uuid": "0c9b2e9c-029a-4db7-b948-7af163b974f4", "value": "12288:DtAanana8Meee0GBGu3qI+3DNJ3vE6v5eRxS332d7t5hT/hexLx:Kanana8qGBGuoNxErxCM7o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647420335, "uuid": "ac6a84f9-4baa-4c5e-af4d-c01a28207c3c", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647420335, "uuid": "567d8437-7a31-4323-9dbb-fe9cd553022f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647420335, "uuid": "2fe0bc67-f3d4-4c75-917b-c3b13bf87926", "value": "6476cd03c2fc7cb3a8103b2fe7346db0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7338218-a568-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647463078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647463078, "uuid": "2758cbb1-6da6-4d61-9354-15af12e1937b", "comment": "Malware payload (Heodo)", "value": "42243cf190470a1e3f1bad3a7e9d8311", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647463078, "uuid": "ceabb2ae-a901-4fdb-b561-b596d180da46", "comment": "Malware payload (Heodo)", "value": "8ab137c720c90892cb6c576dc4bd2e5b7c30422c4d70ca5c32458c2338c2e1f1", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647463078, "uuid": "f1e4c15c-1d72-4e91-a5bd-0a9538c609a7", "comment": "Malware payload (Heodo)", "value": "19308542f455143032f940ed5a8a547802b93d55", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647463078, "uuid": "977f749e-de2b-46b7-ae9a-ea0216de2c28", "comment": "Malware payload (Heodo)", "value": "51d3411cea3198fbe60273e2eb76d9ffd5c328348dd9a8c39030fc70dc87bee9f7745cc3dff3726a045098a85401e24d", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647463078, "uuid": "9b35f411-4a88-42b0-8606-decb058e854c", "value": "T1D8E2C02DF3A0EB1DC219D939446981DA420A74258506EB8FB95CFB1D1F4A6C2770F09E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647463078, "uuid": "143364dd-d1b2-4b18-a027-b8a8d335f457", "value": "384:MjxzKpZPFhNjHEBOA7iEibbwBLg0SCdiVZKgUrNU/qWhZOdBNPJM+kqr9eCgh0kB:Mj1uFhNClizXT2tdFfPdkqstJOE6K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647463078, "uuid": "1b4cfc96-3a89-4025-ab3a-2bf88b2e0a59", "value": 33745, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647463078, "uuid": "aac388f5-87b4-47ed-8148-449815e580f8", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647463078, "uuid": "555e900f-445c-47f1-968b-ca97f74a4e41", "value": "DOCUMENTO 62741015.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ced0836f-a53d-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647444542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647444542, "uuid": "3d7a8d95-9b3a-451f-b823-bcf8e0234687", "comment": "Malware payload (AgentTesla)", "value": "d8f2277379780218dc705279193e6b7b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647444542, "uuid": "9aa1e53d-1d99-40f9-8a8a-19f3a9b09acd", "comment": "Malware payload (AgentTesla)", "value": "8ad85e80afd380e9a65cf79862c00325c8dea3e6cf10db67265dccec4074c22d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647444542, "uuid": "6db726de-d6f6-436b-a7d1-21e47905b872", "comment": "Malware payload (AgentTesla)", "value": "7fb8d72c5bc3310472fe389f3523e4b14d2cfc57", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647444542, "uuid": "95513ad6-2609-4a0e-ad46-23f1786fdc1e", "comment": "Malware payload (AgentTesla)", "value": "b3f984e70394fc2124f4a77c3755e2d1b0e32e826cc586cfc35406ec883c1c25961bdb93e52386eeec071c42348654b7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647444542, "uuid": "d6b7fa5b-fb8e-40e2-a536-7ac5bd4ebf37", "value": "T1D205229133D88F27D2FF8A7AF430494107B2F63A2252DB4D5E85A9FE09A7B1449107DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647444542, "uuid": "574d082c-c80f-4d38-8ca6-224264ad861f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647444542, "uuid": "bff40eb1-b678-4497-ad76-c534c9bf6fa2", "value": "24576:RIwODkwJCRV1Pmd2+95bBWEIUVyq8f1b:RIfDkw0RXoN5blBV2db", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647444542, "uuid": "311153e3-556d-429a-bb0d-c6586845a669", "value": 820224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647444542, "uuid": "52408d9b-c0e0-45be-aab5-ac3dab2b8aa4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647444542, "uuid": "250aa1de-3a06-478b-aa30-50d7a29a6bc2", "value": "RMPEDFGHXPUMPXMOTORXISE803000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7542e17-a50b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647423081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647423081, "uuid": "d712cfba-2df7-4e52-9baa-fdf827cd5bd8", "comment": "Malware payload (Heodo)", "value": "ab5bbc0f9282bf55d2f547bb36c06b88", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647423081, "uuid": "c279918e-6821-4691-ae04-713814e678d7", "comment": "Malware payload (Heodo)", "value": "8b3911dbbf8980b453c53becc8f8c0572f1a8fba40e5be1e661eee2a4d62bc12", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647423081, "uuid": "0534adc4-98e7-43eb-9789-e2539139b6f8", "comment": "Malware payload (Heodo)", "value": "efff8c9404f53c61ad8b9cb8c201f14d926a3c4e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647423081, "uuid": "250d0c52-4863-4bd5-83b1-045f4b690ef6", "comment": "Malware payload (Heodo)", "value": "71d3492a666664afac58e93dafe4ee98f1b163965ed8b645caccb4383815de44216e4bf7a023e1531476dea1c551dc3e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647423081, "uuid": "61bfc2e3-2695-40b1-8909-f4a4812eab94", "value": "T1B7E47C12F461B2B9D04B04741F1723A86EEF5E518629CA13AFA8ED5E1F31251FC3FA16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647423081, "uuid": "273668b6-bf42-41ed-8555-88d2b958f4fe", "value": "066d4e2c6288c042d958ddc93cfa07f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647423081, "uuid": "7ce1f8f5-7be7-48ab-87f7-1715cca19188", "value": "12288:DtAanana8Meee0GBGu3qI+3DNJ3vE6v5eHxS332d7t5hT/hexLx:Kanana8qGBGuoNxElxCM7o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647423081, "uuid": "565b8dbd-9a0d-41dd-aeb8-174ee4cea245", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647423081, "uuid": "07605cf5-a0b1-4697-8549-be07eed96b0c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647423081, "uuid": "54ff42ec-5e06-49dd-ac3d-498dfede13bd", "value": "ab5bbc0f9282bf55d2f547bb36c06b88", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c2f8b58-a557-11ec-9275-42010a9c0029", "comment": "Malware payload (AsyncRAT)", "timestamp": 1647455463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647455463, "uuid": "69cbca6e-c7a0-4e3a-b868-b6cf76717fea", "comment": "Malware payload (AsyncRAT)", "value": "bc698d10a77efac3c9222dcbc056eaee", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647455463, "uuid": "b86f0560-b51f-4c44-9c6b-5c35e1b20b1e", "comment": "Malware payload (AsyncRAT)", "value": "8b9e7e5d218817683f481d4a20b638e64bf3c7d11d5ed1b546330f6aed2862dd", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647455463, "uuid": "411028bb-f5d5-4df3-bcc9-52d3e9fa5d9d", "comment": "Malware payload (AsyncRAT)", "value": "3e22f26c6a03ce6e83b29795f202b79424bdbd19", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647455463, "uuid": "a92222ba-f488-4d80-a2fb-932ad108ba22", "comment": "Malware payload (AsyncRAT)", "value": "5a2b681b852e23bb2ade629abf69f3e0795cd511c12254454528d46bdbf00ded44cc3a2c935cce2274e3bd5ed06865aa", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647455463, "uuid": "1c028fc8-eee1-4f45-bd31-ecfa401efce7", "value": "T1F315136933E4CF17DBFE4AB7D5B006160BB0FA672A56C3468FC425FA1692B1541403AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647455463, "uuid": "ebfd27d1-4ab5-4730-b2a6-08e95a475bae", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647455463, "uuid": "a4f7b5b7-a4a1-418f-85ae-5fef2ecacd39", "value": "24576:c63wOvKg3hQFWElx9pr03mpqxd9aiHXY9:c63fXyx98d9hY9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647455463, "uuid": "6069631b-5eab-4312-9c95-87d9a830de93", "value": 909824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647455463, "uuid": "f1fa6ee4-acdd-45c1-b8f4-c33c5fea41fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647455463, "uuid": "2215d98f-8a43-4bae-bd9b-ab2bff860df4", "value": "TOS1VVOeSy0OG1H.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4205ba08-a565-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647461485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647461485, "uuid": "3481bd41-03be-404d-8cd0-35a8a9f2c9c7", "comment": "Malware payload (Heodo)", "value": "232b994c5aae84f160f7e691bccf1201", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647461485, "uuid": "4f64b223-7e4c-43e8-aae1-f680e865d68b", "comment": "Malware payload (Heodo)", "value": "8bf2df4f41b01ac53f3557a27d825ed4b7537778f422751bb6caad89e9d998ea", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647461485, "uuid": "06d0fd2a-6794-42e1-92ac-b25e725f0bb7", "comment": "Malware payload (Heodo)", "value": "9c75c4871edb6cab5709f975f75167ae63e0c5ac", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647461485, "uuid": "49a8b0ac-841a-4c13-9b1a-39a0d75598d5", "comment": "Malware payload (Heodo)", "value": "9cbae31079b40be4d9ea47a236d63f16df13c8abd2525a2fbaef0654e7f72d13a429c15a0c964f84997d823410543cf8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647461485, "uuid": "c95a5da3-11dc-4267-a048-70d1468e8547", "value": "T143F4DF1176E1C076C1BF12304956A38D23FAFD509FB986976FD02A6E3EB41828E34767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647461485, "uuid": "3059bd02-a543-4e07-aa22-baf041e0ed06", "value": "66a21a1bcb4077b3ed89c00ee693486b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647461485, "uuid": "058e1f01-3d63-433b-9646-7bacab5c59d7", "value": "12288:g6O4TpP0XjxCCFJuf07j+Xk7h28rLneTfABCJoWRWwfpW:BeCCF88j+XT8OTYA7pW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647461485, "uuid": "b51d7312-1d9d-4b80-b8b4-f25e057880ba", "value": 749568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647461485, "uuid": "9fa7b288-0388-4853-92a0-dae54810bf96", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647461485, "uuid": "642cd7d9-fd07-4184-9ce8-414dd585f2e6", "value": "232b994c5aae84f160f7e691bccf1201", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8687346-a530-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1647438974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647438974, "uuid": "104f14da-beac-4ef4-b147-1d5854b9edc0", "comment": "Malware payload (Loki)", "value": "19e3c9315ba2eef9da723160803c69a5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647438974, "uuid": "307deed6-1a96-4101-b604-bfb2cda8cdb5", "comment": "Malware payload (Loki)", "value": "8cb95af443cb322ae6a04cf76c23aa63ddb400fc2786e18241fe1a9b9e3879f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647438974, "uuid": "4ca807b4-367c-42a4-b0ce-0bcc0840e311", "comment": "Malware payload (Loki)", "value": "df5165c376a2f9c1b8b743355d0d012b711a0eb8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647438974, "uuid": "a6fe5611-ddd3-47ac-8a3a-d3b86f8dc2ed", "comment": "Malware payload (Loki)", "value": "9b8744b1939a8e2c252eb0408ed53649e25a2e6b176bc1734d4f58a7679f8bc70e6f14027d5435b5fb63343fffc72908", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647438974, "uuid": "52ef7b0d-66c2-4843-bf44-5df39543e9d2", "value": "T19554235BFAD5DDF3D5E142792EA327B5E3B2909503001797FB084DAA2A231D214CCADB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647438974, "uuid": "ca5e52c1-afff-4778-ace2-46c66e3b14aa", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647438974, "uuid": "d4921a3e-0732-4d7f-9a07-d6b38614fd90", "value": "6144:rGi/VBDG9qrbZnWss1n6+3ZpurJ8ORIGgPb6xfRHd6553:Sgrun6MMRIZz6x23", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647438974, "uuid": "dac5607e-dcad-4c65-978c-dd61892b3c48", "value": 306513, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647438974, "uuid": "f9de7ba7-6e22-4815-a4ff-a5f817c38fa1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647438974, "uuid": "32a5ab6f-8fd8-4ab6-96a9-4a35428bcb71", "value": "19e3c9315ba2eef9da723160803c69a5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c624b421-a546-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647448393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647448393, "uuid": "6697810b-2928-4cd6-a696-3603402612a4", "comment": "Malware payload (Heodo)", "value": "3985b807d58937a539ff4b3df82a1598", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647448393, "uuid": "2ab22d9e-aeb4-4ec3-918f-eeba1469155b", "comment": "Malware payload (Heodo)", "value": "8d0b4c93fd6053ccb378376e98204a08c3fd26faeda8c604d032101e63181e92", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647448393, "uuid": "fed5072b-2e0b-44dc-8a3c-73f7e3055f15", "comment": "Malware payload (Heodo)", "value": "3cc874227a8e7455c56395ea391a553704feb405", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647448393, "uuid": "7674a707-0c16-46bc-88cd-640f58675a5a", "comment": "Malware payload (Heodo)", "value": "ba2b1782030b47b02a2819d75635ca8e5bb0b1deb022778368460f9aec8e21939a64c17239156d45baf9e6aef4f947e0", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647448393, "uuid": "defead18-e34b-4a57-accf-6649b05e6660", "value": "T139A2AF2CA521B80DE37A683C830640FAD64F5D023147B59D38A0BB6D5B7769706CFAAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647448393, "uuid": "f9086409-a0cd-4d46-bfab-6874fe5aa6ae", "value": "384:eyuAi/NjwS8EibbwBlwHSYrLb5CzgObff9kC+xbX7o1vfD:VsNyzXTFCBn9kC+xbLoN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647448393, "uuid": "044331b3-5379-4e32-92ac-be018c55f6ba", "value": 21628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647448393, "uuid": "0f9ff2c4-da5f-45f9-8ab9-5a8e204ca96d", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647448393, "uuid": "592c9a78-71ba-49cf-85cd-a5ac1fd862a5", "value": "ACH Payment info.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1ec99a6-a4fd-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647417059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417059, "uuid": "fe17353d-3c93-4536-820e-4d8c7333674a", "comment": "Malware payload (Heodo)", "value": "9b8e17cc32b47e967692bbb072d79b32", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417059, "uuid": "362c27e9-fc90-4a0f-bdb4-4f21bae6047a", "comment": "Malware payload (Heodo)", "value": "8d950616828679ce50143faed4aa7b9e57482825c109f627da58f33ef4e60643", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417059, "uuid": "9bfee68e-ff29-41f3-a1c9-116279e4231a", "comment": "Malware payload (Heodo)", "value": "56a88ef32179f9a731c0931af09fd08ab7cc9a03", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417059, "uuid": "cfcf75e1-f0dc-4c72-bebb-f99aee149a3e", "comment": "Malware payload (Heodo)", "value": "3cc48ed542935ef4f39c574af578b2562188f1432b62362e0de3497efb7f902acfd179d1b9c5ea5bbff785433c2642fa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417059, "uuid": "e007056e-cc8c-4f73-9afb-8ad83a302d86", "value": "T19FE45B06AF22A1F0C06B03B40555125AC2EF7ED0A72ED657825DFB7EDD339977A30226", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417059, "uuid": "3f5de1bb-5d27-4377-a0d7-1080d146face", "value": "066d4e2c6288c042d958ddc93cfa07f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417059, "uuid": "75ebc04a-6ad5-44af-bf35-ec8746afe04f", "value": "12288:jc899XKPmN4WMkoQ6ZPJSFTdtXlcIL9v6O8:7GP7jgFTdFL9v6F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647417059, "uuid": "196c96d5-6e32-4ccc-ae40-26c0894b2c22", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647417059, "uuid": "d91d068e-f51b-4625-be97-233911876393", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417059, "uuid": "da31bba7-5ba7-4388-b84a-3badb012845a", "value": "9b8e17cc32b47e967692bbb072d79b32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bc51f1a-a52d-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647437450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647437450, "uuid": "d8fccaab-1a14-4c85-a596-dbc89a9dd076", "comment": "Malware payload (Heodo)", "value": "da38669b10f1fdb1ad4a078ca953ed9b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647437450, "uuid": "39f39a8a-7641-43c2-9550-5d3a91aa04d1", "comment": "Malware payload (Heodo)", "value": "8e361184f8b4b359dc4b5d0790411e17fefc85027ee402fe31fd77f684021613", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647437450, "uuid": "b6ae8d2a-c9b0-4e9e-a08c-3d996e4d6f60", "comment": "Malware payload (Heodo)", "value": "5862f74d8b1395335bafe001c31cd9414bb6ed1b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647437450, "uuid": "316998b0-14f2-4b81-acd8-db6cb2bb49b2", "comment": "Malware payload (Heodo)", "value": "894da8adca6a35bf3b7f450c54cd93b68fffc97f98e394f9fbecfff7efc7519e9b66157fa3802177c3299900f839f2bd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647437450, "uuid": "ead70947-3046-4a18-82d9-769bb616b12a", "value": "T109E47C12F461B2B9D04B04741F1723A86EEF5E518629CA13AFA8ED5E1F31251FC3FA16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647437450, "uuid": "651c4f72-cd05-490f-962d-a830bf312e28", "value": "066d4e2c6288c042d958ddc93cfa07f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647437450, "uuid": "043db666-7054-44aa-b596-b2cb4ef88578", "value": "12288:DtAanana8Meee0GBGu3qI+3DNJ3vE6v5eCxS332d7t5hT/hexLx:Kanana8qGBGuoNxEkxCM7o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647437450, "uuid": "f7ceac3c-03de-486e-8368-7533f9df9246", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647437450, "uuid": "05b636cd-a932-48db-9f29-9f4cb069ae0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647437450, "uuid": "9379331c-2d41-4d80-a70e-bd7c906eac12", "value": "da38669b10f1fdb1ad4a078ca953ed9b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6701843-a4f9-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647415376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647415376, "uuid": "fcb42928-c091-4718-8516-0a4a65e92e36", "comment": "Malware payload (Formbook)", "value": "fafd0bafbedee896cadc046e04f6e676", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647415376, "uuid": "462b895e-ae50-4703-98b9-6cfe0714a3f0", "comment": "Malware payload (Formbook)", "value": "8e4143a9ffed1acc96cdc70176be108a068d489ca7a742c79872aea81d076945", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647415376, "uuid": "7652d2fc-0fa9-4d79-8e0d-1eee2c1ae1de", "comment": "Malware payload (Formbook)", "value": "ddb13bee7d0895f8e6a99887ceb2036703cddf6b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647415376, "uuid": "8ad23c0a-a6b5-4493-9c1d-fb4f77eda4d0", "comment": "Malware payload (Formbook)", "value": "42e1276b3a404bd3e0fdcebbf7f30fef2e47015b43abbd11f8b1b46ad0a0c18dafcc899b39dbe591fe3b527b4633a839", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647415376, "uuid": "05e52c99-3083-4019-bdd0-7b5b3d72e035", "value": "T13635AE1AA1B76E5FF191C1B0C88D82701B6690C7BF6792869F048A7ADE873545CCF2D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647415376, "uuid": "08221663-19be-4f33-b342-4ba9fac164ed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647415376, "uuid": "1879906c-4965-4829-b5b3-b6687be39a63", "value": "24576:4JwmhB7v43LfiqBgke4YthQO826Gt9Tmdj6pxkix:4Jw2B7uf6kdmsGt8dj6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647415376, "uuid": "c6327c4f-5adb-47af-a088-b9a96cba699a", "value": 1110016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647415376, "uuid": "4b8436b6-dfec-4bcc-b03f-ce83be4c0502", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647415376, "uuid": "d5875ee5-bb5c-4a0b-9ee0-54e6f2eeb894", "value": "Doc_TekT_0136205,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "205cd935-a581-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647473455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647473455, "uuid": "6a1728ee-e116-4de4-9297-16ae2ee6e9a1", "comment": "Malware payload (RedLineStealer)", "value": "a8253155975a6967be4a5f7fffa37d20", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647473455, "uuid": "4241a5ae-62e7-4b9e-86a3-544eece71d7a", "comment": "Malware payload (RedLineStealer)", "value": "8e608482cad57e0b61c813e96639f62abd854f069f49d68807c966ccadc518d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647473455, "uuid": "de4ffa78-77a6-47b8-8d18-5d64839231b6", "comment": "Malware payload (RedLineStealer)", "value": "cb072a0f167e8a1ec6e48fc7397a2c487edaec6b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647473455, "uuid": "32655b5f-7b8f-445e-8088-a8a4d008fac9", "comment": "Malware payload (RedLineStealer)", "value": "ea693e45a840e0106bce74a8cb995137028bf5cbc74758f98e85426eed339493329bc890e96a0c45f129791721fa70e2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647473455, "uuid": "d4e087aa-ff4f-44b1-a66f-57f34cab03ab", "value": "T19E1533FB8F83FB64C2A255F556A43E9AC49528713CF8DE9626170E4F4105CB3D2680EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647473455, "uuid": "98956552-f1fd-4b1c-86db-f1b3cdf02123", "value": "445554923421947cbff896012e27345a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647473455, "uuid": "d32dfb8e-701f-45bf-9b48-2ec2bfdbbf25", "value": "24576:dzID3iQwIua/9ViYqM1dwRPOaLykkEaHNYK3Z1ZOeQqXol:kakgMjwMCNavPQh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647473455, "uuid": "f95b33c9-e64b-43e0-afcd-0a02928c68b7", "value": 951808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647473455, "uuid": "3dd5051a-716b-4131-ad17-95dc4384a075", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647473455, "uuid": "bd11317e-5a29-43a5-96a0-c185955adc30", "value": "11548671.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c7e6506-a4fd-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1647416809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416809, "uuid": "a3b38c73-0c83-45e4-b2f8-8d38d612ebd8", "comment": "Malware payload (Loki)", "value": "d1fb39ed62d591d0ff738b4c119d28ae", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416809, "uuid": "1a88ce2d-c05a-466c-b3bc-540ee928d4fb", "comment": "Malware payload (Loki)", "value": "8f3c69c3d4787413bbc29c127d5084b574c77cd758f3968497861bcc152b5665", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416809, "uuid": "95e30b8a-82db-44b4-a4ad-4cf3e3dbdef4", "comment": "Malware payload (Loki)", "value": "4025d20b6aa7feddf88f33651ed57d2a41e2e90f", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416809, "uuid": "714c652b-221b-4728-84fd-7395a9acb0fa", "comment": "Malware payload (Loki)", "value": "d0fa6b451f9f277bfdf9abadab599a9f8ca8c986faf2c8a7cac8640e2cff2c9a386c7810c0e292deb16a64888702c909", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416809, "uuid": "cf847ee3-b3fd-45f4-bdb2-91d9141842a0", "value": "T1FB1402213FCB97C4D4324AB2DAE9B7528A76DC3D3D726981B0D3781FC8358498994E38", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416809, "uuid": "aac851b9-d849-4217-99a3-0fb98a7e1fe8", "value": "3072:tXDSvVtzan8R7PFJXbDCaxt/Sy3ngQET8LTUnk0B39a9wT6BNdo+XR3cmJPI3//c:BDSttzaybTPDxYy3gQvLTw9a9PWIR3cy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647416809, "uuid": "995eb37e-1fcd-4e3f-b812-7d41835b396c", "value": 190584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647416809, "uuid": "78b2be43-b871-466f-9639-e5ca31a71434", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416809, "uuid": "22db2a23-49a5-475d-b5cd-cdaf3be028ee", "value": "Inquiry.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbfd2320-a541-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647446255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647446255, "uuid": "c0dedc82-47c6-4faa-b8f7-2acd9a8b1ffa", "comment": "Malware payload (Heodo)", "value": "75ac49b0656c5c06af2c85d410454a36", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647446255, "uuid": "27c0b0be-5053-4b4b-a26c-34d65817cbcc", "comment": "Malware payload (Heodo)", "value": "8f787163478f231a0861f030bb30ab852147b3c2c23324655fc7ad51d5ca54e6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647446255, "uuid": "6f66d09d-26a4-46f0-b57b-69e4eac51fe7", "comment": "Malware payload (Heodo)", "value": "f4c5b008704e4688035c086e576a84ad1914184c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647446255, "uuid": "56aa532e-2e98-4a18-8e81-ff8a1ec42dd9", "comment": "Malware payload (Heodo)", "value": "7f2ad88d8e6d03ae7505e2647aa22798541e1021858c7cbd4d67e830086bafe7bf635d30267438ea0a6b5c7ad7d9f72c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647446255, "uuid": "213cd358-cf0b-4f41-9904-0e66c61f4921", "value": "T10BE47C12F461B2B9D04B04741F1723A86EEF5E518629CA13AFA8ED5E1F31251FC3FA16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647446255, "uuid": "96802408-4349-4cb2-b1de-66c7b032ca3d", "value": "066d4e2c6288c042d958ddc93cfa07f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647446255, "uuid": "b1b5de47-f2f5-4881-bc6a-eb718b266d45", "value": "12288:DtAanana8Meee0GBGu3qI+3DNJ3vE6v5eVxS332d7t5hT/hexLx:Kanana8qGBGuoNxEnxCM7o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647446255, "uuid": "44dd37c8-f5f6-491b-b469-eb873849ebb8", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647446255, "uuid": "61ac0c46-6b52-45af-8053-63f0dad20054", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647446255, "uuid": "6dba8933-654d-45da-a7f5-4807088e0079", "value": "75ac49b0656c5c06af2c85d410454a36", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3948dbe1-a4f6-11ec-9275-42010a9c0029", "comment": "Malware payload (AsyncRAT)", "timestamp": 1647413797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647413797, "uuid": "309f59f2-1bb2-48fd-abee-13e2f9bb0756", "comment": "Malware payload (AsyncRAT)", "value": "c1709c8c57a35a9db077a622a54462a4", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647413797, "uuid": "bd572375-cec5-4933-a726-9d56ec7cb539", "comment": "Malware payload (AsyncRAT)", "value": "8f85813b74f25051da34d31426d21eadabf28e17592f384ea08366d79bcd67d5", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647413797, "uuid": "1a87442f-8291-49d7-8374-240d54931e89", "comment": "Malware payload (AsyncRAT)", "value": "54a8b1cf21d3b999b494e41f6584b66511319b4f", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647413797, "uuid": "9bbcfd0b-5a6b-45fb-9923-440e7812ebb1", "comment": "Malware payload (AsyncRAT)", "value": "0f0a5aac44cf343978a631e46079014f42822997dfb41a805cee91bf1542f9ffe7a701ebe1a639e64bf1cec7e55b6f26", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647413797, "uuid": "a05f6c5b-7545-470e-96e8-caf23f4666ad", "value": "T1BC05CFAC32847E9FC567CE76CA541C14EA3174BBA707D203A107019D6A5DBEBDE206E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647413797, "uuid": "9118b240-a147-44c3-898b-27248c7c16ef", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647413797, "uuid": "0a6ae007-e8f5-4f74-9968-bf68978151ac", "value": "12288:9pEXgDGMQ+c3kwOEocESvg6ze/nHkCbq9MMuBVXug7KcEYlviGtbfNc04ei6zqCv:IXgDGa5wOUe/kC0er7h9btzNf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647413797, "uuid": "66e3ee1a-94f3-42b6-bade-884b0d2b56c8", "value": 817664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647413797, "uuid": "da9c310f-4108-46f0-a14d-1554eade3957", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647413797, "uuid": "9b99cb54-d945-4174-9cb5-82b161b96e61", "value": "PO NO -10948.jpg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65aa3ad8-a4ff-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1647417737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417737, "uuid": "d755cb6b-9e0a-4336-a8e2-649ab935b822", "comment": "Malware payload (Gafgyt)", "value": "d8701d8a3e5328f7ad4a43fb5bf5de81", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417737, "uuid": "9c99fc5a-086c-4103-b8f8-9cac453615b9", "comment": "Malware payload (Gafgyt)", "value": "8f9fe72d7f13ee2be4ac04b88d71016eb73d5abfc2137c2f48ce8441bd4ff250", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417737, "uuid": "2a05fb7c-9c12-4b20-a080-dd80e5474373", "comment": "Malware payload (Gafgyt)", "value": "7615a9ef1856b8af835a9692ce57b242a90eaaef", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417737, "uuid": "671bbdf9-89c1-48e3-b8e7-c5aab70caf8a", "comment": "Malware payload (Gafgyt)", "value": "be61c8200ffd209cb7c930c82a77f9e5a3cdb755d81e84a6563e081fb8140c4949bec69f681ab553013d9b9910535885", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417737, "uuid": "ed8e0e5e-3be6-4878-86dd-ef18a82aca9a", "value": "T19E835BD5B8014D7CFD5BDAB981324B0DF92172009FA30F2BA6A7FCA76C331999E06945", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417737, "uuid": "692238f6-99da-4fc4-97f8-41e9859b3830", "value": "1536:w0TY9J0qBSn1c57gjYcMWykPkOw9+Jl6tLUEqVMH6hzFOZFfXtGn8T4/G:wMbn1c5Mj1Mlk/w8c1qeakXMe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647417737, "uuid": "abebb8f0-d5ad-4915-a1a3-38243eafb7dc", "value": 83276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647417737, "uuid": "b419c08a-2f22-48a2-8058-176a72dbf524", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417737, "uuid": "f5839432-2589-4b6e-8a50-eb9287ec90fb", "value": "d8701d8a3e5328f7ad4a43fb5bf5de81", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca1e4954-a56d-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647465150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647465150, "uuid": "c21a037d-9a3c-4111-83f5-69b7e41432fa", "comment": "Malware payload (Heodo)", "value": "120af83de93f5e6815d0f009a11e6b78", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647465150, "uuid": "83b0cf17-5fa8-457b-8670-aca00e8ceb92", "comment": "Malware payload (Heodo)", "value": "912de956a7cc5dc14efbc5b71896cd9429410404d0570a222a286404fb95369b", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647465150, "uuid": "e33decff-19ab-4966-9e40-493a15387faf", "comment": "Malware payload (Heodo)", "value": "fd0821cd4b9f3f19937bf6b8ffd8425e97d0cedc", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647465150, "uuid": "a4abb661-2469-4e8f-b747-4434a60f86c3", "comment": "Malware payload (Heodo)", "value": "b81e603aea48e2cade30d86f9cf1ec86fcbb4e8f1acc278643358959d7352d3223b49beaf9abe9c712b4774aa16564f0", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647465150, "uuid": "2397fc40-3fb9-4af8-8b4e-af1c73dc638a", "value": "T188A29D2D96216849E37BA83CD20644EA818E1C122143F9DE3495FA6C7E337D7078F6ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647465150, "uuid": "eaeb3e11-3164-4366-8762-16d6994c2661", "value": "384:cDuAi/NjG93S8EibbwB3sLSYrLb5CzgObff9kC+xbXy/8vrEjZSV:4sNs3zXasjFCBn9kC+xbi0vrEm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647465150, "uuid": "39b8564f-6f78-4949-a30f-1e7adca44b7e", "value": 22708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647465150, "uuid": "8a0fbbfd-fbc5-461c-ba66-760c0f758894", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647465150, "uuid": "e31bf17a-2d99-4de4-99dd-7f08470a8997", "value": "untitled-70779.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e88e496-a519-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647428757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647428757, "uuid": "b8c97beb-46d6-4ce6-9fbf-4d99272fdea6", "comment": "Malware payload (Formbook)", "value": "89be02df83401574fc8fa881f290f3a1", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647428757, "uuid": "14bec781-1dc7-4c82-8465-c3ddf3b439c2", "comment": "Malware payload (Formbook)", "value": "91bdcb24a207b35ecc2fda29096e77f8718b7e71c001c07c3510f905976c293d", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647428757, "uuid": "c7ac1998-6cea-4ccd-bbd9-77281a5196ea", "comment": "Malware payload (Formbook)", "value": "007e7dd239e9acea16c20f49611347ecd7325042", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647428757, "uuid": "7bd4664b-a29c-48b8-9bb6-20b5bd60d3a9", "comment": "Malware payload (Formbook)", "value": "e409214de35b1a3362afa323ac578b63b930167aced0782b332ff9dcca8d0dd29179c474d1ac9c2b3f0203178f9f1346", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647428757, "uuid": "81f5c39a-87a3-4d77-acea-4560f06ec37a", "value": "T1A494231443B02E35C0B98B27CBBE4A5AC5433952C8FBC712964B6E7C96636F0DDA06D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647428757, "uuid": "a4586ef5-1f29-444b-9eff-7d323283c0e3", "value": "6144:dEvYvaKC4XKXsNUhwaDkJtsuCq9vdK+F6EirNsWhkCB6a7w3tlF:SvMKXyULDkvsDqJdK+F6EaakxE3F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647428757, "uuid": "ec28f910-a3c4-4e4f-b922-57cb0aea1084", "value": 418307, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647428757, "uuid": "2bb4468a-7f1d-4d5b-ad8c-b217a710ea99", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647428757, "uuid": "b8508a71-61a5-4e53-aa06-f431eac1b2a2", "value": "005432567455.TAR", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ea70f19-a4fa-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647415685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647415685, "uuid": "4937e697-ec3e-4d83-9fc9-8abb24423c5e", "comment": "Malware payload (Formbook)", "value": "72c876e6f764bb1928d1f62c909b7c67", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647415685, "uuid": "4e04bdc9-bbf8-4c7c-9f09-5456c5885f36", "comment": "Malware payload (Formbook)", "value": "92ab8821f6c4eedc8bec6abee96520514061e32b772831dc3ecb8e71f8f7bcb3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647415685, "uuid": "53e56322-0af0-45ad-908c-f43b1f12a0bb", "comment": "Malware payload (Formbook)", "value": "2b75b06f02c650a06ed9ba9db90f3e7348d0b8be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647415685, "uuid": "b861e64c-8014-4ad6-9bdd-a95edf07cc8c", "comment": "Malware payload (Formbook)", "value": "9cf74d37fa01d7cbff01c8da645ee354e383f1d3ca67a5a342d40662bc706634942b84a9e08355b5cc1c90fd27d1a4dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647415685, "uuid": "1430547a-13cf-4029-8e52-0ee851a28e97", "value": "T1A974226B66C545DFEAD88E708B73C77DEB3BD2D441740B570BB10E4D2816782261E8CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647415685, "uuid": "fe4da3e7-a848-4ef2-84dd-5e9451b7563c", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647415685, "uuid": "af3666a8-eed8-48fb-a112-7fe1b7f78afd", "value": "6144:rGiQQUYCM66nTPUe6iGLymQaOxufKMEXjx2aTJSo23bjJI6:0siYPUXyoOx8KMEzx2sT2PJd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647415685, "uuid": "96847b85-4405-4774-a36d-91fda1cc5dfc", "value": 341473, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647415685, "uuid": "8d26f895-747a-4122-b672-6e5f0090abc4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647415685, "uuid": "68d8f1f5-ecf8-4363-8f16-4a27c2e05bc6", "value": "Demande de prix.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdf4c92f-a510-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647425186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647425186, "uuid": "ad17e8ef-aa0b-441e-9c42-a2dbf2871344", "comment": "Malware payload (Heodo)", "value": "538ec022ef4fe2a044d6781dccdcb136", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647425186, "uuid": "11d9297f-4e8c-410f-82ec-75234149338a", "comment": "Malware payload (Heodo)", "value": "92bcccff665698781f065436366b7029220c8068e2524553d99ff7dde2b03597", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647425186, "uuid": "9543cca2-4f2a-4d42-a18e-529c8ca43f5d", "comment": "Malware payload (Heodo)", "value": "cbf7583832c930ec67e2d46b06eeaffbe84714fb", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647425186, "uuid": "42ba7dcd-3210-421e-a569-976022dfd9a9", "comment": "Malware payload (Heodo)", "value": "c1744010bafb55341bc5e79391a0a59d394b366c1d45f26a4ebff577f3d03800ac71db6f3c9847097e7f25904125911e", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647425186, "uuid": "768b1ed0-7175-4611-8eae-6db65009d228", "value": "T1A2E2C02DF2A0EE1DC21EE939446895DA421DB4558502EB4FB95CFB1D2F0A5C23B1F0DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647425186, "uuid": "73eae73f-b1b0-4d0a-a50d-f6a3664bf7d9", "value": "384:cjzZPFhNjqEBOA7iEibbwBLg0SCdiVXUKgUrNU/qWhZOdBNPJM+kqr9eCgh0k5lY:cjpFhNNlizXT28dFfPdkqstJmE6/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647425186, "uuid": "85c1fe4f-1b04-46ea-b9ca-4bbea0fcf088", "value": 33750, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647425186, "uuid": "e37b6f3a-7e68-4490-847d-0b35edb6ef64", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647425186, "uuid": "e518452f-fce0-4ad1-a576-9d7985e7300a", "value": "2022-16-03_0950.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69282e68-a519-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647428909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647428909, "uuid": "e107c53d-f135-4186-a560-332456b34f69", "comment": "Malware payload", "value": "77e571ccf7a49d9358557787b8e26102", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r09", "colour": "#5B3928", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647428909, "uuid": "0d2abc67-7e87-4f4c-ae1e-221a360d8407", "comment": "Malware payload", "value": "92f66f27c2101277e9b7158ac15961cb38b1c7979b7ef98bd943bf8c6caf28ec", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r09", "colour": "#5B3928", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647428909, "uuid": "50c08889-7d80-48b2-88b4-610774b2c37a", "comment": "Malware payload", "value": "c088983714ffc92e433ae306cae0e5673e1a3062", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r09", "colour": "#5B3928", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647428909, "uuid": "d9cfb068-a788-47e6-a53a-401bed3da4ac", "comment": "Malware payload", "value": "405540326e410e05b4a70b1aadba9f0165287a23a3c2eab6fd84eddd81f7992681b1e4bef73bdc7cba9cf0c0eea929f8", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r09", "colour": "#5B3928", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647428909, "uuid": "590d0624-8b22-4a99-a4b1-9ed6070ac8e6", "value": "T14625336F487378E0FB7411BD976BA21C33768BB5638266C36D652A11E0490DE0B2E91F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647428909, "uuid": "33fb53bc-5704-4048-9214-99f9120647f7", "value": "24576:GxxhHMHlEOWeSvaAMV/7KXJ1jJb2I2lQSDraci4W4mqs:4mEaSmVuDdinaUrhifqs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647428909, "uuid": "5342ce22-e543-47d9-9b5f-7e0f400c76ac", "value": 986400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647428909, "uuid": "3dde4b3b-48d9-48a8-a3ad-4c5161e0cf30", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647428909, "uuid": "d022b568-8ab2-4392-8195-2e0d1fc1c16b", "value": "Remittance Advice slip MW-INVOICE.r09", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9cb34fe-a533-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647440185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647440185, "uuid": "04e4d849-7891-4924-a942-3739d0bdb224", "comment": "Malware payload (AgentTesla)", "value": "20d80bedca81966b064bf7cd0092a9ac", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647440185, "uuid": "a3e39cc0-c9a4-4858-9870-676cd652486a", "comment": "Malware payload (AgentTesla)", "value": "9366fdc967537a3400787d6eeff2b91ea6816c3fb1e0d40dae2edbd84e0e8ff8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647440185, "uuid": "780d420a-89d6-4462-9048-ba0dc245d958", "comment": "Malware payload (AgentTesla)", "value": "7e72bdaa09eb2b81662bbaf07d2f5d014a0c6114", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647440185, "uuid": "7d448d95-7997-4e76-820a-62d2e97e866d", "comment": "Malware payload (AgentTesla)", "value": "f366005035e0b6b0d9f9c7ecd71b1215a10338f38c0e1d909f0267cdb0c87617af3ca24101f5a79440c310f97971ee51", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647440185, "uuid": "efa528b1-be47-4ecb-8cf7-68a321bfc743", "value": "T12305122533EC8B23D6FE5B3BE8A041064BB7E1132962D74B19956DFE0993B540A107FB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647440185, "uuid": "2de767cc-4a55-43ae-a4ab-b810900e699a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647440185, "uuid": "b79f28cb-67ac-4cd0-854d-0496c0a292c0", "value": "24576:V5R3wO0i5gu6kd0BHEo08EvfdBDh6uGWaRn:V5R3fZguHwFsT0D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647440185, "uuid": "740c0ccf-07e0-448d-8672-5b046533d3a9", "value": 821248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647440185, "uuid": "313d9c1b-ae72-4d56-b1ad-84fe9b572a6f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647440185, "uuid": "82ecdf96-cc97-435c-9a3d-2cc25748dc16", "value": "4500183423.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "520e160c-a4dd-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647403101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647403101, "uuid": "d12f0444-7a21-4c7f-937c-eee6e640f2f6", "comment": "Malware payload (Heodo)", "value": "64b43efdc6c19a29684a2efbdb82a6eb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647403101, "uuid": "75c7712a-e9e5-4bda-9e8c-33450a308d80", "comment": "Malware payload (Heodo)", "value": "936d384f38cca96fcd3bc02bb0db26a3386d881b4054dd068974bd93e497d917", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647403101, "uuid": "69910c02-ee5b-45a4-bf9e-566bebff40a0", "comment": "Malware payload (Heodo)", "value": "08e65f0bb9a54c978b14f94155acdff9bd8f1cf6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647403101, "uuid": "2dc32527-3fc1-4d48-98db-d79aec856be6", "comment": "Malware payload (Heodo)", "value": "e22f0ac8ffd1cb06fede86013cf6f5a44806a9334d494c18f9f7c6c9aab2ac3eeb557fc0500c8f8b3e986c709ea8df62", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647403101, "uuid": "2d39ab80-cd56-40a3-a27e-1db8b97d9206", "value": "T137257C107E8A817EC71B85B30836676D6FFEAB204B6CA1CB478175ED2D316C29B36705", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647403101, "uuid": "60b1e5fc-f4eb-4a32-973b-8a9c861759b4", "value": "087c9809507dfca4c3283e6c7539e91c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647403101, "uuid": "b8712ad3-5550-4af8-a92c-ae703b20079b", "value": "12288:cR5SOyRHiA6m0OcElfzt6JtcS1j2xKkr:cR5SOrKlfzEtcK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647403101, "uuid": "0ff9becc-1251-4398-89b4-78034d257453", "value": 1040384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647403101, "uuid": "6342c113-bbd1-4479-87af-dffea7230c67", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647403101, "uuid": "103f7230-beb6-43cd-8afb-3856160258f1", "value": "64b43efdc6c19a29684a2efbdb82a6eb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68afc1e1-a4bc-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647388965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647388965, "uuid": "6ce1f32b-5197-45ad-a5b7-d1076b5717e0", "comment": "Malware payload", "value": "5efb8671dd4bd33e4968526777d6a9f6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647388965, "uuid": "b9a338e9-a41b-4104-a1c7-5f15d5961dc3", "comment": "Malware payload", "value": "937e8cf5c406f171696985b30f88d3e91f1d6c69e7489e2e4ea2609c641f7bd9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647388965, "uuid": "7e8d3e91-79ec-4bfb-80ac-955da2e5b3fa", "comment": "Malware payload", "value": "19964feea9f117f8b5fe80b25db63ccd4706e85a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647388965, "uuid": "50d5e06b-63ba-4db2-8f99-f12843843447", "comment": "Malware payload", "value": "899b05f4e351c51e4ee9907bb316be6d3baef17834596e11cc650e69600ad1cb7b90b1f3efdde59e6cf31bbe3d07e611", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647388965, "uuid": "57585031-98e6-49d4-9771-9ad4d727c3b5", "value": "T1E113D5256FBCDC51E11954B9E663C5FC4868EE06D42EFA33DAF53C26B27DA42241E203", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647388965, "uuid": "a2cd2756-24b9-4545-9d6d-86f673137a1e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647388965, "uuid": "12744db9-6777-45ae-827d-45ee9da66ae7", "value": "384:gFQF4NvUQJ82pF9orMvRNC+0gkInBHRrfE6RwaO4JWUPW:gOXp2pFpy6n56qZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647388965, "uuid": "94f884c8-b591-4eb0-908a-97aff65bb992", "value": 43520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647388965, "uuid": "cb82b4cf-2075-4337-9507-0c0fb94f7e3b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647388965, "uuid": "6b4d1231-9044-459f-80d5-1e65e3c2289b", "value": "5efb8671dd4bd33e4968526777d6a9f6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e89de614-a50b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647423110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647423110, "uuid": "31135afc-6758-405c-8675-1747c3007f48", "comment": "Malware payload (Heodo)", "value": "3c9556f7b4575e9aaa7cbf1fcae6d6fc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647423110, "uuid": "844dae89-a733-4130-91d7-af99041e9089", "comment": "Malware payload (Heodo)", "value": "938619617340590ea07140b97c5ade5490be07a6e51fc4a7be39edb0fdec07c0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647423110, "uuid": "557fc0b7-8b71-4753-9d77-5b16739d6454", "comment": "Malware payload (Heodo)", "value": "74b33062c5c3b8d4f861c1f7eea251557100bea5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647423110, "uuid": "4efc20e0-a6ea-4191-b99b-d3fd42e5ecb1", "comment": "Malware payload (Heodo)", "value": "d5fcf66d831cb59ebbee585a0133ad6bfd9176d82dd21a06f7c39608d75d2577e2a6386845045b460eba9e7d82b88210", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647423110, "uuid": "71ff1291-fcad-4ab8-8650-ac95505c7220", "value": "T170E47C12F461B2B9D04B04741F1723A86EEF5E518629CA13AFA8ED5E1F31251FC3FA16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647423110, "uuid": "9ed55f49-3927-46fe-b7d7-ce241e222280", "value": "066d4e2c6288c042d958ddc93cfa07f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647423110, "uuid": "58533bc3-61d2-49be-a65b-914133dbf081", "value": "12288:DtAanana8Meee0GBGu3qI+3DNJ3vE6v5eJxS332d7t5hT/hexLx:Kanana8qGBGuoNxEjxCM7o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647423110, "uuid": "cc64563b-a013-4166-8490-2e484c02310e", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647423110, "uuid": "b959e5bf-24ee-4f91-af95-8e490ae94048", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647423110, "uuid": "1afebf46-3ae1-48a7-a70f-cd9f25e63487", "value": "3c9556f7b4575e9aaa7cbf1fcae6d6fc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9cc312f-a57c-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647471538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647471538, "uuid": "be1ac77f-ed6a-4696-8908-756c3e21e8cb", "comment": "Malware payload (Mirai)", "value": "c84e5d7861b2ea56c99f5e6ada5ee414", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647471538, "uuid": "555b8112-b699-47a5-b318-5fd966d96c9d", "comment": "Malware payload (Mirai)", "value": "951d43c0a8aad5ee05101394e10e94f845d835aca6b5e77dbe9c6fe521dde057", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647471538, "uuid": "28c60ec1-0ffc-4c69-b4af-4985aa6b7392", "comment": "Malware payload (Mirai)", "value": "7e6111cd753039c71df6f128576bb0de3ea1eafb", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647471538, "uuid": "0153a244-5c68-4eaf-97f3-c2a2c8b23d98", "comment": "Malware payload (Mirai)", "value": "d7e47f2228f2b9dde9acdf44e49b0f32a6a913e6964d04008f58412763a7e5b3014b34d4abd1f1396617fd4adce4945d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647471538, "uuid": "5f09779d-eb48-4106-a917-30228f990ddd", "value": "T11633D717BF654EA7E45ADC3B9DA90F1524CCD08720687B762D70D018B14684F8EFFAA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647471538, "uuid": "4960b9a3-d165-4e60-ae6f-13804c513204", "value": "768:bCOvlrivBN5tN5/x2eg5ecxbCpIiXiTRFbOy3EUNlUZyEOPZr8JUZHB6G:pivjN5gd5rxIAOyZlUAEO8J+h6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647471538, "uuid": "622942d6-1e5d-4e11-8f9c-2a6f1601b206", "value": 53180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647471538, "uuid": "d0dd600f-32c4-4b53-91a1-ad86ba98e286", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647471538, "uuid": "0342e0fa-1625-4a40-b42d-615f850d219e", "value": "mpsl-20220316-2258", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "716800ee-a519-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647428923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647428923, "uuid": "c315cb0c-676a-4d68-8b9e-0ff127c914c3", "comment": "Malware payload", "value": "15bedf4b0ea58ea21601b933e5a507be", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647428923, "uuid": "ba8f1118-de92-423d-90e7-97a323375627", "comment": "Malware payload", "value": "9569a90f6b819ef81aecedcb7fcbd76d07cbc24bbc8b100e558a71699c44812f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647428923, "uuid": "5e5fd9bb-9dfa-44d0-b69f-876c7388920b", "comment": "Malware payload", "value": "7c19c661468290489a8278c1d68c9789d35c3b1a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647428923, "uuid": "dfeaaa76-2d1b-40ac-a2d0-d377ef5a6e39", "comment": "Malware payload", "value": "69a00850557cc73dc82c544111e719bc60b648b752b10285040cee1cf5a1b4939f34cb787946e97b29176167c164acf0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647428923, "uuid": "700a012b-d6c3-46d5-a9a2-af02916b2710", "value": "T16835E09D339072DFC8A7C872DAA85C24E731B97B131B8607A41716ED9D0E697CF205B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647428923, "uuid": "be1c5f99-e837-4248-a53b-c0db06e4c16a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647428923, "uuid": "6bb74778-1114-4a74-bbd4-446b9b426d1a", "value": "24576:gwOHrynjGPh8CVaT8TFT5x8xQKPyDyUkoaSe3bN/AcH:gfYjCh8CVakDx8x9y5kse3t9H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647428923, "uuid": "e9f1d264-ed7f-4cc9-814f-8dc2973e5e34", "value": 1094144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647428923, "uuid": "5275c701-e552-418f-85ad-498b4a4dca7a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647428923, "uuid": "c4bd9e3d-49a0-43cd-8753-4499474e4768", "value": "Remittance Advice slip MW-INVOICE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f911971b-a568-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647463081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647463081, "uuid": "4e9cc39e-a0a8-44da-bc25-497479919179", "comment": "Malware payload (Heodo)", "value": "6d9f099af78b3855a3867ba2f54af3be", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647463081, "uuid": "e5021090-d1a2-446a-80ca-88d591fe4b13", "comment": "Malware payload (Heodo)", "value": "95abee21735f595a571e58721b23d938b6163271cea5245ed4ea0116f2357216", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647463081, "uuid": "48816372-6884-4fdf-9b93-d55304060a6f", "comment": "Malware payload (Heodo)", "value": "82c42e16cfb50b8cf3a9adf95ceb934eb724d29b", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647463081, "uuid": "ea52e8cc-4180-4085-96a4-5fd6109e680a", "comment": "Malware payload (Heodo)", "value": "b411147bd5de2ed95df457216a6b31a73b6d6bcecb8cfb5d97aa6d0145643f2a1ec345d086185ebc47e2f7494a26a039", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647463081, "uuid": "49435701-2405-4fa0-84ae-9a5f2c257fec", "value": "T128E2C02DF2A0EE1DC21EE939446895DA421DB4558502EB4FB95CFB1D2F0A5C23B1F0DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647463081, "uuid": "deb83328-946f-44b4-ba72-93311916a52f", "value": "384:QjzZPFhNjqEBOA7iEibbwBLg0SCdiVXUKgUrNU/qWhZOdBNPJM+kqr9eCgh0k5lY:QjpFhNNlizXT28dFfPdkqstJmE6/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647463081, "uuid": "e816782b-a793-4b16-a0ec-50a17a761a14", "value": 33750, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647463081, "uuid": "a89ebcdc-8c6b-4dcf-8f55-eca714e3a221", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647463081, "uuid": "c4fb3034-489f-4d8d-bf77-b83444e378e4", "value": "Form - Mar 16, 2022.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e56f1a4-a52a-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647436220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647436220, "uuid": "53427a27-68ca-4fec-9cd5-3a63ce7f2a0d", "comment": "Malware payload", "value": "3ce76029f876e6fbaa4797bea61c9d27", "object_relation": "md5", "Tag": [ { "name": "930", "colour": "#76BC21", "exportable": true, "hide_tag": false }, { "name": "list", "colour": "#E5D954", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647436220, "uuid": "e8df4927-547f-4401-86f8-2d876a8c8df0", "comment": "Malware payload", "value": "95bb90ace1663439d89ac9da29fbbef7d265a401a73e4aaee22edb080100ed17", "object_relation": "sha256", "Tag": [ { "name": "930", "colour": "#76BC21", "exportable": true, "hide_tag": false }, { "name": "list", "colour": "#E5D954", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647436220, "uuid": "9bacea91-5c63-4a9e-a6bd-fab24a475dc9", "comment": "Malware payload", "value": "68e8873db8728b745d2d87c2f921e4be5810cae7", "object_relation": "sha1", "Tag": [ { "name": "930", "colour": "#76BC21", "exportable": true, "hide_tag": false }, { "name": "list", "colour": "#E5D954", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647436220, "uuid": "2758ddfd-ad68-4bd4-998c-3d241a028be2", "comment": "Malware payload", "value": "8fba8447e5789ef792ddc08e4f029e9212c56ef46dde844a1e490be71a291e38094cfee59e4e3e94f8700320f8c7134e", "object_relation": "sha3-384", "Tag": [ { "name": "930", "colour": "#76BC21", "exportable": true, "hide_tag": false }, { "name": "list", "colour": "#E5D954", "exportable": true, "hide_tag": false }, { "name": "opendir", "colour": "#069872", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647436220, "uuid": "6ca26422-b122-4183-b846-e99a8ff7d89d", "value": "T1192360BDA506F0E1261C881773BBAC32E43FB5BCF795CAC188765D64B889151FA2D230", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647436220, "uuid": "fea8dd00-76f4-471e-be64-288ee215b40e", "value": "192:H+zHZGbGi7EJ9rzzu+517jhDStdDG3ilJcPGpbr:HOHwiAErrzzu+v7jhkdMaPX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647436220, "uuid": "b4409934-d7b3-43b9-a3bf-2ccc5d1310b4", "value": 46113, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647436220, "uuid": "8957dc9c-60bf-4b55-b188-7f335b8b48dc", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647436220, "uuid": "9fedaf82-2d4b-4840-b0f7-cea08970a530", "value": "New Text Document.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a14524b8-a56b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647464222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647464222, "uuid": "3f35aec3-fd2d-4598-9532-a0c7167fb9bf", "comment": "Malware payload (Heodo)", "value": "e0df1508822cb40edab55b0213e1d3ea", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647464222, "uuid": "1ab07e00-ce91-44ea-8b95-cb780095288d", "comment": "Malware payload (Heodo)", "value": "95ff97c8b1e88f9cae7c22f7a08cab494ae633aab5fbdf9da95812ee79faff13", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647464222, "uuid": "674c30fc-fb67-480a-9eb3-5c863c07cec4", "comment": "Malware payload (Heodo)", "value": "563fdb2948c55a969b319ef28b671539689ed7c6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647464222, "uuid": "5aec5af7-dc05-46ff-a0e2-7e701b6bf11c", "comment": "Malware payload (Heodo)", "value": "3f0c399ad066df3920aabd4ba74778287aa9e502aa57f22babf635bc30399c35366c2411ff571a82556f5f9da9a7dd46", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647464222, "uuid": "d3aab202-a7ae-4e4e-835d-a6788439206a", "value": "T1D5F4DF1176E1C076C1BF12304956A38D23FAFD509FB986976FD02A6E3EB41828E34767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647464222, "uuid": "8e8cab04-5143-4389-839b-2d7f413da618", "value": "66a21a1bcb4077b3ed89c00ee693486b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647464222, "uuid": "55eaab6b-e045-4933-9358-f5c9b535c44a", "value": "12288:g6O4TpP0XjxCCFJuf07j+Xk7h98rLneTfABCJoWRWwfpW:BeCCF88j+Xo8OTYA7pW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647464222, "uuid": "66e1db4e-b54f-43be-a6f0-e6998f768820", "value": 749568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647464222, "uuid": "2f40c29b-fd0d-4396-9fca-a14baa64d3fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647464222, "uuid": "4ffcef6f-f7de-4570-9e33-9c7ffd1f7675", "value": "e0df1508822cb40edab55b0213e1d3ea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8080fdf-a55f-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647459080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647459080, "uuid": "c07e703a-18f0-4e6a-9159-59f03aa09c46", "comment": "Malware payload", "value": "5a25582c5a7f77b60d6578f39d7dbddf", "object_relation": "md5", "Tag": [ { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "TA570", "colour": "#FA88CC", "exportable": true, "hide_tag": false }, { "name": "tzr02", "colour": "#BAF7BA", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647459080, "uuid": "96f22acc-5d24-4a9d-b76f-59778a7b0236", "comment": "Malware payload", "value": "96271d8b862a72e67647e555dc326e3fd77ece426a63427b8bfae2d8e821407e", "object_relation": "sha256", "Tag": [ { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "TA570", "colour": "#FA88CC", "exportable": true, "hide_tag": false }, { "name": "tzr02", "colour": "#BAF7BA", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647459080, "uuid": "56aa208d-33f3-427a-9d06-7f268c80e227", "comment": "Malware payload", "value": "dcb0ecb1aff5733faf20b578c0881c35043f516d", "object_relation": "sha1", "Tag": [ { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "TA570", "colour": "#FA88CC", "exportable": true, "hide_tag": false }, { "name": "tzr02", "colour": "#BAF7BA", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647459080, "uuid": "231b260e-7345-4b2f-bc62-6c91a63ca318", "comment": "Malware payload", "value": "8beca9a5476eb022c656d8bffe59cd7b476c0b1511a50e0829523821e5f8dc47b4c6fd632ace5ea19c06997be9c23830", "object_relation": "sha3-384", "Tag": [ { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "TA570", "colour": "#FA88CC", "exportable": true, "hide_tag": false }, { "name": "tzr02", "colour": "#BAF7BA", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647459080, "uuid": "ccb3bbf6-cb94-4ee2-8b83-b3b81c73f6e0", "value": "T120930282AFF7DCBDAD9503B1813B65F711361EE22CF8C131ABE6984E0D0715545DAA83", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647459080, "uuid": "a0228393-2b52-41ea-a0f7-c5c1928d1b1e", "value": "1536:QNxS58z0ZmN/GldriJ5RAxeMABPBA1I8jedwpje3FkIiqfcFbu1CdFw2OBgV5IU8:Sxm8zBRuduJIAxaze6kFkIiqfcFbECod", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647459080, "uuid": "14e09b28-e031-4ddf-9d32-9358111093a6", "value": 93340, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647459080, "uuid": "b1b2e8bc-fc90-4f85-860d-f4d1c8948cd9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647459080, "uuid": "21a77ba6-3bdf-44be-b129-187863617b4f", "value": "71176047803.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf8a944a-a564-11ec-9275-42010a9c0029", "comment": "Malware payload (CoinMiner)", "timestamp": 1647461293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647461293, "uuid": "686f8998-ccaa-4703-a27b-76b8241cf174", "comment": "Malware payload (CoinMiner)", "value": "4b94edba4f2c21015a5220e40e348fa3", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647461293, "uuid": "4156f5e2-f4a3-4955-8763-fd7003ccdf06", "comment": "Malware payload (CoinMiner)", "value": "965de9a48decafacbffec3e87e3585769025a114117f06d5cbaa1b02c5e11d18", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647461293, "uuid": "5153035b-aa46-4750-a863-32eb520ebbeb", "comment": "Malware payload (CoinMiner)", "value": "863a8e1dd9982b6c90e71312fea25a1035eeea47", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647461293, "uuid": "9a6076fb-dd14-460b-9fcd-bcba772b5a7d", "comment": "Malware payload (CoinMiner)", "value": "5158a1d762cc06a085b15407680140cd0606cfcea16c95d96ffa37c2f2e8ec6274eaf444db63f018d7233f6c79205761", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647461293, "uuid": "b3f6baac-7fdb-4caf-a98d-91319cd26255", "value": "T19ED6D0F726D16AADC11EC0FBC250BC7FCA5FB5B14A66B5A38556B3729A17C00B224F04", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647461293, "uuid": "f4550e56-4d17-4d23-bf3a-6f2edee64966", "value": "a56f115ee5ef2625bd949acaeec66b76", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647461293, "uuid": "03155330-776c-4f8f-a669-35bf5acf8612", "value": "196608:UaQOYCtJZAZ9uU2n8iPhGDY5w1DpGpCNUWYeENwDXMZm/VsOsUaxI:UYYCbaZgBswapGLeEiDXMZm/C7UqI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647461293, "uuid": "c666cbb6-d3f1-4fd4-b3fd-edbf48ad3fe8", "value": 13203988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647461293, "uuid": "60b5b85f-4e8e-46b5-b3f1-eb7d8438e941", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647461293, "uuid": "44998338-e008-4729-bbc3-3faeb7269657", "value": "10355064.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc3b9190-a4ea-11ec-9275-42010a9c0029", "comment": "Malware payload (CoinMiner)", "timestamp": 1647408970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647408970, "uuid": "0489ffe1-9b84-4512-88e9-6230c78911f5", "comment": "Malware payload (CoinMiner)", "value": "c7c100f067cae777f90b6fac5663e408", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647408970, "uuid": "cbdf33ea-3488-4a00-8eae-32213ea4b18a", "comment": "Malware payload (CoinMiner)", "value": "9674345f5db2690b81667d39ed232ba8337efe7d46e66d39eff9abcb1c37d645", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647408970, "uuid": "de924cd7-adcd-41ce-889a-6fa6021c1e72", "comment": "Malware payload (CoinMiner)", "value": "9002787c005241c0e30b1b764aee632a2294993f", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647408970, "uuid": "8addb8ed-afe4-481e-8e16-7ad9487fe07c", "comment": "Malware payload (CoinMiner)", "value": "a66afcfd86e4e183730f11289312941e7dd9f1e97dd6bb68988d629d1f91f70717bfae16aaa759cbc4ba4d73c91fabcb", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647408970, "uuid": "d9395e8b-fceb-4984-9cac-8b1b19bfe2ab", "value": "T131C5CF6D725081F9E6AF9038C81A480FE7F53499536495EB0AA457DE2F237D0CA3BF21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647408970, "uuid": "e0809088-4a58-4025-9117-a130736a42f0", "value": "06677e0249fee8274fe149dc2d352c10", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647408970, "uuid": "0150ddf7-6782-4371-85f7-794f38b032a9", "value": "49152:00wjnJMOWh50kC1/dVFdx6e0EALKWVTffZiPAcRq6jHjnz8DhJUjc2HhG82Di1:00GnJMOWPClFdx6e0EALKWVTffZiPAcT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647408970, "uuid": "b294d188-1af4-41df-8abc-4655de82b1c2", "value": 2693133, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647408970, "uuid": "8d564711-243d-40a5-b259-62a4e16ea705", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647408970, "uuid": "e862978d-7800-4ebe-8b5c-f81e856e0bd2", "value": "976p.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5139734e-a519-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647428869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647428869, "uuid": "7ec54226-8e69-4d40-89c0-60789c46838f", "comment": "Malware payload", "value": "80290d88f03778c6d88c2cd19bb45fc0", "object_relation": "md5", "Tag": [ { "name": "r09", "colour": "#5B3928", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647428869, "uuid": "04032261-5618-4ef6-ae64-e6281001fb76", "comment": "Malware payload", "value": "96a60d96a9c8e69f856830198de14d7baf8331802e998c51ff61e3f9710e7f81", "object_relation": "sha256", "Tag": [ { "name": "r09", "colour": "#5B3928", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647428869, "uuid": "6ef017b6-9b8a-4c83-9cbb-82c5e60d7f1e", "comment": "Malware payload", "value": "023504fb435a5e6a9fb25e5a306b93b90011dc0a", "object_relation": "sha1", "Tag": [ { "name": "r09", "colour": "#5B3928", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647428869, "uuid": "b9b7f69d-46d1-4e0d-b213-e49595bf712c", "comment": "Malware payload", "value": "160ae057c9292fa575bb29bfa7ac00dcaa9ea834613fd5965d477a863ae0362425e06d5dab4608af474052af5951efba", "object_relation": "sha3-384", "Tag": [ { "name": "r09", "colour": "#5B3928", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647428869, "uuid": "6e7cb4c4-6f91-47be-9b11-6f5b0986dc61", "value": "T18525334297224662AFBDA9FE998EDCC7D8406F2E3740316470E3554F26D9B94C813EF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647428869, "uuid": "8ff69379-4e20-43a3-bb09-452ab0039bbc", "value": "24576:d8Y18vexTjSgTPOUFy9b5dfvKnMs18JCf3yVmhUY:9+e1jSGRFyHdKnFaEfyVnY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647428869, "uuid": "4c9f9982-b6bc-462f-bb75-5a544d0e7998", "value": 1013561, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647428869, "uuid": "23e84b87-2eba-4b77-b577-50a2e0abc8c2", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647428869, "uuid": "67e624f5-5b98-43be-9cb6-55b79d5ac0f9", "value": "Remittance Advice slip.r09", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec569031-a4ea-11ec-9275-42010a9c0029", "comment": "Malware payload (CoinMiner)", "timestamp": 1647408943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647408943, "uuid": "8f544a6a-1356-4374-9bae-8aa835f95c8d", "comment": "Malware payload (CoinMiner)", "value": "f23308a283a1647e4fc761348385635c", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647408943, "uuid": "a45a0d89-a29c-4475-b239-6a9c92e064c4", "comment": "Malware payload (CoinMiner)", "value": "96b2891248451be6cdc7d95797c5c19583402ccffdc0a42cf1911d20b69ce0c0", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647408943, "uuid": "da3b40c3-b03e-4256-bbaa-3d45bd17c22d", "comment": "Malware payload (CoinMiner)", "value": "e516fe9daf0c4de1f7a660fc879c78fef69a1808", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647408943, "uuid": "2d4bab2d-21b8-495e-94ee-f8264fea5880", "comment": "Malware payload (CoinMiner)", "value": "095cef14735f7908fa6e834eea25f20b8c62badf34f8df28150360306072281add567b304cdd26764869934e9bd795bb", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647408943, "uuid": "6bb2fc67-fd9f-4930-9342-96a073e2b00a", "value": "T12ED5DF6D725081F9E6AFD038C81A480EE7F53899536495EB0AA157DD2F277D0CA3BF20", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647408943, "uuid": "8da5d168-7f3f-4fda-9fee-9cff5b375108", "value": "06677e0249fee8274fe149dc2d352c10", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647408943, "uuid": "2c0efb2f-e237-4161-b797-255988c2c62e", "value": "49152:00wjnJMOWh50kC1/dVFdx6e0EALKWVTffZiPAcRq6jHjnz8DhJUjc2HhG82Di7nZ:00GnJMOWPClFdx6e0EALKWVTffZiPAcn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647408943, "uuid": "6c3f62c9-54e9-4002-b40c-748edff12eca", "value": 2822669, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647408943, "uuid": "73c2dec0-16fc-4dc3-91cf-fe67e6f18f6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647408943, "uuid": "5328c212-84a1-47de-b5f6-64cc119f9423", "value": "96bg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "859b3603-a4fb-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647416072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416072, "uuid": "9bcadc9c-db3b-4196-9522-b46ba4167513", "comment": "Malware payload (Heodo)", "value": "f99dbc188e2eca8160d987a136224cd0", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416072, "uuid": "24722d13-aa7f-4a7c-925a-9ba234a85b05", "comment": "Malware payload (Heodo)", "value": "974adccaad821ff09ec951268a4ca2e51459f36dbe3b3a35a016ede6de145d63", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416072, "uuid": "ae0ae5c4-2d4a-4595-8f31-886e9d71a758", "comment": "Malware payload (Heodo)", "value": "4870d6fd1b12f04a0065753401f8184e4d3219b8", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416072, "uuid": "e0c40cba-3eb5-4f95-a186-80754cc63225", "comment": "Malware payload (Heodo)", "value": "bd409034b1d17c628e8aefbc2333d3cb21ec6a781dfba3dbc025678fa878488866b85291e349f0024ef243364ae113cb", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416072, "uuid": "b336afec-dbfb-41d9-ac17-94bc42788b38", "value": "T1BB33D00F9A22B5ACC3136C3CCA8C55F9650E5592A0C9F72B08857B9C7B1B1E7179F282", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416072, "uuid": "df1d5dde-20a1-48e6-bebe-a6496e7b99d3", "value": "1536:kkcEEt24xZdRBzH9hJBrdEwwNXekVIcog:9cEe2Kd3zdtdEwo/z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647416072, "uuid": "6a6ff1a1-190f-4ee5-a6d4-c3b5fb7b11a7", "value": 50643, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647416072, "uuid": "ef33280b-e6f5-48a5-bc1b-a906ecf5a011", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416072, "uuid": "b2a11f8d-d16b-4a0e-99dc-92edda40364f", "value": "OMICS International_2.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f584319-a4e0-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1647404492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647404492, "uuid": "f0a3b0ea-d5fb-4130-b983-0d6448877c68", "comment": "Malware payload (Loki)", "value": "6f233cd70aa6de0c93c5421c6b2618a5", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647404492, "uuid": "514b5bb1-03c4-4ba2-aa64-31db5d067cca", "comment": "Malware payload (Loki)", "value": "97837fec29a2ac0cdf10600d976e39fb312f65c6ca9193811d1d2f28d53fa322", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647404492, "uuid": "551303b1-e6c1-4108-963c-12389634828a", "comment": "Malware payload (Loki)", "value": "6f716e65c2f3260fded4e92710644078973e6d5f", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647404492, "uuid": "74b7e6fe-6b02-4321-a074-63cfbfcc452f", "comment": "Malware payload (Loki)", "value": "0935a114ff20db1879ccb1c72004d5d15516623f2d513fd22a34efe61a591a124d2526aa8da414a4426daa80cb7dbf21", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647404492, "uuid": "fbf9130a-5997-4e43-bc1f-697087594f08", "value": "T195141251F8DD165BCCC2263FF2BAC95800E6EDB2E142E81A21D3B35B39366740F64675", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647404492, "uuid": "204de777-7cf5-41cf-8cc5-997fd6058956", "value": "3072:turqm1dp1xx0QQ545XsKF+eKbWUZ9R5eanNUTnIwA5G3xnguMrxFI/fYMqLXO:MrqAdp1QQjznKDbeoOnVAIxgt1xNLXO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647404492, "uuid": "9001e58e-f395-473c-9433-91df260ede00", "value": 190584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647404492, "uuid": "de32ab86-0d54-4083-9c50-223e787999ba", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647404492, "uuid": "a4abe061-c53d-42a4-b37c-ec47618bcc80", "value": "SUN221101.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bf1526d-a4d6-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647400138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647400138, "uuid": "36a8be79-e0d3-4394-8874-1426b13109ad", "comment": "Malware payload (Mirai)", "value": "70fcda979decd7e4bb1fddb104e9398a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647400138, "uuid": "dc35529a-6ca0-4d84-9cef-47867b75733c", "comment": "Malware payload (Mirai)", "value": "97b3bf3e7015231ef11d0bac1f81ef101f35b3b7a568748b2d4136c4f8988534", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647400138, "uuid": "4a9cc703-2926-4f0f-928e-05fdbf700ccc", "comment": "Malware payload (Mirai)", "value": "9d72ae890c9be84a04480013d75a63be912ec554", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647400138, "uuid": "a8b2fbeb-8faa-439a-bcb3-d3ff641879a7", "comment": "Malware payload (Mirai)", "value": "c86e9e40dc442e678732bea1917e7480ca02c19e6b0f81a8bfbd574afee752e3d599fd951c2a68cfc6f7af7598bc31b8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647400138, "uuid": "a49098ca-f3ac-443d-a66c-9e181cd90422", "value": "T192B3ACABF24B1861C85306F407CB4FDE6F5721C2AF5BC9E32D6A253B18750DB190AB85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647400138, "uuid": "daf25358-85cb-4059-9629-516b41d70377", "value": "3072:3aYsKspxh94uQXsnFAoCaduCx/gEW4kqR:EpxnFH7gIbkqR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647400138, "uuid": "4f31a674-185b-4777-a31f-a80f8ec978ef", "value": 117288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647400138, "uuid": "c3424702-daaf-4f5f-99a3-162365de91cc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647400138, "uuid": "21c34815-67a9-4e54-b379-b4ce236a6abc", "value": "70fcda979decd7e4bb1fddb104e9398a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8865d21c-a4bc-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647389019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647389019, "uuid": "f11243cc-5024-45b2-8f72-c146f83d7ddc", "comment": "Malware payload (Heodo)", "value": "0afdc6af81d0ae7adc10b52f8e22ae9f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647389019, "uuid": "3a20f7f5-50ca-4c16-9e48-83a00d0d9d0b", "comment": "Malware payload (Heodo)", "value": "988071ec0cfaa43f7398bc1c21932432c7d7d9eaddd0cc2ef77780aec5d6f787", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647389019, "uuid": "5d75306b-2d60-48ab-bf5c-0297aa60f081", "comment": "Malware payload (Heodo)", "value": "b3b4003cfd6456deeebb2869d813f904f19b8bed", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647389019, "uuid": "b189f935-d0fa-4bda-9933-664b1bd43c34", "comment": "Malware payload (Heodo)", "value": "539a32aa9a5ce59f53d73498b48907ba0443739d22a502fcd2ca17fb1a747a851f3d0149114f1c43fe3ab3e1cd3d95f3", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647389019, "uuid": "569ae9a0-a964-462f-8139-9dfb5c1a5dbc", "value": "T1CBE45B3071F74031C3AA1D3905D2DE64DAF5AD4B87B2F0D32F99AB4E99F5AC12B20616", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647389019, "uuid": "413014d9-0fca-4062-bfe3-5f406454d55d", "value": "a38617efee413c2d5919637769ddb6a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647389019, "uuid": "da438d97-26f4-428d-b165-293d2e0537ba", "value": "12288:E94YBCR2xP7guDo463OP4eIsiSOZjb2woE+MhJT:2kRAguDogPEddb2woEBJT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647389019, "uuid": "bf16826f-00b6-4db4-b830-ba0f9711d17f", "value": 684032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647389019, "uuid": "9e31f43d-3bcb-4355-bb40-3e304a835312", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647389019, "uuid": "5fdd4136-7240-45ac-bd82-badf888c6232", "value": "emotet_exe_e5_988071ec0cfaa43f7398bc1c21932432c7d7d9eaddd0cc2ef77780aec5d6f787_2022-03-16__000334.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69af3824-a4ff-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647417743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417743, "uuid": "023942f9-242a-4133-9bfe-7ea1d233cf2a", "comment": "Malware payload (Heodo)", "value": "df531ea22c71dd5b573b09772435824e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417743, "uuid": "1079b7d4-1b39-4ead-9a78-91dee4556864", "comment": "Malware payload (Heodo)", "value": "98ce8e65abccc99588d5c81620215c363d5f713d43a21adc925464b68e7461c9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417743, "uuid": "0cd8a2ad-2ac3-4ec3-8f84-9aa1da3ea23f", "comment": "Malware payload (Heodo)", "value": "d2e625ea8603bbce8d05da9a9f13ed34fca94d7b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417743, "uuid": "945f04ee-8a54-4224-9800-1fae7720d749", "comment": "Malware payload (Heodo)", "value": "de7c51947e20fed60defc7f8194e2a545767edae1a2574d861dbcdbab6ef2fd5ec9123ab4404af717fd11a6831b1d4f6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417743, "uuid": "88246a8c-573f-4bc1-a6e7-6bf14fe7bb14", "value": "T130E45B06AF22A1F0C06B03B40555125AC6EF7ED0A72ED657825DFB7EDD339973A30226", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417743, "uuid": "e4d0981f-ee7a-4389-a80a-b3118346c4fb", "value": "066d4e2c6288c042d958ddc93cfa07f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417743, "uuid": "7ba2c96c-4f18-4997-bcb5-426e9e91f959", "value": "12288:jc899XKPmN4WMkoZ6ZPJSFTdtXlcIL9v6O8:7GP7SgFTdFL9v6F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647417743, "uuid": "f9db2a7d-f22f-4fb3-bb60-74a2b4d1913e", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647417743, "uuid": "2d6fdd11-f397-42be-8019-7e03b339d4f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417743, "uuid": "ab8424c0-61c6-4e6e-80ce-e908c8299700", "value": "df531ea22c71dd5b573b09772435824e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dfea8bc-a56b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647464217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647464217, "uuid": "daa0630f-322e-4b11-aab9-cbffaa0def1d", "comment": "Malware payload (Heodo)", "value": "8221eb52267dfed47a0295a5b7efcd7c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647464217, "uuid": "ec9c2ab7-e590-437a-a538-020a0707b4d7", "comment": "Malware payload (Heodo)", "value": "98ee4f1f8437ea179acfb5a563a1a3ff982d4604924cd46daf1ba8b155caa514", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647464217, "uuid": "50ff0a14-3e4a-4d9a-9a80-29de8099f46c", "comment": "Malware payload (Heodo)", "value": "f327deeab1b0f805acf5feffbfaaefdd015ef070", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647464217, "uuid": "76b28fec-c34e-4abc-a84c-d9730ecd4bdc", "comment": "Malware payload (Heodo)", "value": "d254e0c768295b96a1bf6cb2648ab7ed33d30efcbad3400f8f623c335072da923714d9ed5d4a47e3ddbe242c852302eb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647464217, "uuid": "7448019d-1592-45b7-8f20-e19a0595a118", "value": "T109F4DF1176E1C076C1BF12304956A38D23FAFD509FB986976FD02A6E3EB41828E34767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647464217, "uuid": "6272deaf-5196-4403-974a-e6465b015475", "value": "66a21a1bcb4077b3ed89c00ee693486b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647464217, "uuid": "d22750de-36ba-430d-8738-14a861bb74a0", "value": "12288:g6O4TpP0XjxCCFJuf07j+Xk7hN8rLneTfABCJoWRWwfpW:BeCCF88j+XE8OTYA7pW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647464217, "uuid": "95edf3cc-4fbf-4921-b14a-892ce9a7e631", "value": 749568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647464217, "uuid": "4d9cc1e6-124c-49cf-a117-0e87be9b2d38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647464217, "uuid": "349b56f4-e714-4f11-89a1-ec3d37c88946", "value": "8221eb52267dfed47a0295a5b7efcd7c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f152cde6-a568-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647463068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647463068, "uuid": "5e0cdb4a-d6c2-4655-9abd-b113af09e617", "comment": "Malware payload (Heodo)", "value": "417652ec95dda02abff6a0cbcc360939", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647463068, "uuid": "b4875fa0-cd2a-4336-a124-c88595ce3f14", "comment": "Malware payload (Heodo)", "value": "994ba7f749763102ba7088e5e90be60dcd587cc156858a5615a216655096487e", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647463068, "uuid": "d4df3b42-446a-49d7-a415-f61a8e8952c0", "comment": "Malware payload (Heodo)", "value": "40c488ab67418accb69e2f51d23d18fcf7664d95", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647463068, "uuid": "59b32f25-afb8-404f-8416-a9ae90fa0d16", "comment": "Malware payload (Heodo)", "value": "cf230909ae663c505b5730997472b941db907bed0527961c625eec08538bf744d3929137b35deb96d2b21fad12b6475b", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647463068, "uuid": "9e9975f3-777b-48af-8ce9-67345d4ee064", "value": "T1EFA29D2D96216849E37BA83CD20644EA818E1C122143F9DE3495FA6C7E337D7078F6ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647463068, "uuid": "e060a350-d634-4b0b-b0a0-b9204333bcc6", "value": "384:sDuAi/NjG93S8EibbwB3sLSYrLb5CzgObff9kC+xbXy/8vrEjZSV:osNs3zXasjFCBn9kC+xbi0vrEm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647463068, "uuid": "5d18cdfb-89f0-460c-bfe5-7de59462c684", "value": 22708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647463068, "uuid": "834bf5f8-08fe-4e13-a708-e95a37a059b8", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647463068, "uuid": "d5d53b8c-ae33-4239-bf79-8ad191f4f78f", "value": "1603.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5f78197-a559-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647456607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647456607, "uuid": "ba3fd046-02b9-4282-9811-e1c99e6fe135", "comment": "Malware payload (Mirai)", "value": "aeeef69003e7525a818742a190e0b351", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647456607, "uuid": "4747348f-5321-4a56-97b7-f749822f9159", "comment": "Malware payload (Mirai)", "value": "9a11e592a3fac8ac08310a551aede611c9c1dcd26f2b063436e3c2c6114a1594", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647456607, "uuid": "267d919b-ccbf-4ae1-8a29-fdf291ca9ff4", "comment": "Malware payload (Mirai)", "value": "64da3777d8625d949d45f609158c7607d5651558", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647456607, "uuid": "f0313db8-c97c-4915-81c7-08ec648711c1", "comment": "Malware payload (Mirai)", "value": "bb28718f083a36ea6e54c4129f069262b14851509ee32ced851d5e19096b7d68681ba91b4e5d92d34f12cb53dc791515", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647456607, "uuid": "6dadcb5e-6378-4334-a51d-81a2796ff6d9", "value": "T137634B45BD919613CAC413B7FB1E018D372623E8E2EE32179E256F1137CA96F0E67142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647456607, "uuid": "7aa6f489-6c5d-4f6b-8032-457a24270983", "value": "1536:hE8DbScPEHXZZaKw8tpS3HXz3ZISEzZf02tiGv1Q:hECOcPMXZVdpS3HXz3eMO1Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647456607, "uuid": "0e78511f-e239-40dd-a27f-9d46b4b8bfa3", "value": 72196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647456607, "uuid": "76c26f17-52b7-4711-a7df-9e1622d6c5ed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647456607, "uuid": "f05372d4-242c-49dc-9800-c905a622f2ba", "value": "arm.cloudbot-20220316-1850", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "989c48bd-a50d-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647423835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647423835, "uuid": "2908f0a5-7b3c-47c9-8957-bdd1ad5313e9", "comment": "Malware payload (Heodo)", "value": "089007f70fbf2c744689b3cc051fb48e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647423835, "uuid": "d5fee3d8-bd41-482f-a062-862b994e2970", "comment": "Malware payload (Heodo)", "value": "9af5729f4475f367b9cb2e2fc8378cb1dbe63838a7f349b0b581da45b18dfd5a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647423835, "uuid": "5ab4f643-126f-44f6-bbc5-0487a4f84944", "comment": "Malware payload (Heodo)", "value": "a8b8e9ae7a2daa3bfc21d02a67a64b6cc98e780a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647423835, "uuid": "4a0cdb19-5d7a-48c8-9af1-78b4f33dd32a", "comment": "Malware payload (Heodo)", "value": "2bda94d2b820a0b47baf70acf7acb82c3fb9cceec9382b486196e9734c97c5f35e0e90bb9c9f3ec1da9bc885164cffce", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647423835, "uuid": "9b4f786b-35be-4ed3-bd68-bdf949c33976", "value": "T1D1E47C12F461B2B9D04B04741F1723A86EEF5E518629CA13AFA8ED5E1F31251FC3FA16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647423835, "uuid": "464dc410-53f9-4826-b10d-dc5c812d7b7b", "value": "066d4e2c6288c042d958ddc93cfa07f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647423835, "uuid": "5506e5d3-18f4-4b51-9e85-9737742035a9", "value": "12288:DtAanana8Meee0GBGu3qI+3DNJ3vE6v5eVxS332d7t5hT/hexLx:Kanana8qGBGuoNxE7xCM7o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647423835, "uuid": "437095fa-5f4f-47d2-8543-75c79c9ce4c6", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647423835, "uuid": "091c8c33-4685-4443-94b8-ba0d1f0fbdf1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647423835, "uuid": "0156e420-b074-452f-8a27-683011422bff", "value": "089007f70fbf2c744689b3cc051fb48e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad3fc257-a4e9-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647408408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647408408, "uuid": "c2d7b799-f1be-4346-8c81-3be27387c238", "comment": "Malware payload", "value": "2bded542fec22b4b06a04cab1ee5326e", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "javascript", "colour": "#5DBE2C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647408408, "uuid": "b49a2c3a-760e-4a9c-a0d3-be2056ae6d35", "comment": "Malware payload", "value": "9b02aee6333606c06eb530617db453a7f22a96ccb5d8f1900275220d452e1da2", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "javascript", "colour": "#5DBE2C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647408408, "uuid": "3407f790-463a-4469-8655-24ffcd5be9df", "comment": "Malware payload", "value": "ee2b63d3ab1f8c3fd0b0fa0bbab8708dacb7b857", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "javascript", "colour": "#5DBE2C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647408408, "uuid": "7953bba2-b55b-4cd0-8776-7425cb855ebf", "comment": "Malware payload", "value": "4fe7700b350bd1ca98fe7d4b0727b87aee8a71ffb711615fe8abcb706e06288d2e4738bc56665895104ce2c0799f39cd", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "javascript", "colour": "#5DBE2C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647408408, "uuid": "009c68e1-826f-4e50-af04-c0a75d593290", "value": "T17A51CBDCF9C3F1155263A832997F428BB23B8AC24C4E6604D795659ABCB040AD677F8C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647408408, "uuid": "5115976e-b65a-49c8-ba85-898ea48bb741", "value": "48:lmI++x4S9wJDTWrl9NZQoZh2+bqB/sdWdsg07HAEaSJe+Xku:1++x4mw0FQVB/sqVOe+T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647408408, "uuid": "abd6197b-ed3a-4ac8-86ac-531230187f8a", "value": 2940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647408408, "uuid": "6a5dd461-bd1b-4d6a-b4c7-2c8176ff1072", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647408408, "uuid": "1b2be880-882a-4a75-a41a-a496940e9c5d", "value": "cooldown.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f94fa109-a539-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647442895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647442895, "uuid": "83079718-6fa7-4c28-b84e-4eddb4a54070", "comment": "Malware payload (Formbook)", "value": "0b271247a5c363eaa2e8fa2fd13a93fb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647442895, "uuid": "f6b9c2bd-4de1-4cde-a723-3addc40c4218", "comment": "Malware payload (Formbook)", "value": "9b162a63a20e99fb024e521cdf2fa70d49776511d1fe6259275d1b50269e54e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647442895, "uuid": "6adfec10-dd96-44d8-9459-29d44b878cb7", "comment": "Malware payload (Formbook)", "value": "40d5e9ff1383693c8875638746830e6a83ed4113", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647442895, "uuid": "b72ee9ce-570a-48a1-a928-764f4fc93fa8", "comment": "Malware payload (Formbook)", "value": "2af2186ac3af7c19802c164f8a380353e3d4afa60ee3a62b68e7c4c74490b725eb181d2cd80c51c27a808189e530dc7a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647442895, "uuid": "01f8bc68-43b5-425c-bac1-932aaf8666d8", "value": "T1D46412B2A9D8AEF7D6D30536046EA1ADD7BE93F840359F1783B08E5E3C3A0474911266", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647442895, "uuid": "1df1853e-1ae3-48c1-8655-1f7d6908b01d", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647442895, "uuid": "a6cc7452-90b6-4505-867f-823e1c6e3b2f", "value": "6144:rGiBbHRJbzzxegSsvgWbxPkbhTWRakuLw2suaV57dYB7HpLP:tbHNUsvgWblkbZWRT72sHV578xP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647442895, "uuid": "0bf22431-b63d-4be9-b14d-0c29ff28bafa", "value": 312842, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647442895, "uuid": "51fa78b4-ad3f-4a35-8150-0936cb74f4eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647442895, "uuid": "154a6679-00b1-4b68-8e07-4ef0761e5493", "value": "RFQ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1035ff7d-a547-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647448517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647448517, "uuid": "5e61ce2c-378b-4970-9933-d0d4ec0cf191", "comment": "Malware payload", "value": "d08ad98e96362cd14d4c5b0441a90f15", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647448517, "uuid": "61d15f61-e599-47b9-9359-37059e66dc61", "comment": "Malware payload", "value": "9b50b93463b74bcf86085712d710821aac99f26dbcf305432a5315c987959601", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647448517, "uuid": "d1145968-cc18-42b2-923d-3b8dba9c1549", "comment": "Malware payload", "value": "194bc2a2fb7904da569e602549c5f85546cb0c7f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647448517, "uuid": "42d6325d-a680-40a6-ab68-80317a08faa9", "comment": "Malware payload", "value": "8f2e0d85972d1ee78a5891e3871cc12210aaf310ca479e4ec601325ff379c4c80e845b3ea8761530431c251806e7ca65", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647448517, "uuid": "beca4bea-4bc8-4700-8e8f-b45e69f8ed9e", "value": "T1F42522EF22C84F37C79D287BE85081C62B75D6271297BF421DC838E7448B725166A1DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647448517, "uuid": "507b75ab-d97c-41fb-86a8-c7e866422db8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647448517, "uuid": "8efb6d1c-757c-4303-ae22-2534399ba12e", "value": "24576:fwOQeaireAUUlo16Me57m/+F8Yu+XTrNK:ffQeair2Sk6uGg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647448517, "uuid": "ad72ad0e-a3ce-4149-865c-93b26d45ff55", "value": 1008640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647448517, "uuid": "fbc16dac-1e83-4665-aa84-bfd7a2ba6316", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647448517, "uuid": "38794f5b-d29e-46ea-8d42-8f31a3d1b27a", "value": "Harvest Global.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30ba4783-a565-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647461456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647461456, "uuid": "c79837ed-d8d5-43d9-8960-5c8825c39a90", "comment": "Malware payload (Heodo)", "value": "5840015e2af69e1a5ca652aba3fadc1e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647461456, "uuid": "dadf5786-fb9d-4b3a-93a4-7db5ed52fdff", "comment": "Malware payload (Heodo)", "value": "9b5874b0e1db59330bbc79d8fd5710b5f6c7c3845b7b0834043342af720d3fd4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647461456, "uuid": "2cde0b18-cee6-4f5c-91fc-a5800fd53956", "comment": "Malware payload (Heodo)", "value": "cc84dd1acbf9065cabe8f189c07d7d16a687176f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647461456, "uuid": "2124bc3f-6fb9-4bac-bdfa-58d0d3307be4", "comment": "Malware payload (Heodo)", "value": "8030d10825d37aa80dc952f718f34b974652f26dc574d49f91dccdb17cabd1be76afcdb9c6f0a3f74c2bc56c55f64bd3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647461456, "uuid": "0fd36ced-4c51-4c76-bee6-8209d0517a56", "value": "T1E3F4DF1176E1C076C1BF12304956A38D23FAFD509FB986976FD02A6E3EB41828E34767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647461456, "uuid": "4555857f-75f6-4eb2-947d-137b7cbbbf18", "value": "66a21a1bcb4077b3ed89c00ee693486b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647461456, "uuid": "9aa6000c-887a-4a52-b8a2-94400263be84", "value": "12288:g6O4TpP0XjxCCFJuf07j+Xk7hr8rLneTfABCJoWRWwfpW:BeCCF88j+Xa8OTYA7pW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647461456, "uuid": "8b6a227c-0968-4fe1-8534-3b7eea989cf3", "value": 749568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647461456, "uuid": "ae1a7920-7909-4d09-bc48-d947f0878aac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647461456, "uuid": "ceace4e0-c1b7-4ce8-8726-97d8fb9954e8", "value": "5840015e2af69e1a5ca652aba3fadc1e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74cfb98c-a4fb-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647416044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416044, "uuid": "8b846c58-cbc2-4634-b23c-81bf0e5ef00e", "comment": "Malware payload (Heodo)", "value": "4b0ea31d12836ecde5b5fdbee2fe875c", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416044, "uuid": "e6213538-4351-441d-bd11-bbe83eb1ffee", "comment": "Malware payload (Heodo)", "value": "9b5a3c1f133ee43aa61fa200991f8244a7d9b729b5b19895787a7f778c4ec555", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416044, "uuid": "bda610ef-eb94-4832-b3c8-9949a2ef3b83", "comment": "Malware payload (Heodo)", "value": "5519da54fa205d3776af1ac1b94c177901f7baaa", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416044, "uuid": "6a933016-caef-4bc6-8dc2-8cfcba3d1564", "comment": "Malware payload (Heodo)", "value": "8d096a5887e5c4a180c9dfa9010d7a4f650343268d100005216371fa48a7fd4f549dd7c278807c9696de2078cb463b2a", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416044, "uuid": "166e1633-c4c4-4044-be0a-fad9fdeb7161", "value": "T1F933D00F9A22B5ACC3136C3CCA8C55F9650E5592A0C9F72B08857B9C7B1B1E7179F282", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416044, "uuid": "1078cd30-9d23-446c-9288-ec0b19ba2087", "value": "1536:AkcEEt24xZdRBzH9hJBrdEwwNXekVIcog:xcEe2Kd3zdtdEwo/z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647416044, "uuid": "4889a1fa-a8f4-4d46-80f1-482848b9c43e", "value": 50643, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647416044, "uuid": "49bd0472-4f62-48e7-9c2e-4ccf5d4f8483", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416044, "uuid": "130f44c7-ee32-48c5-9b24-00e14a60ea1e", "value": "imedpub.com_4.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e88566a-a4e3-11ec-9275-42010a9c0029", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1647405672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647405672, "uuid": "9ef6a24b-c9d9-456a-8512-fc86b8392909", "comment": "Malware payload (RaccoonStealer)", "value": "c0270505461a49d4a97ef199d64335da", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647405672, "uuid": "9d0e1c86-a801-4646-8381-9c57469e3f9b", "comment": "Malware payload (RaccoonStealer)", "value": "9b6b3e2da4b70153ce7d7eec15834670a70a71e359f590ccdb3cef331e86a165", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647405672, "uuid": "2d6041fd-d8fc-4521-89d2-2f3d77296732", "comment": "Malware payload (RaccoonStealer)", "value": "cbe0ffd88ef85017a9d6ec8ec3ba712184231a00", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647405672, "uuid": "5382a3b8-0bfc-4920-a458-7cb5e338e337", "comment": "Malware payload (RaccoonStealer)", "value": "ba51cad4cd3d80f8ad3a8be3a9e24fbc47da4733e439670d70ee96f5750b56db190db804b890393c25057a815536ba9d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647405672, "uuid": "6df1ff68-66f2-47b1-878f-3dff5c6a733f", "value": "T119262363129A0049E5E9883AC937FDD132F623B54F82B47A71D6B9C731328F5E712993", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647405672, "uuid": "81081b48-8ecb-4fee-ac64-df320c3985eb", "value": "8d9385e915ba457c4cd1015b2fd5405a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647405672, "uuid": "5e16610f-6909-47c1-8eb4-d3626eb405ee", "value": "98304:iV3uJkHa5HjuJ6HZhvLKzxIm4+lvvDJqQWwU4kj:ituJnKJ6HZ92lIN+ZwDqkj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647405672, "uuid": "1b70e8b0-805d-4397-ae49-b039826ff630", "value": 4558336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647405672, "uuid": "36152946-1501-479d-ab9b-da485025fb2f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647405672, "uuid": "dac353a2-d0a6-445d-b1a1-29853a7dc462", "value": "c0270505461a49d4a97ef199d64335da.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d18c3a9e-a541-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647446264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647446264, "uuid": "e6152863-2e98-4783-a44f-9accfdb0d948", "comment": "Malware payload (Heodo)", "value": "48d4452b9089bddb05ca86f96802954a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647446264, "uuid": "347133c5-f87a-4a07-a190-bfc283de8b96", "comment": "Malware payload (Heodo)", "value": "9b6f0340dda2419c41e6c42b03eae26350589db85fa5bee54cf5d79b54d7ebfc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647446264, "uuid": "1dd6589c-ddf6-4f40-aa57-767c405db3a3", "comment": "Malware payload (Heodo)", "value": "727d6e609e7a77fde643760e4ce7cc9e4a817dcb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647446264, "uuid": "42a2f5eb-e186-445a-b893-91de6a411289", "comment": "Malware payload (Heodo)", "value": "1990893914894a0e51d5efaa1a1afa3fe7e387012aeb8c237a31275c496a3c18b8ce42188bb8ffb187d60bddd8555418", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647446264, "uuid": "ee49f39e-2c26-48be-99ee-61e1b2c2da19", "value": "T163E47C12F461B2B9D04B04741F1723A86EEF5E518629CA13AFA8ED5E1F31251FC3FA16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647446264, "uuid": "589241b2-8ad7-43ed-953b-944372b65de8", "value": "066d4e2c6288c042d958ddc93cfa07f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647446264, "uuid": "fbdcdda4-7b78-411b-b1d0-c1b50cc489e5", "value": "12288:DtAanana8Meee0GBGu3qI+3DNJ3vE6v5e6xS332d7t5hT/hexLx:Kanana8qGBGuoNxEcxCM7o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647446264, "uuid": "5fc74d13-def3-490f-a311-e8f01e8f3b48", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647446264, "uuid": "54bddaf1-238a-4b43-98f2-20d6cf13bd24", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647446264, "uuid": "10208f68-cc05-443a-a2ae-532ef6257868", "value": "48d4452b9089bddb05ca86f96802954a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58cb8487-a507-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647421151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647421151, "uuid": "2a428ee5-d5b0-4cdb-94f6-16a70e15b14a", "comment": "Malware payload (Heodo)", "value": "a53dacb8fbbbfdff2cc0a70ccc8e5804", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647421151, "uuid": "b4c0f5f3-7e65-4a87-b28c-be8fd5cc87d3", "comment": "Malware payload (Heodo)", "value": "9bc6a2be2565ccf61807ab556439edf4d647a74431441ab031543f4336372492", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647421151, "uuid": "b7037eea-d3cc-4889-a49b-ef6e11c58635", "comment": "Malware payload (Heodo)", "value": "833da3a3dd8e84741fd48cb0c5f259fcf5166607", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647421151, "uuid": "bcff7ad2-17f6-462f-9877-cbda00ca7780", "comment": "Malware payload (Heodo)", "value": "bc14572e0d9e66dc54f5f16690268b3e0cd4261d928530e328879cdec18cae20dde34f41e510dbd4d55270d96a9dc075", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647421151, "uuid": "2e87d412-8a88-4226-b6cc-0ca6fd8b2bcb", "value": "T122E47C12F461B2B9D04B04741F1723A86EEF5E518629CA13AFA8ED5E1F31251FC3FA16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647421151, "uuid": "9fb88727-6d1b-4e85-b29c-98fdb02295a1", "value": "066d4e2c6288c042d958ddc93cfa07f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647421151, "uuid": "0d4bc3c2-fc7f-459f-8478-76769f19736c", "value": "12288:DtAanana8Meee0GBGu3qI+3DNJ3vE6v5eKxS332d7t5hT/hexLx:Kanana8qGBGuoNxEIxCM7o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647421151, "uuid": "f4246b86-e56b-4677-b43e-f8a5204daded", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647421151, "uuid": "6ee91076-b447-4bed-a727-106a015853b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647421151, "uuid": "a2a81d6c-c0b0-41ab-8275-805b8406b654", "value": "a53dacb8fbbbfdff2cc0a70ccc8e5804", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffa1a580-a4f9-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1647415418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647415418, "uuid": "af837c5a-3899-4510-950b-b19b7c1ee250", "comment": "Malware payload (SnakeKeylogger)", "value": "289f8a17cfe2cdbabdd53c866a05730b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647415418, "uuid": "f46a3a7e-ccf7-411e-9bb9-acfaf9286b40", "comment": "Malware payload (SnakeKeylogger)", "value": "9c69d55f4d96510e0cb5d227aa07c9355ab9122ebf6f90512828d9d02ec08f8e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647415418, "uuid": "6e97d482-626e-4e68-a41a-678831b715ff", "comment": "Malware payload (SnakeKeylogger)", "value": "8bfeea49551fb1185bd3b344ad8b0e9554ec0874", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647415418, "uuid": "a6625548-4f3f-4eaa-a449-0150ca71a649", "comment": "Malware payload (SnakeKeylogger)", "value": "7807961df0b0d1c4728f8243db696fb8a352fe09f7e1dfc86866c0f0c0357cbf60f1b56b858e980088c0310302d58506", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647415418, "uuid": "6313c5e3-3e67-4610-8362-d1b9a0f9aced", "value": "T1F6F4125633D49B63C1BF5E7BE87042061BB5F6A37952EB0E5EC558FE0A83B5005007AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647415418, "uuid": "9f46a0e2-8907-4673-ae4f-efdf4170545b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647415418, "uuid": "765635de-92e7-4923-9ae9-42a77a2ba66f", "value": "12288:BXwOEqdo6urF/qtktWm9/2McjGXQHJNuD7S8UI7xpAnCo:BXwO7ofF/Ik0m9/ySAk7hNxpAnCo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647415418, "uuid": "77a85888-ca3b-4d23-96f2-d1127e3cd7be", "value": 729088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647415418, "uuid": "1818f1e5-4491-44c0-9ed4-e6703cfb6d35", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647415418, "uuid": "6e98a840-643b-494d-b062-ac37e143ed66", "value": "DEKONT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc668e8f-a573-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647467731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647467731, "uuid": "ff27fe93-9734-4a5a-bd12-b4af17f83fe5", "comment": "Malware payload (Mirai)", "value": "ba0566161f1c7510ab391206ffd4cd28", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647467731, "uuid": "4ccb45ec-20be-4952-9e3b-b55d35ab6f76", "comment": "Malware payload (Mirai)", "value": "9c78c60d2b9ab2af1dbca4194904df589c944873552291bc2ee17f0f7c4e9497", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647467731, "uuid": "2b9efc9d-8166-4d08-b420-c344afe199a9", "comment": "Malware payload (Mirai)", "value": "8c92e57d39071271b2866da970cb0534039ed184", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647467731, "uuid": "f279bed2-be77-4c61-9ab9-74d1410d2d4f", "comment": "Malware payload (Mirai)", "value": "6a836b6bfb822fb2c9c026ae7c6f278c11e032475171fe7bca2e5f2a2291295888456fc733ee43327da8ccaf32e81574", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647467731, "uuid": "0e8f6a7b-f5de-40bf-b8cb-eeffee813d71", "value": "T1F973A70A7E329FACFBA9523447F78E11AA5833D527E1C585D19CD6011E7024E381FFA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647467731, "uuid": "60b71ab1-0e4f-46f7-8455-8783d661c1e6", "value": "1536:3IHb8FMv77EKQHly1R1Fa6yBm3froxvdeEOPFal:Y78ivnEKMyZFa6yBmProxvUPFe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647467731, "uuid": "6e1cd11e-7944-4e05-ad75-3e59894438c9", "value": 76672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647467731, "uuid": "8f9dfa9a-304f-40a7-a68a-466929e35941", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647467731, "uuid": "1a21a63e-500c-4fa4-9cac-997d36cdde0e", "value": "ba0566161f1c7510ab391206ffd4cd28", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92aadba2-a532-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647439716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647439716, "uuid": "302592a9-9538-427e-943d-626f10e8bdbe", "comment": "Malware payload", "value": "e407a17d99063713da2dbdd41d256c44", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647439716, "uuid": "3bc81852-3afc-4f01-b3e1-b345a2ef7edf", "comment": "Malware payload", "value": "9d0de04d329b032b56c8196d553b79e333728caed8f1f38b3e232c94d6028b66", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647439716, "uuid": "2fe2943b-7fc7-4305-aee3-040665137b7f", "comment": "Malware payload", "value": "2197af267ed20707f30d759bd17ee91965aec999", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647439716, "uuid": "45e16304-a3a4-47bd-b6e5-8117e5b8c310", "comment": "Malware payload", "value": "ac5423a0a8d210e5fd4eaa3eb53f47346174f6e90426206f5ad8e89969859bd00999185af44619bcba526fc66bf61ada", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647439716, "uuid": "e0cb2122-6154-4b01-9e0d-476340fb9749", "value": "T11D1512FE23488A37CB9D193BD911C6C13772D6A3A192FB9335E5ADDA4A8732C0415387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647439716, "uuid": "0682d716-56a6-498c-a3b6-7ecaa8c52778", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647439716, "uuid": "cc55d854-e1bc-4858-8825-8dc48a03cdbb", "value": "24576:NiwOlFT8jEjLJERYgRh7q6f5/B96T9Sl:Qfv8jg25h7F82", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647439716, "uuid": "b76c9b8c-5abe-4633-a04e-e2ad2b896404", "value": 915968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647439716, "uuid": "3064d193-4942-4448-b2a2-5afeac4637e9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647439716, "uuid": "e4c546a8-743f-4065-b32a-233d1e8ae741", "value": "Dekont20221603.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d981cb4-a4ef-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647410878, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647410878, "uuid": "af767689-c148-4e66-9e1a-69dfe76885bd", "comment": "Malware payload (AgentTesla)", "value": "0dacbb28cef175c1e01560fe18e3ee70", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647410878, "uuid": "2e7db8ea-6334-4659-a070-dca3481e0889", "comment": "Malware payload (AgentTesla)", "value": "9dbaa30f9fbccd0821c136557992a8dfa6e1c92af89aa637807f18db7a7e7f78", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647410878, "uuid": "27a57f4d-abe4-4337-9adc-bb0310ef51aa", "comment": "Malware payload (AgentTesla)", "value": "61b84862a70a43ef54ffe00b8c15cb192e9d79a8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647410878, "uuid": "99c86211-bbeb-4b6d-ad76-4010c7724d68", "comment": "Malware payload (AgentTesla)", "value": "04f33146d5fc92fe16454ff4cf3d4a0778999b2b1c7a4efa67cc169a74553405d235f7594c25009f56cae7128c7c2eae", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647410878, "uuid": "aa0ba59d-159f-4afa-b360-17e8c18a1436", "value": "T14105121133E48F17D9EF5B3AE0B4414217B6F66611B2FA4A1BD168FB0A53F0185A07EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647410878, "uuid": "3275d473-ec34-40f6-94dd-9e953b784851", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647410878, "uuid": "405cd0f8-94bc-4563-923d-bef31162e0f9", "value": "12288:aTwOEkw0Gcz48ReEG2LT/Jl60Vqnwtkc6J05dYxPrgBckFpO0kRoiNMSdLthAli:aTwONwNKTBRYnwtaK5dYxDgakFhk7Mi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647410878, "uuid": "5037b0f6-75e0-4ae1-93b5-e09ca6801400", "value": 812032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647410878, "uuid": "81ec816a-a876-4966-916a-4189ebb02e47", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647410878, "uuid": "fabbf2fd-c7cd-43af-b34b-9fb32aad7c26", "value": "4219085.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1394c355-a525-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647433920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647433920, "uuid": "2f5c8e84-2369-4ee4-a89c-ae2730d588f9", "comment": "Malware payload (Heodo)", "value": "02cc75b3d235606edbcbe4266d4be5f6", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647433920, "uuid": "0f2ac994-4c49-4b2b-886b-f93493832071", "comment": "Malware payload (Heodo)", "value": "9e275dccfffe445f24430e39e87ba23d0f8633b6edbe12917a7df6d2f6d92723", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647433920, "uuid": "964ac5fe-665c-4a0a-a709-a7c1fbfe6adf", "comment": "Malware payload (Heodo)", "value": "7629c86ec8762285f2155ca2e09ac37954a188ed", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647433920, "uuid": "7bdf4d4e-e06e-4d46-8680-ad402ec42f6e", "comment": "Malware payload (Heodo)", "value": "82cb56a8578b0495a78b3b5aad07ef795c9c3550cac75cebd7ab211a4f3b4d2f6ac55e0589f4ad922694cfb451b15e38", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647433920, "uuid": "7f256bc3-fd38-40ba-b306-b9e4682cca76", "value": "T13DE2C02DF2A0EE1DC21EE939446895DA421DB4558502EB4FB95CFB1D2F0A5C23B1F0DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647433920, "uuid": "ac279103-1364-477e-b9f4-e8fbff97a48b", "value": "384:QjzZPFhNjqEBOA7iEibbwBLg0SCdiVXUKgUrNU/qWhZOdBNPJM+kqr9eCgh0k5lY:QjpFhNNlizXT28dFfPdkqstJmE6/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647433920, "uuid": "66936787-e82c-4fb1-af9b-e10fd396ab50", "value": 33750, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647433920, "uuid": "058d0ff3-d3d7-40b8-b287-92615cbb622c", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647433920, "uuid": "bd0e6e85-7f8d-441a-a1a6-5f5b87a49229", "value": "2022E000022120.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7ce327d-a568-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647463079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647463079, "uuid": "72687f7e-616c-4d20-bcae-5f9ca5d25d64", "comment": "Malware payload (Heodo)", "value": "8934a43fb2419e71c1d4fd4a6de4061d", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647463079, "uuid": "8d4d39dc-7cbb-437b-be30-8a474e05b51a", "comment": "Malware payload (Heodo)", "value": "9ebfce5805d0e207b38d0c8dbf627bb2864a0301b3c34ac06e5242bf29075047", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647463079, "uuid": "fd5ab2ae-78d1-4f35-be1a-affc39a54a4a", "comment": "Malware payload (Heodo)", "value": "474160a9fcf19e51549d32f2ea283009a429d6d5", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647463079, "uuid": "f4ab9e29-4138-490e-93ba-d3c514ccd953", "comment": "Malware payload (Heodo)", "value": "637905179c0148c211c3c359ed7f420335d12fa6d34b71c308c4d50ffce4f598bf76a9a6e6155ab5e0efda03ae93694a", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647463079, "uuid": "dbd21aef-e8b6-4ca0-93cd-81f8ab4b9da0", "value": "T105A2AF2CA521B80DE37A683C830640FAD64F5D023147B59D38A0BB6D5B7769706CFAAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647463079, "uuid": "0d9d0d8a-70d6-4a72-a8e8-15fc76e74f24", "value": "384:SyuAi/NjwS8EibbwBlwHSYrLb5CzgObff9kC+xbX7o1vfD:BsNyzXTFCBn9kC+xbLoN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647463079, "uuid": "41e855fe-5570-4d54-b9fe-430d20d5a0c1", "value": 21628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647463079, "uuid": "45b812d3-18ce-4523-98fb-a825eb163d3e", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647463079, "uuid": "bd580376-a0d4-4e70-a699-32d29d789eff", "value": "EFT.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60239240-a510-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647425029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647425029, "uuid": "3e55e9c1-4edf-4a64-ada6-ab6c442bd97b", "comment": "Malware payload (Heodo)", "value": "7d6a2727e842d5e60e99a215859eddeb", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647425029, "uuid": "7be9d233-8e22-4390-a04d-02a049d0055d", "comment": "Malware payload (Heodo)", "value": "9ed41ae21d2e1127c0b8ed916d3efcc1317a374a1431af9955943684a3be8da1", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647425029, "uuid": "1ca60f6d-16df-49c3-8f2c-78a804a7a12a", "comment": "Malware payload (Heodo)", "value": "c588bb5161b0c3dca6895b7169f03e5f8600b902", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647425029, "uuid": "8f62a78b-708a-481b-a187-1ed5663f9383", "comment": "Malware payload (Heodo)", "value": "945d13fdefdd828b68167881e8e859a79e5b0146ad8d6c50cc2a921bb4d38f2ac1e588470387bcf028908d3bdd0220e3", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647425029, "uuid": "aba8a99a-b211-4bca-85c6-f7d65fa4294d", "value": "T15FE2C02DF2A0EE1DC21EE939446895DA421DB4558502EB4FB95CFB1D2F0A5C23B1F0DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647425029, "uuid": "bbe6b9b9-32f9-4dca-80cc-9b72203c535a", "value": "384:MjzZPFhNjqEBOA7iEibbwBLg0SCdiVXUKgUrNU/qWhZOdBNPJM+kqr9eCgh0k5lY:MjpFhNNlizXT28dFfPdkqstJmE6/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647425029, "uuid": "fe14ad3d-24bc-414d-be19-bdd1a274d0a8", "value": 33750, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647425029, "uuid": "b04fd04d-94fa-462c-bf88-1d4a722a9877", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647425029, "uuid": "8368cc71-1099-4cec-80ce-71b1e3548366", "value": "gescanntes-Dokument.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c27692c-a505-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647420298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647420298, "uuid": "e182dcbc-872b-4c8e-9c62-26fe94252b74", "comment": "Malware payload (Heodo)", "value": "4294c3f9ab2756be129e5678195218e2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647420298, "uuid": "8b38feb4-0b7a-445a-ae00-80161eda520d", "comment": "Malware payload (Heodo)", "value": "9efcb2cf7918a04b3ce888630622f86788f4a23e0c97249500faac8b6fb5ed07", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647420298, "uuid": "592dd252-3b8d-4bff-97b4-a293186de39d", "comment": "Malware payload (Heodo)", "value": "2f38932d142b5a408405b86ebb29397b333a429c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647420298, "uuid": "235eba70-31b6-4a42-b384-3be873ed4896", "comment": "Malware payload (Heodo)", "value": "d60734bfcb73d1b3abded9a1aafc4e6ac86413c15e7616f06a1a963e5ff6ac5071263692898e92c17f971fcf2819afa4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647420298, "uuid": "ebf3e0bf-8ef1-4861-8725-c70cebd257eb", "value": "T191E47C12F461B2B9D04B04741F1723A86EEF5E518629CA13AFA8ED5E1F31251FC3FA16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647420298, "uuid": "6fc5f580-46f0-4881-8213-de5c05b68891", "value": "066d4e2c6288c042d958ddc93cfa07f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647420298, "uuid": "25bddf8b-f500-405b-a9b8-e3da800b96a2", "value": "12288:DtAanana8Meee0GBGu3qI+3DNJ3vE6v5eIxS332d7t5hT/hexLx:Kanana8qGBGuoNxE2xCM7o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647420298, "uuid": "0985e007-d1fa-4e06-af75-12f06d4dd76b", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647420298, "uuid": "f906d850-b410-4721-9fdc-04994398c4d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647420298, "uuid": "647f1734-7082-49c5-91c6-524bc1db7db9", "value": "4294c3f9ab2756be129e5678195218e2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "082da1c6-a4fc-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647416291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416291, "uuid": "ca7dcf69-3d15-4c2c-81e7-65a7c7ff1d3a", "comment": "Malware payload (Mirai)", "value": "edc8410d201705d27a496ece928a3efc", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416291, "uuid": "622f6bac-e20f-4f16-8d16-48a7ab9f0957", "comment": "Malware payload (Mirai)", "value": "9f7f54982ce2d8192a2ca915b6a90f6a3cb44a96326f8149defe018d7d5aed46", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416291, "uuid": "f5256bf3-cfba-4728-ac4d-83218d34df5e", "comment": "Malware payload (Mirai)", "value": "ad29b8ff18481b005617a631d8d16ef0ff61fbaa", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416291, "uuid": "fa4ebaff-059d-47d1-b8e4-e7ed9c36f7fb", "comment": "Malware payload (Mirai)", "value": "57605e648bc2fc191462df2384a09ff59748e3ea8055cbf65c670972bb4c099562c408527d6020d4e2b1f70daa9fc2a1", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416291, "uuid": "ccfe01bd-cd9e-400e-83ce-9759a25ce6c5", "value": "T1C273C519BF610FB7ECAFCC3749E91B46298C945621943B367934C818F68B25B5AE3C70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416291, "uuid": "b149ac1d-9d73-4ff7-815d-60cd1fc6e8ab", "value": "1536:cJfEFvGQrH19rskjDosd0dTRIROY9lbWZephJT:cqGQrH3rskjDou0VebW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647416291, "uuid": "995a1eb0-bb06-44b3-825c-0e688abcdc91", "value": 78244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647416291, "uuid": "7ed0b202-2887-41e6-b51b-e47cb87b3b19", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416291, "uuid": "50a4a616-8faf-4147-aa44-2dc7fe2abb60", "value": "mirai.mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5efc710-a4f0-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647411536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647411536, "uuid": "ec7d1ee8-0912-4800-aada-b0c8a5c643f8", "comment": "Malware payload (Formbook)", "value": "1ffe43c6112372a2e57123074f40dd96", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647411536, "uuid": "fdc1cd85-ed85-4f31-8a65-6dcd5f240f35", "comment": "Malware payload (Formbook)", "value": "9f88ac4f3600b2aca3e1c2ffed88f336dfa6330de095b1c579feb55b500d9fe0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647411536, "uuid": "de7049c3-b0a0-4d41-9e4b-95860f168da3", "comment": "Malware payload (Formbook)", "value": "5e6c0fb3e6461937be5ed0339f235015a681427a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647411536, "uuid": "b8759a7c-dad5-4662-aba3-d71d52793132", "comment": "Malware payload (Formbook)", "value": "4261826c55892ba291891bf9a4cf5853d21e7668858bfb73b46fe77f499eb22548b2adb2f0db31a8018a78ef364b83b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647411536, "uuid": "39afd0fe-1b09-4c88-a612-b1b4761d697d", "value": "T1C0F4122633E8CF52DABF6973F970511213B2F922A5DAE30DAAD414FB096375586103E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647411536, "uuid": "cac51ca4-be80-4e85-bafa-e7e5781e5a02", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647411536, "uuid": "d53f894a-9087-437c-8533-bc37989b59e3", "value": "12288:kPwOEywCeA5Zjj9grUdFov1qUELDp/ROCkpR7DPrxi5EIWr4raf+ye0M:kPwOxbt5hjKrtQLDJ1otDPdiAyVY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647411536, "uuid": "f21eeff0-f4c1-4977-b756-7279426b5b32", "value": 762880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647411536, "uuid": "279be956-b50b-40ec-9dc4-073de0627c55", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647411536, "uuid": "4639724a-8348-4851-b19e-a16f95b49fac", "value": "MC INV220304-2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d8e0816-a568-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647462766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647462766, "uuid": "1aa5e54f-ccd7-408c-a89c-885e65faea99", "comment": "Malware payload", "value": "b7588fe1148af55929fd8f8e96287c1d", "object_relation": "md5", "Tag": [ { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647462766, "uuid": "1e87073e-2e03-48a7-98e6-55e65dddd126", "comment": "Malware payload", "value": "9f89117b827cd7928e0a8729f6cc49127730553274d18601d6c6fd3fca7b8c9e", "object_relation": "sha256", "Tag": [ { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647462766, "uuid": "8864152f-d052-40ca-8782-ccdd77715aba", "comment": "Malware payload", "value": "7f06b8bae3f1be6674a1e3dd86c704d6d9661e2a", "object_relation": "sha1", "Tag": [ { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647462766, "uuid": "c3819815-dcfa-4aee-945e-74ed533938c9", "comment": "Malware payload", "value": "f7d90800e543366f5c7316e5d72074b62bf6fefaee4e94d9ecf9efdf691ba2ebb35daeb8416319251346c9d276e71778", "object_relation": "sha3-384", "Tag": [ { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647462766, "uuid": "2917ebd3-a709-45fa-95fd-c211d7851a2a", "value": "T1C3D2E034758C3D31A1B8090932CB228568B32795253F708467689079FB61FF57D2FA7B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647462766, "uuid": "7c5881e3-239b-4750-95c6-4ba9e602cede", "value": "768:c+33SawAT1gZNPQrfp8YWa0QtlcwsMX+/PUrXN5F:13Hw416NPQrp8YWlQtjX+/ePF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647462766, "uuid": "0737f542-c70b-4269-971f-b0b3a5b0bc08", "value": 28562, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647462766, "uuid": "55af933d-723b-4fc7-9647-1c5fa7e11300", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647462766, "uuid": "844fd0f2-9925-44af-890b-2543bc84275f", "value": "2022-03-16_1830.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04eac688-a509-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647421869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647421869, "uuid": "31da8780-a5a8-4203-b287-ee94d8f1e49c", "comment": "Malware payload (Heodo)", "value": "8ac9dec2ccffee4d37463e88b24a50d2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647421869, "uuid": "9ae7af5b-0f59-4bb2-8a94-029ad11e9f0b", "comment": "Malware payload (Heodo)", "value": "9fda9f1db16fa57bddc2d72faa4f93c090c02f23261d1c31981631d3401ba5a6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647421869, "uuid": "0aa178d7-ac52-4ac6-999d-dee3ab378052", "comment": "Malware payload (Heodo)", "value": "186718ef0a6e703b5e2067adbce977b97beb1baf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647421869, "uuid": "fb1c3ee2-e856-4dd9-b28e-9b0a994dfbe6", "comment": "Malware payload (Heodo)", "value": "7f37563967ac1c710225b65f2e14c400540c0492d0a6c7bea263b78a9bc911057f1702dfa4ef2f0992b087a6647d2efa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647421869, "uuid": "ff3e0003-7ae0-444b-a913-f455c2641a64", "value": "T14FE47C12F461B2B9D04B04741F1723A86EEF5E518629CA13AFA8ED5E1F31251FC3FA16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647421869, "uuid": "890ff357-4957-4a27-88b3-ca785d299863", "value": "066d4e2c6288c042d958ddc93cfa07f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647421869, "uuid": "da2b8295-0721-46df-91e8-dc6821af8838", "value": "12288:DtAanana8Meee0GBGu3qI+3DNJ3vE6v5e1xS332d7t5hT/hexLx:Kanana8qGBGuoNxEjxCM7o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647421869, "uuid": "61998048-117d-417f-96f0-1c4cecb326c6", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647421869, "uuid": "7f1d8e77-190b-47b7-b9cd-bac01a2abb9f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647421869, "uuid": "2c154df8-c470-427f-bc7e-862b25f9f587", "value": "8ac9dec2ccffee4d37463e88b24a50d2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61ee6741-a535-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647440923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647440923, "uuid": "33c6b928-6660-4a31-890f-97fbfafdf15f", "comment": "Malware payload (Mirai)", "value": "bbf744a97e6d3bb5f46df3932899a928", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647440923, "uuid": "03fe12aa-4547-40cc-a02b-a1a6d1ad7ea8", "comment": "Malware payload (Mirai)", "value": "a0feab7c6b7c3752f8572e45986cd828b30c0322f2db1c70b8b6152d77a90efd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647440923, "uuid": "895f8884-6418-42e7-85bb-30fdcfc4dd1e", "comment": "Malware payload (Mirai)", "value": "e2c0ea181ce80877395ad01762ecc3310fd08b1e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647440923, "uuid": "fd87322a-fb7a-47da-9d68-0126f8827f2f", "comment": "Malware payload (Mirai)", "value": "0e4d93f5b5211a6dde5fbbb132f3a806a4392326132a157dd7408eaa79d44e6febbfa3ee4e49e2067be1b16198c80750", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647440923, "uuid": "ab9b2a36-ff11-4f06-8f83-0b4cd6dd7c5f", "value": "T113D2D1B263958070E0581A75FFA9904E135FBF7C84D6F0777A40413CD6D252F28B9EAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647440923, "uuid": "de5e3209-7338-40e4-8deb-fb2210183c51", "value": "384:ad3Sy+LhqEyTuV+MDG9wqfRcX4ncFqnAG7IJz8FECPNO5QU8qj1b02+mdGU5Er:ad3S5Lhx+eqfiXWcbtagR+3Uo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647440923, "uuid": "b3f31e47-d56e-48e4-8b1d-1256353ce9e2", "value": 28620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647440923, "uuid": "6488dd10-1b3f-49ab-bbe7-7c267177f414", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647440923, "uuid": "1f005660-4dcb-46f6-aac0-be2819733273", "value": "bbf744a97e6d3bb5f46df3932899a928", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39250bdc-a565-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647461471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647461471, "uuid": "6b5c44c8-af7d-4f31-8003-fad336449fc3", "comment": "Malware payload (Heodo)", "value": "99d7ed5207fffa01c95600856b21b419", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647461471, "uuid": "194a9347-4c54-4d10-a005-10dc803930a4", "comment": "Malware payload (Heodo)", "value": "a0ff4a0c821c53ed4f26c3f9803817d45ea7e2d44ebc71c4ad00adf003f30333", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647461471, "uuid": "55207621-0a64-47c8-ad25-093c95b10d25", "comment": "Malware payload (Heodo)", "value": "a5901cd57cd5f19352fcdb2cacc768b8f57a3ff2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647461471, "uuid": "fcd9d031-b93b-48ae-a2f2-41fca9cc1d6e", "comment": "Malware payload (Heodo)", "value": "0619eee1ae728bb46ec701ab55a40946042c13609d8c2ad6d4e303e9ac3b7c6b543f64c0ed134b86874234dfef0111f8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647461471, "uuid": "e1ccef71-7d53-4374-bab4-0f64bc8d577d", "value": "T1B5F4DF1176E1C076C1BF12304956A38D23FAFD509FB986976FD02A6E3EB41828E34767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647461471, "uuid": "0bbdcce9-c18e-4397-b860-ce74475bc800", "value": "66a21a1bcb4077b3ed89c00ee693486b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647461471, "uuid": "02544804-88b2-4938-a5c9-b0d9d961623c", "value": "12288:g6O4TpP0XjxCCFJuf07j+Xk7ha8rLneTfABCJoWRWwfpW:BeCCF88j+Xn8OTYA7pW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647461471, "uuid": "53aeaffe-5a44-45dd-96c0-bc22eca7f453", "value": 749568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647461471, "uuid": "9d9103c5-ba17-42af-b938-8ee22b579ff9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647461471, "uuid": "55021f4f-0bba-4878-9a36-a602db895a15", "value": "99d7ed5207fffa01c95600856b21b419", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89cf5d7a-a4f7-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647414361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647414361, "uuid": "dafa0e7c-06c3-428e-b6f5-60fa7bc72314", "comment": "Malware payload (RedLineStealer)", "value": "4f0132be18ed27ae40237fa12d7ba1a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647414361, "uuid": "46075065-1a29-4c8a-b62a-1beef4b619dd", "comment": "Malware payload (RedLineStealer)", "value": "a19bebfc71e1b1ead9e5032ddc82f74e33da8f4984cdf7aeddf672ea662af633", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647414361, "uuid": "5b56a4e3-029f-4e63-9967-aebffc79dcb1", "comment": "Malware payload (RedLineStealer)", "value": "12cf9e98d8699e3082df36b9481207363e941a33", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647414361, "uuid": "3e6b556d-f32b-4288-8595-86a64cb68237", "comment": "Malware payload (RedLineStealer)", "value": "e2c9d22c10b1c685bafe8105835ccd8c0475a0c8fc7028cce2f3cc70bc1f1fbbe148cc48fc4208cdf5e0757bc22fd2e2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647414361, "uuid": "52e65b12-183d-4902-b7b1-3becd0eba7a2", "value": "T18025AD90FFD85283E6DB2D71C68EE320F0A1279E4691BC872E2C1E9DC59973341BB519", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647414361, "uuid": "df5748c6-da27-446b-857b-17b6e3e2bb0e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647414361, "uuid": "f4967040-b94f-4891-ad8d-ca27eba4d306", "value": "24576:HN2/V9j0z1PuJ56WiXNs8HR7B2j3wxpxki9lWp:Hk/X0d3e8HREj3wxU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647414361, "uuid": "082021a8-5adf-4fa4-bf83-fb73842439fa", "value": 1038336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647414361, "uuid": "653748f4-7d2c-4282-98ec-34f22f40a212", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647414361, "uuid": "6943c033-f944-441f-b070-58f192e379dd", "value": "QUO-15-03-22.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de410c0e-a50b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647423093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647423093, "uuid": "dbf83120-2be4-4a0b-af8a-ec46516c99e5", "comment": "Malware payload (Heodo)", "value": "0fc58fffb61e20ea9f3a48784e695236", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647423093, "uuid": "de10691a-164f-4b04-a53b-908719f2e201", "comment": "Malware payload (Heodo)", "value": "a21b374afa3bedcf28fd2b68ee987fc46f4235a5d4f2e9b0d4dcb03fc8d59daa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647423093, "uuid": "e151bf47-e4a7-48c5-ac8f-0a082dd1ab74", "comment": "Malware payload (Heodo)", "value": "8eff9d5d9b88bdc69239feab06910f9223cd2008", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647423093, "uuid": "d8f66734-dbdb-4203-b339-246d1a4a9d2f", "comment": "Malware payload (Heodo)", "value": "b88c0ac3d70787689fd84b5a532a73cacea26599b10dcfaf9db2d8cec2c3ab3c603702652df8851d8c35f8662c2a8d04", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647423093, "uuid": "504f0f53-1416-4821-8ae7-663c3df1da6b", "value": "T192E47C12F461B2B9D04B04741F1723A86EEF5E518629CA13AFA8ED5E1F31251FC3FA16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647423093, "uuid": "5c6d748a-5e32-44cc-8445-08fddf8a2aaf", "value": "066d4e2c6288c042d958ddc93cfa07f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647423093, "uuid": "238d119d-01f2-4f85-a6fc-c7d92739efb0", "value": "12288:DtAanana8Meee0GBGu3qI+3DNJ3vE6v5eIxS332d7t5hT/hexLx:Kanana8qGBGuoNxEyxCM7o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647423093, "uuid": "078d7224-3486-4f0b-8ae3-34045b87d52c", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647423093, "uuid": "862017ad-f710-4729-9d4f-7c8188776347", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647423093, "uuid": "757b3951-6163-4250-ba36-acd326572726", "value": "0fc58fffb61e20ea9f3a48784e695236", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2990abaa-a4fc-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1647416347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416347, "uuid": "ce702f0a-40a4-4916-96e0-cd9848f6df72", "comment": "Malware payload (SnakeKeylogger)", "value": "a7587a9b004319cbd9e99be63ffdd01b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416347, "uuid": "791a1d9b-732a-412c-b2fb-1f746c6b8df8", "comment": "Malware payload (SnakeKeylogger)", "value": "a24c29577829b36891f119e527d91a1c77e33df3e2d96eef668ccaa2e9a31672", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416347, "uuid": "2122c65d-058e-4e24-a9f6-aeeae857e229", "comment": "Malware payload (SnakeKeylogger)", "value": "082f0c9b62c1b1cda25e7d800bac1a0d1ed290ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416347, "uuid": "7abaff47-ef51-471d-92a2-ea42ebf6a3ea", "comment": "Malware payload (SnakeKeylogger)", "value": "929008cde76153a0a8cb729cfe53ba604e066e3bb449b3ee502b9f6b4e1fd63f00eca837386bdb3e5d1da05d230cc89c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416347, "uuid": "0f9428fb-81ba-45a3-bd87-aa94ac1507de", "value": "T1A2F412203398CF62E7BF6A36F17851111BF1F7A36466DB0E4ED104FA4AA3B5846503DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416347, "uuid": "91470bbc-9fe1-459d-978f-87da5508e09d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416347, "uuid": "fba883f9-dfb1-4074-a5b8-6bf56f30b7df", "value": "12288:aLYhwOEjQGcOhuAfxAOJHAbbMOlb9GLZVY7vQApt4ui94E4FEnE6:aUhwO2QrS5gfMab0LjwvQADW96FEE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647416347, "uuid": "d2417edf-055a-4446-9f54-bf43ccb0bf81", "value": 723456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647416347, "uuid": "37c30823-b22c-41e5-be19-68b624aa617b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416347, "uuid": "9d13d22b-20e0-47b4-a5eb-71eddb42b4c3", "value": "Halkbank_Ekstre_20222501_ 073653_270424.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "556c0fa3-a505-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647420286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647420286, "uuid": "665c667c-bfac-4c58-be94-b43ab6eb7ba9", "comment": "Malware payload (Heodo)", "value": "d81dfb6def8dc747aa61f4a0249c0009", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647420286, "uuid": "d958116e-253d-4c2e-a682-28bf389bceee", "comment": "Malware payload (Heodo)", "value": "a2d3909e646d79ab4f235c6bf6a744654979cbf1b4918e6e9668e9475433332a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647420286, "uuid": "70a4a660-ea44-4789-a2ae-f263c207081b", "comment": "Malware payload (Heodo)", "value": "433866be37c55ac78c4bdc96ab6d24f8f85c9772", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647420286, "uuid": "b6fe0b49-fee7-4e2b-9e26-2d0107a8a22d", "comment": "Malware payload (Heodo)", "value": "3cecd78d044f77d263e227776d60bb85e185094a8dd9bb1efce314bfe11a5aaa6278760a077957d653075ce79b133870", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647420286, "uuid": "273491f2-3ea4-473c-9278-9e888bc4205d", "value": "T11DE45B06AF22A1F0C06B03B40555125AC2EF7ED0A72ED657825DFB7EDD339977A30226", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647420286, "uuid": "2e988856-7fc0-415b-b3b6-edf861c8f471", "value": "066d4e2c6288c042d958ddc93cfa07f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647420286, "uuid": "94ae5834-21fb-4130-873f-99dde1729688", "value": "12288:jc899XKPmN4WMkoi6ZPJSFTdtXlcIL9v6O8:7GP7hgFTdFL9v6F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647420286, "uuid": "d5df99d1-dc07-49eb-be19-5320b973c69d", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647420286, "uuid": "c1354ae0-9a1b-4be8-a272-79c915c9e545", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647420286, "uuid": "417d7e8f-4b72-4091-8307-ed8006b95288", "value": "d81dfb6def8dc747aa61f4a0249c0009", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "969d81a6-a4fb-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647416101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416101, "uuid": "04ca8977-78a6-4185-8ed7-343d37ee5499", "comment": "Malware payload (Heodo)", "value": "5bd9c72818ffb251bdc0e5000fb9355b", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416101, "uuid": "2a8cb99a-bbc0-4db2-87b2-8650176fbaa5", "comment": "Malware payload (Heodo)", "value": "a2f434d88ab58d17789098629ba4b9d31f910bb982b04c1970a6ad701145ffa6", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416101, "uuid": "f8158325-3b65-44eb-9635-604151ff69e5", "comment": "Malware payload (Heodo)", "value": "2e6864f9cc869931ca647986693a41975fb70b73", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416101, "uuid": "811abc7e-b1cc-476c-b3bc-d6cfa698f694", "comment": "Malware payload (Heodo)", "value": "2c1e62287c9e18fdfb480f2481197dd51c12613b2491ea15137381bbe77603792a882513e34a4696b06a5b38fe6b33ae", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416101, "uuid": "e16ef2b9-8931-402e-a3e7-f98d61ce4f82", "value": "T100F2CF2DA3A0EF5ED61DED38849881EA421579154506EB4FA85CEB0D6F493C33B1F0DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416101, "uuid": "531a5c56-48c0-4b2c-a1d1-e66b911c14c8", "value": "768:IjFhNKbeXizXT2LxdFfPdkqstJ1goE6vS:IBTGeXgXUndkqegoE6vS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647416101, "uuid": "c81d65fa-af14-46a9-997f-4611d725c2e9", "value": 34391, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647416101, "uuid": "eacc2139-2593-4353-b0d6-ac785cc47864", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416101, "uuid": "220516fc-87ae-44ed-8e2e-2add6b06a7f3", "value": "Wire transfer info_1.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8eaf8cd-a525-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647434305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647434305, "uuid": "8a906808-2b1b-4dd9-ad70-10ed6bba08cb", "comment": "Malware payload (Heodo)", "value": "e878de8cc243503803f6000cb756673e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647434305, "uuid": "2368fa8e-32b5-433c-9435-fdf21c3ea645", "comment": "Malware payload (Heodo)", "value": "a3a1af592b33bbf757eb527d3434bd9f2cc48d314f65c2021ed1cf9a092e7fae", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647434305, "uuid": "6e93d91e-9e25-4005-8e68-1655229dd729", "comment": "Malware payload (Heodo)", "value": "12d459e547225058994fa9bf53d72a056954a3e8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647434305, "uuid": "24d86964-2812-4a2c-82a8-9762706254f8", "comment": "Malware payload (Heodo)", "value": "0aec664ca8269163447eed158a09917aad38f897e07ccabcc3a662ff5e9a6996c91f20f6cdc5190b069ac8d30c396f94", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647434305, "uuid": "f113c39f-5eba-4727-872e-55b97f8b2416", "value": "T18BE47C12F461B2B9D04B04741F1723A86EEF5E518629CA13AFA8ED5E1F31251FC3FA16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647434305, "uuid": "d21f739b-1424-44d3-b47a-c8eacde2af4f", "value": "066d4e2c6288c042d958ddc93cfa07f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647434305, "uuid": "fef01859-7cd9-49f6-b569-441ae0683eac", "value": "12288:DtAanana8Meee0GBGu3qI+3DNJ3vE6v5etxS332d7t5hT/hexLx:Kanana8qGBGuoNxE/xCM7o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647434305, "uuid": "c42a2510-228e-4707-ba3d-37b5342e1f32", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647434305, "uuid": "a17644d9-651b-4069-b244-5974630e82d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647434305, "uuid": "2dac771c-00b9-4c41-b9b5-95fe068bb3e2", "value": "e878de8cc243503803f6000cb756673e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e425c5a7-a50e-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1647424391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647424391, "uuid": "3b86f8e2-eb5d-4b0b-9cf7-a10b5508bec7", "comment": "Malware payload (Loki)", "value": "abcb1d5820d98fa14546fd4cdbbf37b5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647424391, "uuid": "d876ca6c-1efa-4cb8-a16a-caf2d5dbad89", "comment": "Malware payload (Loki)", "value": "a3c488e1af87fdd8ad0f25ceac2be542f0cf037616cbff76abf61ee8c7afb27b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647424391, "uuid": "b57648ec-a6a8-4a65-a58a-90aea7c20cfa", "comment": "Malware payload (Loki)", "value": "3220bc2149a7b150bed0918519b417282522ecfb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647424391, "uuid": "7fc29364-8a5a-47ab-a722-740149631dad", "comment": "Malware payload (Loki)", "value": "d231bbad3e52b1ad4cb887cd5c8b529e8bb078d40a685937d057a89f59217de1bc84695c316670a0506bf3c3c5a01cae", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647424391, "uuid": "58ffbad6-5d18-4dce-8ca8-52085675bae3", "value": "T1BA5412066BE1EEAFD6E2053306E7EB34EBFAA94905091583174C2FEE1CE598F47005D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647424391, "uuid": "1c9f9733-40b6-4a17-833c-f6e2b5f21cb4", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647424391, "uuid": "2280e8b2-ac40-430b-b773-1b36e0e8be31", "value": "6144:rGiQfOG0YsQSAMzZAbJLPnN9m0ec28/o2qZggBhck1z:mOGZTn1ZpJ/wrBhcE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647424391, "uuid": "b02afe70-7a7b-46d4-be2a-9c8896d9bc6b", "value": 301468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647424391, "uuid": "748237eb-acb1-4dcf-aed2-40cbb18770ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647424391, "uuid": "4f1b5464-b9ce-4901-9fa2-0de5c3ce848e", "value": "abcb1d5820d98fa14546fd4cdbbf37b5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2967c7b8-a56f-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647465739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647465739, "uuid": "0aae7576-7e06-40c7-9cb9-a93d96988db6", "comment": "Malware payload (Heodo)", "value": "094e1d80cc730a048da9e6d6c0e8440f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647465739, "uuid": "d20eb1c0-4587-4292-8b74-aa5a2ac0f2a4", "comment": "Malware payload (Heodo)", "value": "a4d27854f7220c9840010ffee287baea9ce6d512fe3b2fe5caebf49e964456d8", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647465739, "uuid": "1f44dc9b-efcb-4dc0-a11f-dec926a19013", "comment": "Malware payload (Heodo)", "value": "b201b18be9660be6213c0a586d3e905b42c56ea8", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647465739, "uuid": "8c128e0e-c5d7-47d3-9cef-ee5da8a8483d", "comment": "Malware payload (Heodo)", "value": "4352f0561c824bd6214f916e9e413a6ccf5a02026b7589a40dab892b3f11756dd8390f8a352b5d5c5883fa2ef3dd4d42", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647465739, "uuid": "f4eea082-57a4-47f4-b2f7-efbb19b12277", "value": "T160F4DF1176E1C076C1BF12304956A38D23FAFD509FB986976FD02A6E3EB41828E34767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647465739, "uuid": "50c19807-eb8d-4183-a13f-48bfc315db50", "value": "66a21a1bcb4077b3ed89c00ee693486b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647465739, "uuid": "499e4062-67a1-42bd-8074-c567d5ebf3ee", "value": "12288:g6O4TpP0XjxCCFJuf07j+Xk7h28rLneTfABCJoWRWwfpW:BeCCF88j+Xj8OTYA7pW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647465739, "uuid": "1f38604e-7af1-4ef2-8651-3d183b6eabed", "value": 749568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647465739, "uuid": "b59800b3-1f9f-426c-9a04-5996107a55d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647465739, "uuid": "c431b989-ffec-4a83-ad9f-b449d9e44ef0", "value": "Sup93JDTpD.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8e6600d-a4fe-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1647417527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417527, "uuid": "dd57fb42-ebc6-4148-b934-0a479127bdf1", "comment": "Malware payload (Loki)", "value": "d3565e6d90db596c72cc4abff18b2a6e", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417527, "uuid": "a6ee94ec-0311-4c6f-bbc9-35ebdd6cef25", "comment": "Malware payload (Loki)", "value": "a4e7d0ae8897f92d023444b312a89374b384f6801fb62c893455d2156bf80fb6", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417527, "uuid": "604cafc5-5e17-43ce-a231-ff60ec42c5bd", "comment": "Malware payload (Loki)", "value": "9e2eeee60798b8db0473aa07368bd1f2e4284119", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417527, "uuid": "f3a53e0d-63c9-4ced-a711-7860d18e79f4", "comment": "Malware payload (Loki)", "value": "32a9cba6754abd5eb342f657f9c3699a204b69250aac2608bdfdca6e6aea2c65d2aac670bf80b250442f4d10dad1d282", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417527, "uuid": "a6c620be-8262-4e66-95e1-5b7929e7d797", "value": "T1D8F4024AB2E45F83F4FADBF789651A5443B2F0191A19E31D8DC630DB09E6F0047A4B9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417527, "uuid": "87f8afa9-9764-4a22-87f9-d567a120289c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417527, "uuid": "9fd9c8e1-f28d-47c1-8094-5015f24d55d7", "value": "12288:CC5mlkwOEocE794O3OpfPQeIADNx8sBMthmFC0aGRLWPk3:75mewOHhujx8sO3AC0acWPk3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647417527, "uuid": "885cb917-826a-459e-a384-a72f71c6075f", "value": 786944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647417527, "uuid": "b9ac4965-0c07-48d0-9505-e891a872732e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417527, "uuid": "5ac6ffe3-3d74-4146-8b6f-0b32a5ad2ce1", "value": "DHLINVOICE3152022.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6788e69b-a4fb-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647416022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416022, "uuid": "7e0cd6ed-3c17-4dff-a0cd-355656f52b70", "comment": "Malware payload (Heodo)", "value": "a481f511505ce4ade4c9325297969172", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416022, "uuid": "7959d4cf-533d-4788-bcb6-07b2a3c23e31", "comment": "Malware payload (Heodo)", "value": "a571af498455b139af55b9da81d4b82623a1d8f4498d6b12dab8ecee49e33fa6", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416022, "uuid": "a5f68bcd-7be2-4759-b29a-70bfa12dff71", "comment": "Malware payload (Heodo)", "value": "8dd14e772adf74f2cfe4909a693720a4508b8fe2", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416022, "uuid": "efe98fcf-ab34-4f2d-abd4-e570dc5c036a", "comment": "Malware payload (Heodo)", "value": "bc80cd7f7ee9e0689764823afef1b19e10130b6f1c212a02f83d04af012bef4fdad771b78006aac2768ea0a4ec37124d", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416022, "uuid": "2defa645-2791-411c-9b3f-176cef77890e", "value": "T142F2CF2DA3A0EF5ED61DED38849881EA421579154506EB4FA85CEB0D6F493C33B1F0DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416022, "uuid": "cbe0a711-59f6-46c0-8a4c-f537c8395fbe", "value": "768:8jFhNKbeXizXT2LxdFfPdkqstJ1goE6vS:8BTGeXgXUndkqegoE6vS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647416022, "uuid": "479fa779-c22e-4ee9-b0f0-00ae6c7d8499", "value": 34391, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647416022, "uuid": "39a2debb-5891-41b3-9434-594441b98332", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416022, "uuid": "a4fd6304-0c28-4c8b-ab62-59e1ecbaf664", "value": "10088281145643809842475.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d88c1365-a555-11ec-9275-42010a9c0029", "comment": "Malware payload (RemcosRAT)", "timestamp": 1647454866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647454866, "uuid": "cc934353-fc08-46e7-bc6f-cd09dbb077cf", "comment": "Malware payload (RemcosRAT)", "value": "39111af805c7028a00c60a7cb5852fdb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647454866, "uuid": "0b118252-9afa-4cee-9f88-a81f33b99c45", "comment": "Malware payload (RemcosRAT)", "value": "a598b3824495f56c447a88ccfdc805f077370ae2255a999cf00464da1d53d9a0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647454866, "uuid": "5b78546e-b90c-463d-9176-18271eee327a", "comment": "Malware payload (RemcosRAT)", "value": "192846ce11bfd57d0c50c0e0e99e910ebf686519", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647454866, "uuid": "6eb003ff-eeca-4cfb-bd94-8c38e2aa6ba1", "comment": "Malware payload (RemcosRAT)", "value": "60587db4c6afb7f9e56356e24a4fdec35eebe05b8fd7e7bb0b772437881e311b2d8632a20445ac566f3f67793c384f8d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647454866, "uuid": "36857a1b-4778-4187-ac99-39f7a4b1c291", "value": "T1BC65121777AE8F03C6695A76D5CB050097B1EF962933CA4A3DE837EC4543743AA2818F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647454866, "uuid": "5c3a740c-56f5-470c-90ee-e57adcfc307a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647454866, "uuid": "2970855e-c857-4dfb-8f46-0b408ab3eedc", "value": "24576:czE6wOMTLfE6hppM/jQqkpZX3HpnXWTN8OMl/NWex6Z9ZLH6pe1PB:cHfZ0rXHJnmC/bx6BpJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647454866, "uuid": "80973193-73fe-4a4a-ba9f-ece8ec35ba9b", "value": 1434624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647454866, "uuid": "6e1300f9-c9fb-4d53-9d28-cffb934c8e4e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647454866, "uuid": "0f9dde72-6c79-4ec3-be72-b84a13f26ca2", "value": "DHL delivery confirmation of customer.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b409cee-a4ff-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1647417773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417773, "uuid": "e4fd2e26-0595-4376-b05a-4429e4b1baa8", "comment": "Malware payload (Gafgyt)", "value": "c3b8b1509ecacbdf105f4efececb0316", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417773, "uuid": "7c49c5fa-7d51-45c4-b6f9-d41bbd4a4bfd", "comment": "Malware payload (Gafgyt)", "value": "a5a5da244853a3087525179c84cecb96d6c1c63cf328e8ffbb34bc0a25c3a6cd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417773, "uuid": "069ae7a8-0242-4dc5-95ea-13665dda2cea", "comment": "Malware payload (Gafgyt)", "value": "0d3f0d851d4636e15824f149c2a0ff52079ece42", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417773, "uuid": "3ea38900-45fd-4345-9640-8ae393fbc8d8", "comment": "Malware payload (Gafgyt)", "value": "3a1acb39a097823c0f13c233190d4e360fafcf77c16bf16f057f36dfe8759e15d7715b2d4eabbc22d50b4f070c3816b2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417773, "uuid": "ef86d0b9-c3fb-4ad8-9835-31d0f0427d73", "value": "T11B836A21B93A2E17C1E4B07B42B78325B2E6278D24B8CB5DBD320F4EFF156902457976", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417773, "uuid": "4f4fded0-a6ab-4b31-ad43-7721b5f6eae8", "value": "1536:7gHZ0IS7BnK9XJPNaag3cfFgE6xgde4GpjMdQj9kbH:4CNhSKAa/gde4W9j0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647417773, "uuid": "c902f872-77c1-4ab6-8a70-6e8bdaf0016e", "value": 85784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647417773, "uuid": "6dfea5c8-0df5-440a-a3d2-87e5a6caa215", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417773, "uuid": "540cb0bd-1194-4622-8824-7625a5e1c3bf", "value": "c3b8b1509ecacbdf105f4efececb0316", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db861055-a4dd-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647403331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647403331, "uuid": "7b7595f3-712b-4b5c-bee4-51092e588d43", "comment": "Malware payload (Heodo)", "value": "e87cd6225a0f4be4bae768305565d1de", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647403331, "uuid": "e9242806-b4e1-4ddd-b841-3527216bb4ff", "comment": "Malware payload (Heodo)", "value": "a5b33cfeb82bbe40ddbf9b19554c72c6055f1a6ef62faac39d0e8d021a8cca27", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647403331, "uuid": "886300db-13c4-45e9-b28e-409cbdd2cd31", "comment": "Malware payload (Heodo)", "value": "f18fa01eb10977e280d1d7f35e62aeeb3fb91bc1", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647403331, "uuid": "fefd882f-e371-4bb5-91ed-5a1ca6171bb2", "comment": "Malware payload (Heodo)", "value": "3574e807f0d7ddbaeddcd2af3a90755cf13ed953cec56a779ffcd8da44d1a900181f1f3b4d9fbfb31b3a00475b72ee95", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647403331, "uuid": "0439a663-03d9-4f2c-840d-1b8ad811d22c", "value": "T17BE2DF29B3A0DB5DD30EED35846986CA525AA825C406EF0EAC4CF71D2F492D3371F49E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647403331, "uuid": "bac748b4-3cd3-401b-a052-1ebbc208a82d", "value": "384:XwdAZPFhNjUA7icg0SCdiVAg2GKgUrNU/qWhZOdBNPJM+kqr9eCgh0k5NGE6h:gdwFhNbiH2rndFfPdkqstJNGE6h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647403331, "uuid": "9cbf55db-afbc-4c30-9eb0-d39dfa53c7b0", "value": 31319, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647403331, "uuid": "ce5db435-6f96-4ea4-a844-e213ee1d2900", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647403331, "uuid": "b7451e93-f0a9-46d2-9af6-1b63fb9d64e3", "value": "Untitled-1603.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "449871e8-a507-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647421117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647421117, "uuid": "78690040-3b13-4457-9316-42525c73276c", "comment": "Malware payload (Heodo)", "value": "52c5a48a409d3fc190e444ffc1edf9ed", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647421117, "uuid": "e2189c6c-1fcd-42d0-b4c8-bc113266e432", "comment": "Malware payload (Heodo)", "value": "a7beebfe4f6406b40a799c160ca1869018ca7beca78bf8208ea99eff2716841c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647421117, "uuid": "64c1ae9d-bfe9-4a4a-9762-ef8459944fb6", "comment": "Malware payload (Heodo)", "value": "5d46f5e0aab7aaae7d4fa4211ff55a827d8805e9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647421117, "uuid": "400b6b91-bf39-4b9b-ad81-ca9fcd220d68", "comment": "Malware payload (Heodo)", "value": "606c0a20a82b68e64caf54372e98e1a9d2ad46f5589c25af3f60e72050552ade04774419e9ed97fffeaac93430e20af0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647421117, "uuid": "0c4ecc21-b143-4925-afbb-7cf81c8d2f52", "value": "T11BE47C12F461B2B9D04B04741F1723A86EEF5E518629CA13AFA8ED5E1F31251FC3FA16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647421117, "uuid": "0715f187-0128-43a9-b146-1b8a5e5246f3", "value": "066d4e2c6288c042d958ddc93cfa07f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647421117, "uuid": "80c6e674-f4b7-4815-9a5b-f0d0679f6a5f", "value": "12288:DtAanana8Meee0GBGu3qI+3DNJ3vE6v5edxS332d7t5hT/hexLx:Kanana8qGBGuoNxELxCM7o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647421117, "uuid": "32f34285-1271-4f2f-8530-17c419c5f915", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647421117, "uuid": "5c6c4cca-de30-4fb5-96a8-a7e88d74c98c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647421117, "uuid": "41ef283d-22a0-471a-9c87-981451c19e58", "value": "52c5a48a409d3fc190e444ffc1edf9ed", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e48ac7e-a56b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647464083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647464083, "uuid": "7a6f3a1d-0ab6-4b68-aaa4-4e3b9c13ee32", "comment": "Malware payload (Heodo)", "value": "4a667370861391adb4ab1eb17c36b374", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647464083, "uuid": "a5be7e71-58df-4510-9e0a-fb11ad291f92", "comment": "Malware payload (Heodo)", "value": "a7f2ddaaaee54d39f6ea902a7bb4796ce9a60262c836234fdd8da49c2beae5a8", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647464083, "uuid": "aa72956c-2056-490e-94f6-e69aabcdc1c9", "comment": "Malware payload (Heodo)", "value": "22a6f34fa3113171bf48ee7659e8dbf8fe0c26b7", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647464083, "uuid": "d413acf2-f0dc-4421-b4a5-b75670b2ce01", "comment": "Malware payload (Heodo)", "value": "d976fdcbedc77882590f232e735b08062714240ce3558dd62d1669f944f4145595e8fc2016cc09dfb88aaa142525fe8e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647464083, "uuid": "c46e7ad3-2326-4e18-a88f-c2c257c64b22", "value": "T194F4DF1176E1C076C1BF12304956A38D23FAFD509FB986976FD02A6E3EB41828E34767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647464083, "uuid": "6d0396be-5bd9-4747-a2d1-7c4a1b76e1ba", "value": "66a21a1bcb4077b3ed89c00ee693486b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647464083, "uuid": "89013bec-c081-42c1-b80b-ea6b19e81c72", "value": "12288:g6O4TpP0XjxCCFJuf07j+Xk7ht8rLneTfABCJoWRWwfpW:BeCCF88j+Xc8OTYA7pW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647464083, "uuid": "48a6ab41-1869-4ebf-90c1-1770adfddefa", "value": 749568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647464083, "uuid": "fe2e96b8-17bf-4e45-a6c6-489718ae9d60", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647464083, "uuid": "770a90f5-5c0d-49a5-b145-e949dce0d706", "value": "4a667370861391adb4ab1eb17c36b374", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "220ed0de-a4d8-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647400873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647400873, "uuid": "c58f9a98-0e24-49b4-9323-7ab8afeee69b", "comment": "Malware payload (RedLineStealer)", "value": "be66bd51a577250754e0dfc8af9c1282", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647400873, "uuid": "9ca97e28-1042-4715-95da-31b8612da518", "comment": "Malware payload (RedLineStealer)", "value": "a83c10a38408972dbc7d9daf66e2dd8c9bb6545e9e4f81c2097214ebe2a16119", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647400873, "uuid": "dd417318-e813-4041-b7c6-98f9f03d7065", "comment": "Malware payload (RedLineStealer)", "value": "c9df5b5bcaab0ad3a93c5a077a6c5f9cd7b61a61", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647400873, "uuid": "6f79db65-733e-4d82-8131-16554e282294", "comment": "Malware payload (RedLineStealer)", "value": "a116892663a5bc1eb483be9a31db272679496644db74fbb451f42fdb07d03f99fe98ac6eaaba92351618c4b0ad8ac0b0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647400873, "uuid": "465af9f4-f208-4289-b370-ed0d3f923f4e", "value": "T1C91533BA6AD19D0AC5DF8C7CCD324BCE4CD749F4AAB89425D7B24689D73C032353A4A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647400873, "uuid": "b37ab4e8-ce11-4cef-a17e-a662e78932a5", "value": "445554923421947cbff896012e27345a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647400873, "uuid": "04212ec0-23a9-4fe5-b161-5b761bd7fe42", "value": "24576:H4Vs+5IEVrELHIrtaYgBndp8IFCEo3kEaHNYK3/qAvt:Y9IA8HEtep8IoEINaPvt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647400873, "uuid": "a0c22b8f-698f-4884-9e3c-6a4641dda812", "value": 951808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647400873, "uuid": "936c4e5e-4333-41a6-a4c3-154cb52bb4c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647400873, "uuid": "6aa172d4-75c2-4bf9-8fb8-5634d7c977f8", "value": "be66bd51a577250754e0dfc8af9c1282.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b031f5b-a4eb-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647408995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647408995, "uuid": "8656e6fd-e8fd-4155-8427-46da625a0cad", "comment": "Malware payload", "value": "23f4a173ccda8b842540deb25fc92d3a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "InstallIQ", "colour": "#7A0AFD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647408995, "uuid": "92d9e046-2940-4a96-9304-fccbd2bb49cc", "comment": "Malware payload", "value": "a87d10a3995ea6db62f65541511ec819a2574bea0effe46ce28646bf262a3d57", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "InstallIQ", "colour": "#7A0AFD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647408995, "uuid": "907eed47-6ca4-4a8f-b537-5d9680ec4b19", "comment": "Malware payload", "value": "7ca09242430c959896daea8d1b9015a9b6c9ebdc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "InstallIQ", "colour": "#7A0AFD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647408995, "uuid": "8de10cb1-47d4-4e8c-9afc-c67c8cb94dc6", "comment": "Malware payload", "value": "92639625370a966031900f98f8624cf23bb9695d12959ce42f94321a988db98c34bbc5561c4e856b6c14d8b62661a354", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "InstallIQ", "colour": "#7A0AFD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647408995, "uuid": "9565846d-9d61-4ac6-af3f-1dfb90cc9922", "value": "T1C775CF127391807AC8B611B0625E4765EEF1FAE142758E4B77C8390D5B709D2BB3E3B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647408995, "uuid": "dad5ef87-81ee-49c3-b58a-8b19cae0e309", "value": "8c502d2bed2b547ca28206bb213b0952", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647408995, "uuid": "921890a9-7099-4fed-ada2-bd69b1c039d2", "value": "24576:IIenlERh1GdDBL5nmwd0DbOEOoGl5Q4g20vlLe9T2aQ0RdE2SHRpZ3d0:AERCdF5mWOOOpcT408r4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647408995, "uuid": "de4cd7a0-f12c-4211-85d2-c3a96c1fdb01", "value": 1592512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647408995, "uuid": "78a6de6b-f4da-4e4a-9ef7-ef34e77dab29", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647408995, "uuid": "a4d6b439-2912-47f1-bc78-63a251a17d13", "value": "a87dx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc85ee49-a568-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647463087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647463087, "uuid": "a92e6ee8-244d-4692-9ec6-92d3737343e4", "comment": "Malware payload (Heodo)", "value": "fa5e462b0fc8a5cd7e280c6e56468cb4", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647463087, "uuid": "5c8085ae-05a8-47cd-ab2b-689c4a29273c", "comment": "Malware payload (Heodo)", "value": "a8c289f87e46c80550afed8268a936fce63a856fe22e58b940488edf17cc3e29", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647463087, "uuid": "52bae5e5-cf46-4f72-ac56-3695d47700d5", "comment": "Malware payload (Heodo)", "value": "f88c103f2310313078977ad646e6d813008118ae", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647463087, "uuid": "868f3b03-3b4c-42ef-9c89-65ccbebaf141", "comment": "Malware payload (Heodo)", "value": "480c102a92b404bd6a54ff0067633b0fd4c3754bad06fb38704ff9d0b23d0b66e88f82ce550809d521365e8b52644f72", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647463087, "uuid": "218cf23a-63e2-4eb0-82e1-31ecc3d74024", "value": "T19EE2C02DF2A0EE1DC21EE939446895DA421DB4558502EB4FB95CFB1D2F0A5C23B1F0DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647463087, "uuid": "30f30c97-1d4c-486c-8200-386229be5fc9", "value": "384:cjzZPFhNjqEBOA7iEibbwBLg0SCdiVXUKgUrNU/qWhZOdBNPJM+kqr9eCgh0k5lY:cjpFhNNlizXT28dFfPdkqstJmE6/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647463087, "uuid": "f96ab5a8-3b94-4a81-933c-981d8ee87a34", "value": 33750, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647463087, "uuid": "c152aad0-8dd4-442e-8cc0-8e03684daf5d", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647463087, "uuid": "4074322b-fd4f-4d57-be31-e4eda023688f", "value": "Payment status.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1a9945e-a500-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647418347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647418347, "uuid": "3e37b3fb-7498-449b-ad3b-c33688b94012", "comment": "Malware payload (Mirai)", "value": "d3ab22409b9e2fd83885b3eef17a72fc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647418347, "uuid": "f53f0091-05dc-45b8-a25e-6913e29e14f9", "comment": "Malware payload (Mirai)", "value": "a8e026a5b92b44e35a1c3186dc7453ad75d164158d7166a223c2c088ba8ecfbc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647418347, "uuid": "998777a5-e721-4757-9ac7-3224f30c3b2a", "comment": "Malware payload (Mirai)", "value": "b1084f65ef7019622ccd51a8fd9d5a6aa794a7b7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647418347, "uuid": "141db1cd-e686-49f4-a52a-2615733726ef", "comment": "Malware payload (Mirai)", "value": "91713912ffda0b80a5343e32d3993fff86a0c15ff0d51d98b4bfab39aa2606cd5fa8b94e73f7e0667da4bd185fbbb8d9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647418347, "uuid": "f0a0aec0-5e0f-45bd-a566-800225c22616", "value": "T10CF2E126CB577AF3CCF839FAD9650A4C536604F46A36322576089B3C4BD34862EF4683", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647418347, "uuid": "d9d241d5-701a-4736-87f5-f45bb16bebef", "value": "768:LGlqfageJzUK0XSWazTefNp4WCGkfheEty3U1b:K4rKYSHRWZkfh1b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647418347, "uuid": "6af2d393-2674-4451-b157-2765b9a74b1d", "value": 35200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647418347, "uuid": "dc289df0-7b2c-4d85-b290-babf634452b7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647418347, "uuid": "e845020f-537d-4e75-b781-7f79eae18d97", "value": "d3ab22409b9e2fd83885b3eef17a72fc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37ccaf74-a550-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647452449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647452449, "uuid": "dd0d39f4-f1ab-4a1e-856e-5d85fca00b93", "comment": "Malware payload (RedLineStealer)", "value": "447291c395ec53fc174ddfcc1e5f5821", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647452449, "uuid": "3bb76c69-cb9c-495b-9466-b2728cbfcf8a", "comment": "Malware payload (RedLineStealer)", "value": "a96ba40dbc509b29e875ec6d919497b1fb96bc59e20061b14cf47def6fc0c0b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647452449, "uuid": "e6606d32-3782-460e-a735-00f69ed6e239", "comment": "Malware payload (RedLineStealer)", "value": "00f4c550baad275ff2d0dc80f185d9f8cf7490a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647452449, "uuid": "01bd737d-5814-4906-a056-939b90e2d193", "comment": "Malware payload (RedLineStealer)", "value": "c34b2d76f8e708a37d3d5871fbf572c128b247a73fb20c0161d85ea2c522951f17e0c070e303dae99bbe7020e8030884", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647452449, "uuid": "4cbad9bb-ce56-433e-ada7-7611074d3993", "value": "T1401633EAA790771DC4E2ADFA098A690998E816DCB5FF472AC3750FC174C8309363156B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647452449, "uuid": "832ede98-a9b7-4881-b5b4-4f3fc9134e03", "value": "445554923421947cbff896012e27345a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647452449, "uuid": "1768a08a-c925-4c5e-82c7-c7e15db9ad33", "value": "98304:OUD9jafNh0ufgnKSZC8qDwZ5Tejo1AXH0I2ni8SH4:h9a1h0OEC8qD0KM1A3zB8SH4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647452449, "uuid": "7fc98576-fd59-41c8-bf05-79ad76d88272", "value": 4137472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647452449, "uuid": "fcf5784d-3afe-449e-8d18-c7eb16c9197b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647452449, "uuid": "e9b3b057-1fdd-4b49-8299-3a93aea9c6b7", "value": "447291c395ec53fc174ddfcc1e5f5821.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "170b1fed-a4eb-11ec-9275-42010a9c0029", "comment": "Malware payload (CoinMiner)", "timestamp": 1647409015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647409015, "uuid": "81af4efb-d1c4-4b9f-9065-f8c67245bf9e", "comment": "Malware payload (CoinMiner)", "value": "dc2bfd734712dd61708ee8841d1edb42", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647409015, "uuid": "22ab9005-4bc2-4582-b64e-82f65a6fe825", "comment": "Malware payload (CoinMiner)", "value": "a987674680af03de3bf313f992b3c1bb6726ef2b39b836c62abfde3ea01bb834", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647409015, "uuid": "af01e6e2-1e27-41b3-90a6-670f093eb9c7", "comment": "Malware payload (CoinMiner)", "value": "f7abcf8f4a0962eccf57137cb1fbce88d9fbfa37", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647409015, "uuid": "f587dd3d-7c59-4f01-9494-d427f5bd72c3", "comment": "Malware payload (CoinMiner)", "value": "ee4c84832c23fc4ed14d41e8a8c3b6c87a57cf0d26c0198a245f7105723d9776a86d902356f459cfcb40152dd1e14fe2", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647409015, "uuid": "d9b3935b-7498-4484-8ff6-1e9dbd841e8b", "value": "T1DAF5E05E726540F9C6AFC078C91B890FF7F13849436495EB12A15A9A2F277D0CA3EF21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647409015, "uuid": "d933d166-4723-4b5e-8fe5-345bc2a6dfce", "value": "15d37b2dbf429fe98369cfe1275b025f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647409015, "uuid": "bcf15f1d-f1f3-466a-a6b7-4c4e485ac794", "value": "98304:31ONtyBeSFkXV1etEKLlWUTOfeiRA2R76zHrSD:3bBeSFkP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647409015, "uuid": "3a8a68f4-fd97-4401-af21-afa15def68ec", "value": 3411309, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647409015, "uuid": "fb351c9f-a016-4ee5-91f5-66fef39ecab9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647409015, "uuid": "7e58359b-a212-48b3-a29b-f8a76ab92deb", "value": "a987l.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e12a509b-a500-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1647418373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647418373, "uuid": "9869fb4a-6028-44d9-a85d-d2a68a383ce1", "comment": "Malware payload (Gafgyt)", "value": "b0094b490d9283621de06c554a7a72aa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647418373, "uuid": "a6dd9162-4783-4f5a-acbe-618fef3c9e85", "comment": "Malware payload (Gafgyt)", "value": "a99023f49ee5a39d6b27daa7e3d9caf48401dbe51fcd74c5960c82f9a48fd53e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647418373, "uuid": "8f28fa16-a4f7-41c4-b909-3ebaf42cee51", "comment": "Malware payload (Gafgyt)", "value": "db0af35506ea8e8b76f724642b8e02a9bcfdb528", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647418373, "uuid": "cdfb9a92-9aa8-47a8-b796-5ff3774bfe78", "comment": "Malware payload (Gafgyt)", "value": "c5a451cd2ea4e4927627052a178a3564d0edff20a0c4d3881d74c46af3ea78204d1479e00b1316dceb70abdaaf3e2349", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647418373, "uuid": "8405f43e-e140-427f-a90d-bf60c5fdd160", "value": "T1AA73AFB1D0687CA4C25C0138B9F9C93A2713F404A6635EF45E568BAA640BDECF51E3F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647418373, "uuid": "bdad96c8-ff1b-49e1-bade-19f90df170fb", "value": "1536:z/BmBJTHblwt3imVUkYrL6AVQfoXwFTALwSeGCBrE:zZmLTblEimVarm1fNTALwSeG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647418373, "uuid": "64cc1a45-935e-4976-8fb4-e640b95369ff", "value": 76804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647418373, "uuid": "59b92521-8532-4213-9a12-c73737c13571", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647418373, "uuid": "83307a67-6a89-4914-9e31-f019707c6ca2", "value": "b0094b490d9283621de06c554a7a72aa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "560f4da4-a52f-11ec-9275-42010a9c0029", "comment": "Malware payload (Escobar)", "timestamp": 1647438326, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647438326, "uuid": "2524d671-fa25-4ad2-ab37-1b095c6c50aa", "comment": "Malware payload (Escobar)", "value": "d57e1c11f915b874ef5c86cedb25abda", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "escobar", "colour": "#D1C959", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647438326, "uuid": "81038af1-f810-4763-9871-a6cb1e03d986", "comment": "Malware payload (Escobar)", "value": "a9d1561ed0d23a5473d68069337e2f8e7862f7b72b74251eb63ccc883ba9459f", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "escobar", "colour": "#D1C959", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647438326, "uuid": "698c11b9-ad7d-4ef4-af2d-8ef2f4844ba1", "comment": "Malware payload (Escobar)", "value": "22e943025f515a398b2f559c658a1a188d0d889f", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "escobar", "colour": "#D1C959", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647438326, "uuid": "f1ec0142-40b1-4b0a-8a23-9b74cd185239", "comment": "Malware payload (Escobar)", "value": "fb2386dbc662005a88acbd753baafa136b0eb3d5a41ac498fffadadc72145d7567e38d66ff92155f1ed540fd5a698d36", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "escobar", "colour": "#D1C959", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647438326, "uuid": "53f47816-f8a8-4691-832d-47ab32ac1695", "value": "T10DA58B56F748B97FC4F393324575966A112BCC268B43D683596C323C28BB9C84F5AEC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647438326, "uuid": "c082f486-eb61-428a-9512-d2fa3fa96337", "value": "24576:N6yYAMzfzW3yA2XMntKGYp1P9Iu24SjxK/2axX8g/+Hfr0OMQi84B+oBG1xz:wvZzLW12gKGS1wB7aig/+Hfr0HB+RX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647438326, "uuid": "6c7a346e-3480-48f1-a9ed-8114278b3e2d", "value": 2147865, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647438326, "uuid": "581c1be6-3732-4e14-b269-0c3e2d444199", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647438326, "uuid": "3ad15727-b3c0-4446-afc4-82ae119b3ca2", "value": "escobar.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad279787-a50d-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647423869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647423869, "uuid": "8a41d3e4-31b6-49d1-ae27-0aa3f3ac0f8b", "comment": "Malware payload (Formbook)", "value": "25c91a6c077e0593b9c202f4cffecaa4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647423869, "uuid": "fd692d76-6f91-4204-9b05-2e495c5f4294", "comment": "Malware payload (Formbook)", "value": "a9f8ff439d6cf51c60a5f9bba3653ea480fa72249562e11d6bc03bda8e672f5d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647423869, "uuid": "f36759c3-b745-4825-9b2d-076f25b7e916", "comment": "Malware payload (Formbook)", "value": "d88a32c2d756e27814738004bdfb061db483619c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647423869, "uuid": "98f761c6-4ba9-42ed-9928-7672c36c8b11", "comment": "Malware payload (Formbook)", "value": "971c4fae95b6347a5c9710d61b773eb15e6b830b570b79797132df2face457c79d1bbf6361850727420ed621ffc2f56b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647423869, "uuid": "fc4d813b-fcc9-4851-baca-331c7a393924", "value": "T117F412EE318A6BA3EC35C3FE99BAA00817B67CA59131D2499CC239D75592FCC2410F57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647423869, "uuid": "b68683aa-4e65-4500-88f1-48842ee33244", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647423869, "uuid": "7324d656-d5ab-4970-b8c2-02dbd3c4b405", "value": "12288:eIuwOEhmuSxaXrvl7s+KY3eskEnnmuSK05/6JncxcgoTXxUVZfXol:buwOPaIYmEmuEV61OiXxUro", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647423869, "uuid": "6a729a99-bf54-4e9d-b5a8-c826287c06d4", "value": 779776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647423869, "uuid": "8468ac79-5c86-4425-8a95-143ec1bd3305", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647423869, "uuid": "ca6d3154-9850-45d0-bc93-05037de7ea63", "value": "25c91a6c077e0593b9c202f4cffecaa4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bda46f57-a4ff-11ec-9275-42010a9c0029", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1647417884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417884, "uuid": "e060387e-cbda-40e4-b859-b510ad67c8d8", "comment": "Malware payload (AveMariaRAT)", "value": "8e45a312c3147f29b1ae2611af9a020d", "object_relation": "md5", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417884, "uuid": "073c7303-05c0-4fc0-9c54-831ab1cbd01f", "comment": "Malware payload (AveMariaRAT)", "value": "aa13ccc548a1e9a74cc2b0ea68e61aae9156cd9e676b90812c5befb35ddecec6", "object_relation": "sha256", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417884, "uuid": "a16ad204-0842-4f9d-94f8-1cc780f2a1de", "comment": "Malware payload (AveMariaRAT)", "value": "319de98b253d37640d818f7c11b9ed5d49fa886b", "object_relation": "sha1", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417884, "uuid": "989dd098-9198-468a-a007-822fe6451ef3", "comment": "Malware payload (AveMariaRAT)", "value": "8106132e93cddbb9ada069980ca0943d2c075201fa0598062939c053e08eec5fd6148378dd1dbe303df25d4b3c73d940", "object_relation": "sha3-384", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417884, "uuid": "b850cef8-89db-4f35-83c0-7f9ba9976875", "value": "T1E7D19E3FFA00945BC3F04A7D116DA45AB914F89326E4A42B2DD44D68065118F3F9F67E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417884, "uuid": "99925e67-09ce-4372-a43b-63165c42756e", "value": "96:ZEKrMbKo1/waHI+Apww/Hv4LqNLh1xo1V0qu/tVot9/5UD5PdBmn:xrM2I/VvdKAgLhzo1VnuVVWWqn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647417884, "uuid": "233646fa-94a9-4b4b-93c0-f7daceda528e", "value": 6698, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647417884, "uuid": "98c41e55-240a-4513-a518-d732931253db", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417884, "uuid": "ce56e8cf-ae14-4d3f-aaf8-d43cf56edbd7", "value": "Reservation 21837102,pdf .ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b2d5d0c-a534-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647440455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647440455, "uuid": "24f8e199-8572-4e44-beec-928d65bccb26", "comment": "Malware payload (Mirai)", "value": "5e4bb1ae8c2772d7366660cd9bc36155", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647440455, "uuid": "c551458f-e7f4-4833-854d-f93e0da8ffa4", "comment": "Malware payload (Mirai)", "value": "aa2ac6e9cf50403c547839371d01bb57dff97d58466fc95c457a43107f45d070", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647440455, "uuid": "736f91ee-cf88-47fe-99e7-537d9ae42659", "comment": "Malware payload (Mirai)", "value": "9ba7a81953561458dc6fe4ec209d713615e1d39c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647440455, "uuid": "b40c3e33-aef8-4442-a083-d45c3968d1e0", "comment": "Malware payload (Mirai)", "value": "5dfd5919915559ddbe024fa41daf12cecef2e3b0e807ee75356128d9494d79395c31089f4b828103031e5164d640119b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647440455, "uuid": "63541d63-7463-4a3d-95b6-331ff2c1b9e3", "value": "T1A3133A42BD5BE7A1E410647A722B5BB3537AD1EE2444DFEAC71CD234AC06081A60F7BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647440455, "uuid": "e69208fa-6a63-4731-ba4d-c83eb8c7edb5", "value": "768:c0ICH4/l/AZyn7tCJ7rOGEKhLeHdv5dqQ0FN:c0hH2eyn7EJ7rOXgLWv5sQ0F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647440455, "uuid": "39e29f8b-5cbb-4aed-bdad-c013d234d469", "value": 43308, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647440455, "uuid": "7f0c74f8-5da3-4d8c-92a6-bfaebc2f7490", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647440455, "uuid": "ceea1483-643d-4afa-a9bb-8dfefd069fe2", "value": "x86-20220316-1420", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2aef1090-a519-11ec-9275-42010a9c0029", "comment": "Malware payload (NanoCore)", "timestamp": 1647428805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647428805, "uuid": "8f9efa00-80ac-4e47-bf4b-79622bf647b3", "comment": "Malware payload (NanoCore)", "value": "40379db898f2812724a793d63322b892", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647428805, "uuid": "c0033fc8-bd88-4c26-9285-ff5ccd7006c3", "comment": "Malware payload (NanoCore)", "value": "aa9397375d9de50fc1be34b49f30b49ebd69a741745801edcbe2652e2d58a509", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647428805, "uuid": "22ad6bc3-c0c2-43f9-a96f-da7b542ab6f4", "comment": "Malware payload (NanoCore)", "value": "76e7c69de1a69e9fcf8750941a73a5859722fabd", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647428805, "uuid": "0e04fde7-9735-40dc-af13-c7947921c84a", "comment": "Malware payload (NanoCore)", "value": "046e6e52fed381fc75061278fa739a9f996d244cac5ec549b7c909bc0eabca4f41c5f5e965ccbe6e075a0b3680788c85", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647428805, "uuid": "adec266e-59c1-4dc2-b4df-fb5bf53d8d6c", "value": "T178F433CEA116CCC61AE8DD13055294BF42C1396E9C2FCBA25B9A10EF0D4FE91E42D5ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647428805, "uuid": "47912099-83e3-4412-a52c-5794f16ac9dc", "value": "12288:M0wSwG0EeamVEZRcT7pYX62+WWht3xOEbdeoQkJtOcHqaHygyaemgY/CJrWSmKwr:TiG0umVEnOptDt3PdeYJt/qa89Y/8rWT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647428805, "uuid": "6d2628e0-8b47-4194-9712-4071b5f93a62", "value": 760573, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647428805, "uuid": "9fce6c1e-dd31-40fe-80cb-b4ec39a444de", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647428805, "uuid": "3ce1c3d2-3d33-4cb4-832d-144a8a82652b", "value": "BOQ for PT_PDF___.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "261091f3-a54f-11ec-9275-42010a9c0029", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1647451990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647451990, "uuid": "7160e89b-f438-4d21-9cb4-a12108965015", "comment": "Malware payload (ArkeiStealer)", "value": "fd959a8b07081ca2b2724265399e6479", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647451990, "uuid": "bd5d4076-26c9-4daf-a0f5-31d1d05d02b5", "comment": "Malware payload (ArkeiStealer)", "value": "aaa77ce4b5341185c016e9cc4f28c16b5e3f8e544f3dff6a66e33718c2775088", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647451990, "uuid": "ec849046-1c01-46d4-b841-adc3beeb2c19", "comment": "Malware payload (ArkeiStealer)", "value": "2a44cf9be75066de3053fa8fa7003c49a3d88afa", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647451990, "uuid": "d5337ea3-5407-4e06-9ed4-dc18c74f8851", "comment": "Malware payload (ArkeiStealer)", "value": "ff362b7cb81da7d58e40da109aa2daa2af9c6cf99720acc7ff58d7374fa9f1d0f6b6e97d6716f3e11032172c9dc98d33", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647451990, "uuid": "e2a3b801-e34d-4473-ac38-61b0422a2cd0", "value": "T14FC48E57F7CBF6F0E6BE827A86B1891D52B774520270A78F664072896D23382453DB0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647451990, "uuid": "3c8dff03-0ee8-4e78-b063-9ac02fd82df2", "value": "a31761b5a590c4c499d5f4a347d75c12", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647451990, "uuid": "22b9fed7-b27e-4645-b2c9-47679bf5c3c9", "value": "12288:Ln/zjvGHAykHJRLW/4+8bzbBSreM3yqZGDx:Dz7GHAzH7jX1BFx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647451990, "uuid": "6c051649-d7ac-4eee-b481-f5f5719dc0e3", "value": 557568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647451990, "uuid": "8cb5a3f6-f017-4672-a0f6-c36f9e53b351", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647451990, "uuid": "76b99111-9bb9-4d21-9885-15deb6a37837", "value": "fd959a8b07081ca2b2724265399e6479", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8536c3db-a505-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647420367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647420367, "uuid": "bbd2e5f5-5de2-4186-ba6d-40016af18f19", "comment": "Malware payload (Mirai)", "value": "73b17606ac314e7fa24706ac2c547cbe", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647420367, "uuid": "40ea58c6-d710-4d0d-b66d-c19501a76c11", "comment": "Malware payload (Mirai)", "value": "aab990ad7a91fa79cf0ad37e99e8d3794e384606ccc1f694e83c5e0287cd91af", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647420367, "uuid": "36dd7fe2-e29e-4e2d-8a87-b8db09fdddfa", "comment": "Malware payload (Mirai)", "value": "6d3367b1563eb028dcb5dfe0bf31335ac23c3b35", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647420367, "uuid": "9bbadc2c-c927-4826-a5c2-a8c503c712ba", "comment": "Malware payload (Mirai)", "value": "ecafe0c1c42c03f9f76936cf97853adfa8bac946173815585255bb10c0a1ee2280456dfb9d8e74b9d3426b6e047b8a35", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647420367, "uuid": "b522f9a9-7ef6-42a5-b521-d04b74009b50", "value": "T11C336B65E8294D64C14E01B4B82C8D3E1FE3E4C5A6823DB26ADEC271144FADCB904FF6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647420367, "uuid": "7281a405-bfed-4f5b-a106-a2397a904194", "value": "1536:3a+BiFCYXjD2/FuhF0KbwBx/eURAYEYCF:3pioYXOt4OuyAYEY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647420367, "uuid": "f49e2a6c-7696-4e76-a77a-7246e4c1f635", "value": 54668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647420367, "uuid": "301501f6-5c18-4e04-bc16-5c78b7ea23aa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647420367, "uuid": "3ccfd9c4-7297-4bd3-b1ae-cd8458f98f76", "value": "73b17606ac314e7fa24706ac2c547cbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "745073c5-a4ec-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647409601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647409601, "uuid": "22e450c0-ddb9-4cef-8498-36ac607397df", "comment": "Malware payload (AgentTesla)", "value": "3e1488c65881e45862e5b17ad5bc23f5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647409601, "uuid": "96aa6891-9b38-4aa1-a256-eba4cb780e72", "comment": "Malware payload (AgentTesla)", "value": "abd985aa1bfe39c848147583e821f9a2b0c806db69900e96850a7a9d70dbb75d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647409601, "uuid": "d9eb1522-0688-42ba-8a29-438185e6f99e", "comment": "Malware payload (AgentTesla)", "value": "127f383b2062c48d4cd52866c7628c4ce5ee7773", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647409601, "uuid": "c9c44a1c-c67a-460d-8890-1e782bc90a96", "comment": "Malware payload (AgentTesla)", "value": "9e60f2baca6c1db5fd598732b101a70ee98d824acdb3a16def9edd61e8c4034dde21a787413ffb0c2ef032597f08a283", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647409601, "uuid": "0d59f2b7-d12c-4d44-a867-65503bd134ed", "value": "T137827D09E3A9C373D5F68B3258F71E91A675F2249937830EC482123ECE437190D67B52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647409601, "uuid": "75b6f3e6-bd49-4c2e-80a9-1bdafeb5659e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647409601, "uuid": "0e345eff-01aa-4c44-8aa1-01c6930d0213", "value": "384:58Nf8EoKHFzTYJSUaepk0OOyd3zXzYJtH:6Nf8upYJSUaq1LyJDzqH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647409601, "uuid": "3a8ffe2b-416d-4db0-ba2e-662abb2c6510", "value": 18944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647409601, "uuid": "e3e88c38-6073-48f4-991a-b46dc7746507", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647409601, "uuid": "1434ea01-a1d7-459c-8f38-458b85f0e9c7", "value": "JC220000322.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5672254-a533-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647440177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647440177, "uuid": "8ba9c924-5085-4e74-af5e-93a97d0a83c1", "comment": "Malware payload (RedLineStealer)", "value": "fc8aa247e3276097e369173274da8cff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647440177, "uuid": "5b51d003-b89a-4add-8f5f-27a85ad95352", "comment": "Malware payload (RedLineStealer)", "value": "abf0a7d34d6187eea645643b45c99eeb12778ef1ad803d56caebe96b05aca52e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647440177, "uuid": "94e47e94-1fa4-4a84-bf99-bef89af7fd67", "comment": "Malware payload (RedLineStealer)", "value": "6f068a0b08f4deffef0c623b3ad86171f7af59f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647440177, "uuid": "83208b45-ecac-4ae6-bb5a-e4885037e68d", "comment": "Malware payload (RedLineStealer)", "value": "caa760cd456257667fb7c6887a78950fbdfc6cfe719c5bfcf98a14e7d3f4b8b70e92bcc5f120718658699c5065ebedbc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647440177, "uuid": "72649a91-9e2f-412d-ad5b-b6b84dfcfc37", "value": "T15FC423263A8FB108F4ED5AFA5BEDED43D056315601AE8912EFC87F669024C3877406DE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647440177, "uuid": "deac9a87-b155-4006-86b9-c9e46bc1ed23", "value": "390d44241890f16bc2697a53156b03cc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647440177, "uuid": "5286df2e-35e4-4946-99bf-9d1045e720dc", "value": "12288:xqPOldwd5r43BfyfWRbTULSK/lGRgOUqmq9kR6lhKXhB3a9FsqJKB57d8f+iX:x2Gdwd23hoWRbILSK/cRgOnmq9g6kB3G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647440177, "uuid": "55c8b3f4-9b15-4dfb-91c6-2aa94c380247", "value": 546816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647440177, "uuid": "44ba69cb-0f5a-48e1-8c11-17da2278dab7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647440177, "uuid": "87e3c108-5352-4a88-b76e-d2b7e81f2879", "value": "abf0a7d34d6187eea645643b45c99eeb12778ef1ad803.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "511e67f1-a572-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647467094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647467094, "uuid": "15740420-c292-4e43-b6b8-c33687073e14", "comment": "Malware payload (Mirai)", "value": "92229429d449fa4969fdefc64c82f112", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647467094, "uuid": "7673a18f-f479-4014-ad3f-56492e128ac5", "comment": "Malware payload (Mirai)", "value": "ac04d68b5823856d769fbf4369e6f82b691c014aaaf0d31e929f1331c751eb47", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647467094, "uuid": "4d7c5c9a-da1f-4fb5-8f4f-1470bdf0c169", "comment": "Malware payload (Mirai)", "value": "eafe61ca54c29f4cb4e7ac7b4e526046574693ee", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647467094, "uuid": "571cf1c8-d9c5-44e3-9419-c7d19c912aee", "comment": "Malware payload (Mirai)", "value": "babf12311e4140bc6c185209f2cb9880cc0e10948282df8260919eb5cc937f9348c0a015bcaf9ce257f09fc26a69a515", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647467094, "uuid": "8916eb79-788c-4e51-8d48-ce833552b695", "value": "T1EB932986BC419A11C6C61677FE2F108E331257ECE2ED73138D245B707B8B91B0E6B95A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647467094, "uuid": "126dcb2d-ec7a-43bf-87c6-15c67094bf74", "value": "1536:XhnRcUWoXufJ4Au8YKzv/5J5zVMcO2aUl9aFmLbRMIiEg188Qxc/5SYG:EUW+lAuGFhMRn0awg188Qxc/E1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647467094, "uuid": "f16e39d9-ac5f-4faa-aee3-cadebf3660fa", "value": 95476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647467094, "uuid": "3ab4e7c6-b2e3-43f1-b042-d7c52d6a61c1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647467094, "uuid": "b560b92b-0681-43b8-9041-ee857390c3f4", "value": "92229429d449fa4969fdefc64c82f112", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0902ed46-a532-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647439485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647439485, "uuid": "739d0665-53b3-4144-9823-a5b9bed4a800", "comment": "Malware payload", "value": "94e49c4017373b75d1c1fbd026e05c01", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647439485, "uuid": "4a589d2d-36eb-4b75-8f0d-c9c45a4f418f", "comment": "Malware payload", "value": "ac51c71015cfc58a83ed66b84df8dc1fd6b3543dde411ab8b4ef0cda434a7538", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647439485, "uuid": "b8864e7f-94d4-422b-9228-2380f8ad3d98", "comment": "Malware payload", "value": "61925142544bc0627a1d5019527b0f61273b2b8a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647439485, "uuid": "0d196b0e-8770-4c01-8184-921ecf1173e4", "comment": "Malware payload", "value": "98c46fdbb15384154f86c4d7445acca5a43838fa3a1339a09b28bc97463021bd4ef5c75ed371475dd7e07c50c6db9caf", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647439485, "uuid": "a0e12e99-b01b-45b1-841c-903caa257a0c", "value": "T193133B85BC81DB16C6D022BBBB1D41CE37164769D2EF32479D3A6F5137CA82B0E7A604", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647439485, "uuid": "94d57ed5-cdb9-4ed1-a9ba-1267471dbd28", "value": "768:g1hfVV3FGt2Xoox1QLBXffIqmo8f/wFPc3Ihx6VLR3wDWUxB3lmKZl56n:GhNV3I2J10fIqmo8f/wFPcO6VLR3qvBK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647439485, "uuid": "4a6a16a8-b715-4e11-912e-7bd8956a8a8e", "value": 43232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647439485, "uuid": "e4d72440-6ce3-4e1a-a6d5-1d0cdb01d4e0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647439485, "uuid": "e698ccd0-4b24-421c-9ac5-d6da8be1f646", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf3e945b-a4fd-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647417055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417055, "uuid": "bcf490a8-e4b9-4ef2-b380-f13657129426", "comment": "Malware payload (Heodo)", "value": "e8e72b5db8aa4ef1c85147fe397bc534", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417055, "uuid": "bbf59974-b675-4c15-9252-94a962e9a2dc", "comment": "Malware payload (Heodo)", "value": "acf485f5dd5ade0449b11f432f8ba32810801a1d9acc0bf970d6330ea1084419", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417055, "uuid": "2e2ef5a4-5f50-40f1-8f35-74f58fab827e", "comment": "Malware payload (Heodo)", "value": "0e8f87e855e0e7d7c904baad6cc6621a41fd684d", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417055, "uuid": "b4a0fe37-8762-4de6-b99e-2ef701be398b", "comment": "Malware payload (Heodo)", "value": "e70136272e83775d24c35d1ac05ad7b659f5a2774445bd9e939d0199761ffe9ffaaa95f30e78afa0cd30fca110f9d789", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417055, "uuid": "cc9acebc-17d4-4ee1-ad01-f4dc0c695032", "value": "T19AF2CF2DA3A0EF5ED61DED38849881EA421579154506EB4FA85CEB0D6F493C33B1F0DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417055, "uuid": "9d12ff70-8905-497c-8831-64aa1003e34f", "value": "768:cjFhNKbeXizXT2LxdFfPdkqstJ1goE6vS:cBTGeXgXUndkqegoE6vS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647417055, "uuid": "469e8806-6bd1-4bc5-9865-94e8a65b7f77", "value": 34391, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647417055, "uuid": "3b75c8d3-9436-4a53-bdf9-552839664f5a", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417055, "uuid": "33615d32-0fbd-49fd-b816-1d04ebaa9fb7", "value": "10006855205055288298.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0a7bb4b-a522-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647432975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647432975, "uuid": "c86f0f44-5a00-46c8-bb7a-f08fdf34d50d", "comment": "Malware payload", "value": "8eb3b1e4c31492708db3d0008d893dd5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647432975, "uuid": "f6e9b0b6-ded0-4f16-89fc-5ec95753efbc", "comment": "Malware payload", "value": "ae260cc9c23cd1d8b4b33d9a7372cd8c34ca40124502228a988d57c279c50280", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647432975, "uuid": "7ae9638c-a28b-4a57-8141-e162c15aefa9", "comment": "Malware payload", "value": "152eca64515e0260bb417fa1ef9d74805018fbac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647432975, "uuid": "6465834a-c797-4bcb-b636-d6d71a09cd06", "comment": "Malware payload", "value": "5d5d043831bc92623714751886e1c3caee0bc64bb4e2c7fe240936f6f7dd3b353196adf4ce08f0f65ad814f618a7f86e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647432975, "uuid": "7410efa4-4d9f-4433-82ad-0ee6f9c6f444", "value": "T1F8B53358DB989969C19174F745679F5E8330E3202F2C8BEF1B067C18EA71EC3997C0A9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647432975, "uuid": "60d239c5-6759-4dad-8afe-4ec78ffee224", "value": "5aa94c7fbfc01c9462c4d62e06efe88a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647432975, "uuid": "6e2b365c-d406-448d-bb58-52dee37168cf", "value": "49152:TgGS1LSfK6NKyLKGJmfedZGEk6aftElvw29S1q2FG00INlby8vHRt2ws:clOS6syucmfoZvk64vW2FGelO8vxa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647432975, "uuid": "1f4bb06f-322c-4c9f-8ff7-0a2b070e92f2", "value": 2285312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647432975, "uuid": "e8c7659f-73ec-4e2e-8a6f-939eb6d056fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647432975, "uuid": "3680a1d4-0c65-4a73-bb44-fdda223d2ab6", "value": "flashplayerpp_install_cn.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e0a658e-a53a-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647442984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647442984, "uuid": "c33471e9-f789-453e-be7f-54e0d5ab1f52", "comment": "Malware payload (Mirai)", "value": "11e7d58b7a03e6f55d0d61a69dac0fd3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647442984, "uuid": "f173fbef-1e58-4ba8-9585-4a78c6e69f78", "comment": "Malware payload (Mirai)", "value": "ae5af8c0ca3d4e22b7b79a4b27d8b805703a904e4b8b2d36e9a7693682758f92", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647442984, "uuid": "0df58783-08d5-41d3-9c98-c2a11e037f49", "comment": "Malware payload (Mirai)", "value": "2a9d7fe3abff61328726e283242e85c7de2d63dd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647442984, "uuid": "a3c88409-e599-480b-8fab-5176ba0a0144", "comment": "Malware payload (Mirai)", "value": "0476cd8deb4435b3954775c67a92a0be602a84670423b84aa401b890710bc7627765a65d7e2170eba2a715ab47e6a31c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647442984, "uuid": "945df689-d5a0-4a89-bd79-c0acc383f9c2", "value": "T1EA13497BADFDAD50E109017DAC56DF3C0B67D1A19816EFBE011AC03548434EABA0B3B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647442984, "uuid": "4b2b68d0-09e3-4b27-8420-c1d29096cae9", "value": "768:2jNZaHUxWiZrSo86hCFHNlUZyOz6CSI0+hUlrFv4B:2jN8U1rl3hCFtlUAI6CnBClRv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647442984, "uuid": "a582fae5-553e-498c-b9fe-bb60852d3f82", "value": 43144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647442984, "uuid": "965d86d5-ff77-4c5b-8109-002697b49b83", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647442984, "uuid": "4b6ab7d8-25cf-4c30-8160-a5527d2c753c", "value": "11e7d58b7a03e6f55d0d61a69dac0fd3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fbb7330-a565-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647461401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647461401, "uuid": "10a848ee-f3c4-454b-bc62-c917ba67a6d9", "comment": "Malware payload (RedLineStealer)", "value": "3b1c6656d31884cf8b7ed3d6c6085d27", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647461401, "uuid": "1199c664-fe1a-4d69-ab6c-260450bdf4bf", "comment": "Malware payload (RedLineStealer)", "value": "ae5fbeeb442c6be9185291147500eba3131e3068500293b7d41bbabd31bfe54b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647461401, "uuid": "1ef66ea2-9631-4761-8592-a6bfdb0a1cc6", "comment": "Malware payload (RedLineStealer)", "value": "d94504f64103c3701bb933b70a080c39f6144c2a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647461401, "uuid": "2bc91742-3cf7-4e89-897c-ce2584ad5dc8", "comment": "Malware payload (RedLineStealer)", "value": "f4b9da32826938d9763730799875afedd0e10919d9c1792767f87ab9bbaa54074b67518d16de7712b3b03d6afc9be243", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647461401, "uuid": "8434b9a3-bfbb-4cd9-9ec1-566f1dd3ac76", "value": "T18A75339EB3463B28CB5F09F43F43291E05119482B9C5BA8BE76E7AF39D395D6963001C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647461401, "uuid": "1f0ff873-8ac1-46f8-891d-565541a3d684", "value": "445554923421947cbff896012e27345a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647461401, "uuid": "78ebe682-5d6d-440b-9bf2-7b0d3e624b4a", "value": "49152:IOjIX2ZGYUzrFabTFagIbuXrOpiNadU6NVZ:IIIXm5PFRIbyipeCv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647461401, "uuid": "b9b4c385-e739-4dc8-bec1-b24abb8d51e2", "value": 1701376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647461401, "uuid": "64c9310c-ebcd-4d3d-b450-6bc1c5c5eef5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647461401, "uuid": "84c9c128-2d17-4d2d-a9c3-92125d6c80ba", "value": "10545892.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f155ac9-a4fb-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647416061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416061, "uuid": "9789c443-166e-4774-a0e2-a0730a4e3aa8", "comment": "Malware payload (Heodo)", "value": "7975f6819f03ca57bd36a29c4a8b2b12", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416061, "uuid": "4a1ee19d-d0f4-440c-a7a9-a89d70599303", "comment": "Malware payload (Heodo)", "value": "aebba0d7f66d6bbce31c028dab27496f83e72d99f78db4920bd70b28981c3004", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416061, "uuid": "2adc7a36-dbc6-4bc9-ae25-3b653cc38187", "comment": "Malware payload (Heodo)", "value": "9d0b727fa7aa88bffaf98d2780a3ec53c852004b", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416061, "uuid": "003cc490-bb06-4f91-bee0-72ff66ab6787", "comment": "Malware payload (Heodo)", "value": "5598812e638253fb1ec0f170f7731defd296005ee8007ef1e9e4581afe2d1a05a8e9b0082210f6becd847b49f5605c5c", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416061, "uuid": "d051dd74-cb5b-4bb2-875a-becfcaf7347a", "value": "T136F2CF2DA3A0EF5ED61DED38849881EA421579154506EB4FA85CEB0D6F493C33B1F0DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416061, "uuid": "3b474ec5-f5f8-4768-817f-a83d4848762d", "value": "768:sjFhNKbeXizXT2LxdFfPdkqstJ1goE6vS:sBTGeXgXUndkqegoE6vS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647416061, "uuid": "b63119ae-bf02-429b-8c11-44f7a85a2119", "value": 34391, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647416061, "uuid": "bfcd3e22-7090-482e-b3d6-b2fc7ea8943d", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416061, "uuid": "8aa2a0ed-5375-4c66-a753-aa95a292b6be", "value": "Invoice Copies 16-03-2022_1644.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d4339bd-a4bc-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647389054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647389054, "uuid": "de215e29-9409-4e7f-8df3-60b5d6a47618", "comment": "Malware payload (Heodo)", "value": "dbe66bbe05901e62b907bbd05a669574", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647389054, "uuid": "df849861-aafc-4d4d-ba87-eda0d19e3ade", "comment": "Malware payload (Heodo)", "value": "af96e027ca7cd0874ed8a5239c7733cae17886448134a0e70343a50f71334229", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647389054, "uuid": "8d8ef914-383b-4c9f-9fe6-7bb82ce2be6e", "comment": "Malware payload (Heodo)", "value": "db27016f4310c94e468d7e3d828edfb5a399c792", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647389054, "uuid": "b32ce2a6-c5fc-43a7-97a3-25e8d634c010", "comment": "Malware payload (Heodo)", "value": "c2f26ab1b8369ad75366f582481aecd09db859fed68b7578350bf09c9c455af73abaa3366685321687ff1b805eec5080", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647389054, "uuid": "69fc883d-73fb-42f2-a9e7-eec67e62e971", "value": "T170E46B0124A29C71C3E7C9756BD91E1539EAEA92CFF7800BBAE06B7CD874942C337516", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647389054, "uuid": "768706f2-7ed2-41ec-87d4-57ae5215b72a", "value": "a38617efee413c2d5919637769ddb6a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647389054, "uuid": "9f89cd36-c166-4f84-919f-5f628029855e", "value": "12288:KFxGsTPy4BHT4Sj1zf7f7ABqDLkWynCsZ:obPy44Y1/f7VDLkNnh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647389054, "uuid": "17007d33-7f44-4596-915f-93f237145baa", "value": 704512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647389054, "uuid": "eefeafa6-3fe9-47c7-b441-e3a0927be225", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647389054, "uuid": "826a55c1-5a1b-462f-9bb6-460d0a36bfef", "value": "emotet_exe_e4_af96e027ca7cd0874ed8a5239c7733cae17886448134a0e70343a50f71334229_2022-03-16__000409.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "512f264e-a56b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647464088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647464088, "uuid": "3c6b7d6b-f9b7-4199-89d3-68a42052f2ea", "comment": "Malware payload (Heodo)", "value": "fe4025a85a7f589676ac19d792a20169", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647464088, "uuid": "019d1f52-17d2-4476-b0aa-273acf6e64ab", "comment": "Malware payload (Heodo)", "value": "b01e92516b078e04681aad42966ea45189d99202f699f08309317999aa321226", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647464088, "uuid": "1486917d-f617-405e-9c2e-a6025c3f51d1", "comment": "Malware payload (Heodo)", "value": "f85b2253e839fea814caa049c657fbde14ac70b5", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647464088, "uuid": "048ba773-186f-45b8-b49b-120feb6f64d0", "comment": "Malware payload (Heodo)", "value": "015c0a7362a7265bc8bf25a560b992f85314596fce4d5f119da15edba40d50598eebb47ef2b7ef5043627cf804386d52", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647464088, "uuid": "7112e804-c69d-48c4-9cd6-cf6cff48f515", "value": "T11FF4DF1176E1C076C1BF12304956A38D23FAFD509FB986976FD02A6E3EB41828E34767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647464088, "uuid": "8ab5aab7-27fb-4ca9-b2b5-c7ac40377fb7", "value": "66a21a1bcb4077b3ed89c00ee693486b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647464088, "uuid": "c4d481b4-5d2d-4219-b740-d17a8a9c08fb", "value": "12288:g6O4TpP0XjxCCFJuf07j+Xk7hw8rLneTfABCJoWRWwfpW:BeCCF88j+X18OTYA7pW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647464088, "uuid": "47316b54-4c20-45cf-a6d0-32da454c5c36", "value": 749568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647464088, "uuid": "fc9c196c-4e95-4ace-bd1a-c447c92797b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647464088, "uuid": "062890ba-534b-472c-bb43-d1be503e66ce", "value": "fe4025a85a7f589676ac19d792a20169", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f875e2d8-a568-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647463080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647463080, "uuid": "d471def4-0d2a-49a7-a9dd-54117b06ab6b", "comment": "Malware payload (Heodo)", "value": "1649121227582420975c91256690dd4d", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647463080, "uuid": "c62b960e-113b-4d30-aea9-51644cf490b9", "comment": "Malware payload (Heodo)", "value": "b05677b226640cecda367dc0fd1ee6a8535f531cdd3bdebd911b75247a9dc397", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647463080, "uuid": "57d41703-ae05-431e-b654-1ebc59a5ca57", "comment": "Malware payload (Heodo)", "value": "1ece137e94213df7de80076847c9cfa488a2a2b6", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647463080, "uuid": "11784737-e1dd-47a1-bf95-e250b2c4c402", "comment": "Malware payload (Heodo)", "value": "d2b49ee30ac59cdfcf6fcc593b10a4bf6b72b3021fdcb12746f8f18ca5bcc195093acb54f27f2cde8136fdb23e34a83d", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647463080, "uuid": "0efc0c2d-86a8-4f4a-96eb-f277a16061c4", "value": "T15CE2DF29B3A0DB5DD30EED35846986CA525AA825C406EF0EAC4CF71D2F492D3371F49E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647463080, "uuid": "04a1d886-0b9a-491d-bf85-bea3dd5e1ba6", "value": "384:bwdAZPFhNjUA7icg0SCdiVAg2GKgUrNU/qWhZOdBNPJM+kqr9eCgh0k5NGE6h:sdwFhNbiH2rndFfPdkqstJNGE6h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647463080, "uuid": "17ec8f83-df6e-4086-99f9-205dac745bce", "value": 31319, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647463080, "uuid": "9b18b3f4-a241-4320-9bb3-a11b07da59e1", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647463080, "uuid": "46b6d917-21e2-48de-bdf6-c1a00ef7b0e6", "value": "File_1603.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bb6837c-a4fe-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647417237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417237, "uuid": "c38b96ae-79b4-41fa-b595-b952d67cafcc", "comment": "Malware payload (Heodo)", "value": "acc732a2b9db8570e984a32e5f535eb9", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417237, "uuid": "9ad3e9cd-3365-480a-8ba9-cf735a1e8c03", "comment": "Malware payload (Heodo)", "value": "b08033c0c166256787c79f5b3b3fdce91e78fbe8e9818f4fe86934e1e8141261", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417237, "uuid": "3ce94000-1605-41c4-b907-3d43239a8322", "comment": "Malware payload (Heodo)", "value": "f63acde50855bcecd232a25143369ca85801dd8a", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417237, "uuid": "caf33a82-2357-4330-ac4e-9e9770bc895d", "comment": "Malware payload (Heodo)", "value": "50064717af15527225cc358800c4f614dc08ac0a9d92958d260b9650e946496f42411c96b509026d94971448715b5305", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417237, "uuid": "e3ebdeac-9d54-4e49-9a20-b898a42071fb", "value": "T1BCF2CF2DA3A0EF5ED61DED38849881EA421579154506EB4FA85CEB0D6F493C33B1F0DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417237, "uuid": "fac8d8ea-774f-4c4e-9c85-c6a543c58a96", "value": "768:cjFhNKbeXizXT2LxdFfPdkqstJ1goE6vS:cBTGeXgXUndkqegoE6vS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647417237, "uuid": "9f5a1d3f-4f3e-4c44-acaa-0e1e86f1b7fb", "value": 34391, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647417237, "uuid": "8cba8b7a-4b0a-4049-a587-0dc85ebda9fc", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417237, "uuid": "1774c16a-e692-46e9-b5eb-7b63c1587a72", "value": "2022-03-15_2019.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67b7bc88-a4d6-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647400131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647400131, "uuid": "ec6cacc9-33b3-4d9b-929b-e8b4b90196f9", "comment": "Malware payload (Mirai)", "value": "e7be53b01cd8e0078f37cab614f8cdfa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647400131, "uuid": "9317f2ba-7e9a-4822-acbb-1a48b92b6394", "comment": "Malware payload (Mirai)", "value": "b09714a10a00e2a7ff9790f7e38d105b709b95bc2d28ff7358dbf16d3cbb6c25", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647400131, "uuid": "59407ed7-6057-4c87-a2a0-89054f2ff7d8", "comment": "Malware payload (Mirai)", "value": "d934f233d2b0a99ebdc8be48554408ae8bb2652b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647400131, "uuid": "7c6bef37-4b0e-4372-8d96-2ffe2891ca97", "comment": "Malware payload (Mirai)", "value": "d193d9ba9d085b6b6ebcc81e5d65eff53b62c2cdd4da427ddc42afbeac48fc7f24e3960eaface0aa14968870a34863b2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647400131, "uuid": "5111858a-9319-4f80-94cb-c9dee17058cb", "value": "T173430956F8829B3AC1D0627AFAAE568D333073E8D2CF3217DD601B517A8A41B0D67F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647400131, "uuid": "664b0dc1-1ccd-46d8-9ca8-e90241814f84", "value": "1536:r3FP/B0J9QIEFOw4Qf04bQkaEkFEjZXnbJa10w:r3FP/1trPQkxAENr45", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647400131, "uuid": "8814cf11-6256-4d54-9347-f3b8c2ee9a6a", "value": 59924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647400131, "uuid": "2e748b63-bccd-410e-88c2-dc307ad74c81", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647400131, "uuid": "08124802-deb6-4006-8f9d-8bd3449ac367", "value": "e7be53b01cd8e0078f37cab614f8cdfa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66cf9a0f-a536-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647441361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647441361, "uuid": "cd4fcb38-b68f-497d-87a9-653dd7684a10", "comment": "Malware payload (Heodo)", "value": "26e94c39f952645160ca911985351c86", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647441361, "uuid": "989f9920-6206-442e-a6d7-c3338914a41a", "comment": "Malware payload (Heodo)", "value": "b15d83daa484f04badb274a46ad3524d095a51cfda545a94b056844d9dae217a", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647441361, "uuid": "a9aae131-405a-4ad4-b128-253fea01fa8e", "comment": "Malware payload (Heodo)", "value": "40bf5219d69c01a92106fca996f267ff61158f05", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647441361, "uuid": "b7287657-7bf3-4226-a751-f72b3795ce46", "comment": "Malware payload (Heodo)", "value": "d1489ddd13238bf3a9c1bbbae42fc1e49d2c7b6e490c05e0933e4903643f0553abacb1418dca36797e7b775f450b70f4", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647441361, "uuid": "7968d0e2-2ebe-4a8a-9a03-59d71141313e", "value": "T1BCF2CF2DA3A0EF5ED61DED38849881EA421579154506EB4FA85CEB0D6F493C33B1F0DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647441361, "uuid": "ed8079f4-f083-44f0-918f-deefb9955a04", "value": "768:YjFhNKbeXizXT2LxdFfPdkqstJ1goE6vS:YBTGeXgXUndkqegoE6vS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647441361, "uuid": "6f44bb10-baa2-4e43-8744-d974dd79125b", "value": 34391, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647441361, "uuid": "2f12a06c-ca79-4f4e-8531-7042b9e02105", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647441361, "uuid": "d4b70b5b-be12-4de0-8a34-fd8e270d2c9f", "value": "SOC report 03 16 2022.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8078c59e-a507-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647421218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647421218, "uuid": "36c65d5c-072a-458a-961e-5f00a4cc6460", "comment": "Malware payload (Heodo)", "value": "388b2cc339d8b100f1f38bc50085214d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647421218, "uuid": "4cd03fad-45ad-4de1-b10b-11d35a9f49ad", "comment": "Malware payload (Heodo)", "value": "b17af21cf63721f0639a666e4c12713d56adaf410f210d5246532dcb03e9da51", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647421218, "uuid": "b789b0a1-f7c5-48af-893d-507f7e9111d1", "comment": "Malware payload (Heodo)", "value": "021573707db680925fe52d3d6cad1789f9e64c83", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647421218, "uuid": "7f2367ea-4a63-40ce-86b1-78a9a4899c04", "comment": "Malware payload (Heodo)", "value": "d8cc76b0c9523388dd44a4f06d4fa367c414f4f95b0e41e8e926b35df21a62407ab65c64f81b9e26814fcd886c59a59d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647421218, "uuid": "fea2ee71-ff5c-4497-9ca8-52fa0b3d4796", "value": "T144E45B06AF22A1F0C06B03B40555125AC2EF7ED0A72ED657825DFB7EDD339977A30226", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647421218, "uuid": "1954e798-30b3-417d-810c-608c593a71a0", "value": "066d4e2c6288c042d958ddc93cfa07f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647421218, "uuid": "935e4d9f-649e-4bf1-9018-802fb7fe59fa", "value": "12288:jc899XKPmN4WMkou6ZPJSFTdtXlcIL9v6O8:7GP7dgFTdFL9v6F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647421218, "uuid": "02bd808f-4e83-43a2-b4a2-58b3460c5cb1", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647421218, "uuid": "f42571ae-74fb-4f2f-aefc-627115089f66", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647421218, "uuid": "e273a45c-752d-4ed0-9ade-6f6fb8a2b075", "value": "388b2cc339d8b100f1f38bc50085214d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a74e7009-a50d-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647423860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647423860, "uuid": "44635ea8-8435-451a-9345-11e6fd03b3af", "comment": "Malware payload (Heodo)", "value": "b1508aa0308bc7b1f3ebc5d0ef256d2a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647423860, "uuid": "d277f526-618d-4b49-a260-da54a216f197", "comment": "Malware payload (Heodo)", "value": "b200377742f8f8344fbcfe1451bd005471e0cfb9d0a14e433828c6ec1406ad5b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647423860, "uuid": "419ff401-c371-4d22-91f3-96cd0f154b5b", "comment": "Malware payload (Heodo)", "value": "6e81b570e74ad89fa05daa4516bb2d5ef0edaae0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647423860, "uuid": "1af4995a-7d19-4179-bd32-f09ef20177d0", "comment": "Malware payload (Heodo)", "value": "94e8751fdb5eedee56b54583c4500470e79d2b1b34cd7f43d64b6a137002b70504c88842c78eafe538ebc310558b75f6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647423860, "uuid": "d781064f-7179-44e0-aa08-f773e8007e43", "value": "T1F8E47C12F461B2B9D04B04741F1723A86EEF5E518629CA13AFA8ED5E1F31251FC3FA16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647423860, "uuid": "c7e92946-4222-4286-bc1c-c8247d9924e8", "value": "066d4e2c6288c042d958ddc93cfa07f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647423860, "uuid": "5da856ee-b92f-41d0-97a5-c19df656280b", "value": "12288:DtAanana8Meee0GBGu3qI+3DNJ3vE6v5etxS332d7t5hT/hexLx:Kanana8qGBGuoNxEHxCM7o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647423860, "uuid": "330abaf1-7657-44d8-826f-9c698adb4766", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647423860, "uuid": "5cbe5d10-69c1-459f-aab6-41ac2955059b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647423860, "uuid": "d75616bb-3761-49ce-bf2e-baadbf60cdc9", "value": "b1508aa0308bc7b1f3ebc5d0ef256d2a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dfb845e-a4fb-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647416059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416059, "uuid": "b57c213f-85e1-4575-991c-780c008c641d", "comment": "Malware payload (Heodo)", "value": "8fa424bc8c1be0ffaeeaddda962cab82", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416059, "uuid": "e884e335-2776-41b5-bc27-1bbc12d85819", "comment": "Malware payload (Heodo)", "value": "b20a8dc2ba488466c0448f9a60e948c6cdff374ee7c271e5109150bcb6b1964d", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416059, "uuid": "29ef0ecf-a391-49e0-a045-0ebf587827f2", "comment": "Malware payload (Heodo)", "value": "bd6d378c42b04770df0f693711a640eb55066d4c", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416059, "uuid": "cd444b2c-f05f-4bc9-a250-6a7efc4c3f8a", "comment": "Malware payload (Heodo)", "value": "fafdf8bd7d00dac0ea710c25739a1b1cf2a09eb08d1b8732508e8610de85ea9f2f07c843445de1a07a219e2b86e84ee9", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416059, "uuid": "122842ad-03fb-4cb1-b8fb-3357cdf4f002", "value": "T12933E01F9522F5ACC3136C7DCA4C59F5650D5893E089F62B08857B8CBB1B2E7178F286", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416059, "uuid": "178d98ac-0099-485d-a973-0dbe12a88d30", "value": "1536:XFmPpcEglt24xZdRBzH9hJBrdEwwNXekVIc07:V4cEk2Kd3zdtdEwoc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647416059, "uuid": "544df006-1f33-41c9-9a68-38c909418787", "value": 50551, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647416059, "uuid": "af264902-e94b-4d14-ac4f-f87a3b479269", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416059, "uuid": "643e1a17-696e-4c15-a6e6-a680bfa17a84", "value": "Insight Medical Publishing_9.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34a3a501-a518-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647428392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647428392, "uuid": "1c729042-5950-4fa3-8aa0-bb729c45564a", "comment": "Malware payload (Heodo)", "value": "159029eb72f061a98aea7370edd25d3c", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647428392, "uuid": "10af34a6-5acf-40c9-a5cc-6be8fb5beda5", "comment": "Malware payload (Heodo)", "value": "b286d0fa0a02588e7d89db4b4a2d6d822c8fd8e5a05685bb7e172a03493dffac", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647428392, "uuid": "e2b7001c-d656-4906-ad82-1d9543d2b400", "comment": "Malware payload (Heodo)", "value": "07093fe8a7bb78445cd2c8d71c72a03f245cebc9", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647428392, "uuid": "150f4e86-77ab-4746-98ec-835e94a685f3", "comment": "Malware payload (Heodo)", "value": "1d3d510b3ff0caa4585fc64021988bde33729e23ddd55191c5b7803fdea0a2a03b23f66ea4d033f4ef3fc484b97b106e", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647428392, "uuid": "af5b277c-12ef-49f6-a424-321605b17693", "value": "T194F2CF2DA3A0EF5ED61DED38849881EA421579154506EB4FA85CEB0D6F493C33B1F0DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647428392, "uuid": "cf6fd0f4-defd-46c6-94f2-822266ddd108", "value": "768:ojFhNKbeXizXT2LxdFfPdkqstJ1goE6vS:oBTGeXgXUndkqegoE6vS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647428392, "uuid": "c9eebb4d-934d-4840-af79-6c75be6affb4", "value": 34391, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647428392, "uuid": "4a000979-d3f6-489b-9d9a-dca1ff050593", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647428392, "uuid": "a62d7985-1320-43c2-927f-c8e4ffbc1533", "value": "GED-010322 IOXY-160322.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab0e2bdb-a57c-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647471540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647471540, "uuid": "5e48d775-62f6-4a60-b861-7c411bfb2e57", "comment": "Malware payload (Mirai)", "value": "0655f4d50a83574bb9669fc4ecf2794c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647471540, "uuid": "470c6ee5-5283-417f-b137-3f65fd5bb642", "comment": "Malware payload (Mirai)", "value": "b286ff5da7930e6f64d1e1abc585c6148b27127c21b54895e0d95657c64dcb6d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647471540, "uuid": "33e181af-55fd-4886-8f07-2986456a9a6d", "comment": "Malware payload (Mirai)", "value": "39ba9f912ef8392b5cdfa0b2fc7c3b5dc586a400", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647471540, "uuid": "b6b1dbd9-b420-4d9e-8314-f61cea13989a", "comment": "Malware payload (Mirai)", "value": "f9ce97c1ba5cfdde48c318f25597712088f988b799f249f9628037efc29bae0e9479a3a54db064a39fdf7209968b8143", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647471540, "uuid": "8840f594-913d-4f28-b11f-b138538542c3", "value": "T1CA33A6482F318BECF238827482B38B38D75813D167F1E7C5955CE4044E64A9D6A6F7EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647471540, "uuid": "2da8cc05-8479-436b-8870-0a9aa024e404", "value": "1536:n34pCDsWpzjVzjYxj/iv0tXUrSL8OXt+dlUAl2c/:1t0tXUrSL8OXQdlUAkc/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647471540, "uuid": "9ce94198-ba68-4ec5-8b27-47832b10d34a", "value": 52956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647471540, "uuid": "da213ad9-0ba7-496b-a201-cefc63514950", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647471540, "uuid": "d1dcb4bb-83e3-4873-8b24-f5a101b1733b", "value": "mips-20220316-2258", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6cc965c-a54f-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647452340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647452340, "uuid": "e7222825-ed05-4ee4-823b-2f5a56d70143", "comment": "Malware payload", "value": "c4f79edc4498c5570495bb36fc942134", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647452340, "uuid": "98893faf-27c2-49bd-88e8-fa32e687bdcd", "comment": "Malware payload", "value": "b33d569af5e490875d6473c6402797ddb4ce639bb1f1cf7f67698eeafa625f09", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647452340, "uuid": "cadd04d6-ec9b-42e8-815f-23395a2a7fb6", "comment": "Malware payload", "value": "00046b588252502480e8e708a22d25ae1d9b05fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647452340, "uuid": "212c4f4b-a9ea-437c-9937-d685d0150bee", "comment": "Malware payload", "value": "66b6eb382b7679a195e91613ff253d798386dd473bd9be688e290466efee333f93cc18194b9f489f46973ae07c6e77a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647452340, "uuid": "c8159d7c-d1f8-4060-8020-b782bca2d06b", "value": "T185D394122ADA1459E3BF8FB07FF2B5EECA76FD231516E5AD048102490B32B41ED01B76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647452340, "uuid": "c6f39231-8cd3-434f-81e2-faede2b94923", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647452340, "uuid": "decbfffc-13be-4c99-acf7-41f7d651daa4", "value": "1536:+W27RutYPWEBvw8WvBgVdmUqkbv49FusLKw09s7MzhLbbATOX1A/Oux1b:+wBSdCkbvCFnK6M8Wuj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647452340, "uuid": "3a967d0f-072a-4fc3-a26f-e3b513fef112", "value": 134144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647452340, "uuid": "5fa552f5-396f-4b46-ad0c-9a26ed519d35", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647452340, "uuid": "eb2698f5-9b67-4047-a5ac-077b597d2aae", "value": "a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf181585-a55d-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647458286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647458286, "uuid": "5dd76a9e-0dea-4627-8b4b-cb28aef7d891", "comment": "Malware payload (Heodo)", "value": "c8db07abaf1ea3fb909096b88cef6079", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647458286, "uuid": "713f77bb-f241-44ba-96c5-5faa90d8fa15", "comment": "Malware payload (Heodo)", "value": "b4446f42fb55f80ae6b5219cb889d82c07e9164c749b428527c63a3f187e1989", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647458286, "uuid": "a877f473-37b8-46b0-a3ff-e08ea2425f52", "comment": "Malware payload (Heodo)", "value": "603ce00841d4de8d7bb110ced463f09dfa2a5372", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647458286, "uuid": "f2f43a29-faa3-4d3d-8213-164fdf7c5639", "comment": "Malware payload (Heodo)", "value": "fcb6356513fc56cc09e5ba0f45a1079baa90034fb11d4baa0fefce3f73e505ecaf9b16efa657c9f5acb67fedab098d54", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647458286, "uuid": "b50f9775-cfdb-415e-9e20-043becbf88ea", "value": "T1F0F4DF1176E1C076C1BF12304956A38D23FAFD509FB986976FD02A6E3EB41828E34767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647458286, "uuid": "543f24d7-48ae-443d-a651-6f7046712874", "value": "66a21a1bcb4077b3ed89c00ee693486b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647458286, "uuid": "96be7f52-ba49-49a9-9efd-d3632a329b8d", "value": "12288:g6O4TpP0XjxCCFJuf07j+Xk7hL8rLneTfABCJoWRWwfpW:BeCCF88j+X+8OTYA7pW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647458286, "uuid": "cafcbfe1-918d-4fb8-bafe-aca48623b3a6", "value": 749568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647458286, "uuid": "16d741de-9c8d-44e6-89aa-e3ad5b4f4d4b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647458286, "uuid": "4429a858-e111-4306-8492-707d6c6ad3c2", "value": "c8db07abaf1ea3fb909096b88cef6079", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c84d06b9-a52b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647436800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647436800, "uuid": "565797f8-855c-4b87-86cf-2931041a26b0", "comment": "Malware payload (Heodo)", "value": "d6cb262ad55062ab17b938b51939f20d", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647436800, "uuid": "76e52f2c-a943-4384-a8ea-102ee5eacd7a", "comment": "Malware payload (Heodo)", "value": "b451a263a736da6b508425162a043eddf65233fc05e8f4cd5f9e562306889062", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647436800, "uuid": "704dbf7e-4e8f-412e-811a-d958c1a4560f", "comment": "Malware payload (Heodo)", "value": "df8887e24d1e224a9524269d226613006531ed16", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647436800, "uuid": "adf9fd1b-ddd3-42db-993b-08c80dc6300f", "comment": "Malware payload (Heodo)", "value": "07a1bf1e1d692314543c7052abc0340e4801bbb0addb73b2fd0d66e433824a770ed4ababc74acf060fcf41cd5b69431d", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647436800, "uuid": "9e9e9a45-1f09-4332-ac4a-8e02e90e2da3", "value": "T19FE2C02DF2A0EE1DC21EE939446895DA421DB4558502EB4FB95CFB1D2F0A5C23B1F0DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647436800, "uuid": "6b4b1c51-2ff7-4e8f-ae2c-2a88b90ea247", "value": "384:8jzZPFhNjqEBOA7iEibbwBLg0SCdiVXUKgUrNU/qWhZOdBNPJM+kqr9eCgh0k5lY:8jpFhNNlizXT28dFfPdkqstJmE6/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647436800, "uuid": "22c4faba-f3d0-46c5-bf97-82b3bf79dae4", "value": 33750, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647436800, "uuid": "eccbf458-9d74-4db5-8cbe-a911d38f3e14", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647436800, "uuid": "acc01dfd-652c-4cb5-8b6b-ea3797e6c230", "value": "29223096-72895113-Neuer-RV.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd888e87-a4fd-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647417079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417079, "uuid": "3477b42f-3b53-4e9e-af2a-60257b1d6d8b", "comment": "Malware payload", "value": "bfca40db13b63e028abec27ecf798396", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417079, "uuid": "975025cf-448f-48fa-9fff-4126f398f984", "comment": "Malware payload", "value": "b4929f7fb874ed756d9a535f255eb29057f5f8bc80ca34471cc3681a20282ec9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417079, "uuid": "12d7f017-1339-4f72-893c-e5d1bf78d742", "comment": "Malware payload", "value": "ef2e4db7d24a4a0e6638b81a3d3ca97a59d36e98", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417079, "uuid": "55d0ec7a-acb5-44d3-996c-273b5dd05c7a", "comment": "Malware payload", "value": "8baeb46f0fdfd964b83b1dfc78312e7afb0e79b1f5f73c409294a63744f55e6b24d75caa355f1eccaa9c0bc113e3f55f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417079, "uuid": "76a5b314-9279-4f9e-8181-cec806f3ae50", "value": "T12B042E809D1CC61CEE6AFAB10833D1B1CE2AFF8ABA4C1A55E440FBD6397527156CD934", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417079, "uuid": "1551bdb1-59df-40c4-baca-d345585e8ede", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417079, "uuid": "bdc9b415-ea49-4d8c-99da-4ad63ba219e9", "value": "384:RraibUZ9yLxa0RFzpBkn6dMafm7omN59M:RRldknZafmL+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647417079, "uuid": "75584638-6b78-462b-9389-5b3e73ca2247", "value": 176128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647417079, "uuid": "9f4f5f67-bc7f-41e2-bcdb-4191f46e9c7d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417079, "uuid": "f9069735-3e32-4167-9299-7ec3f6489b7d", "value": "bfca40db13b63e028abec27ecf798396", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f540e3f-a578-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647469668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647469668, "uuid": "4fcf756c-a58d-4a0a-8fe3-48287f1c8572", "comment": "Malware payload (Heodo)", "value": "7fad1d5dfd93d3982a1fb528d5061608", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647469668, "uuid": "c4c6db20-ef67-4ef9-8e15-7b3be505e0eb", "comment": "Malware payload (Heodo)", "value": "b4c1ebe6637c062d6e42143bc82a29e11e7adce04fb26be296fdf00bbcf16b41", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647469668, "uuid": "bfea3a70-a118-48a1-b95a-2bcf278709b2", "comment": "Malware payload (Heodo)", "value": "0ff24dc00048eac9b0ac95033898a5839036ced2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647469668, "uuid": "1ac99187-411b-4898-a53d-166d580ebb6c", "comment": "Malware payload (Heodo)", "value": "e3f64a241d5c3d815cc78ce54b2759919384b0faf3fc473b41c0ffb8fec7d5920ddfc881af9e00b8284a58e942a625bd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647469668, "uuid": "8d26d1dd-0727-45a8-bb46-f901e5431f4b", "value": "T19AF4DF1176E1C076C1BF12304956A38D23FAFD509FB986976FD02A6E3EB41828E34767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647469668, "uuid": "20db0508-7210-4c13-aadc-83bcf337e3a0", "value": "66a21a1bcb4077b3ed89c00ee693486b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647469668, "uuid": "204ee440-8f23-4797-b99f-0d7733d312ca", "value": "12288:g6O4TpP0XjxCCFJuf07j+Xk7h68rLneTfABCJoWRWwfpW:BeCCF88j+Xf8OTYA7pW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647469668, "uuid": "c4241e66-2f6e-4429-9310-5b93c3da9505", "value": 749568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647469668, "uuid": "a79a72fa-9cf6-4540-895f-9d953e5e9189", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647469668, "uuid": "ddc2ced8-61a7-452c-a376-c5d41f0ee78f", "value": "7fad1d5dfd93d3982a1fb528d5061608", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16172d2f-a4fe-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647417174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417174, "uuid": "53d33dd9-fb32-4501-a18c-e19694fce968", "comment": "Malware payload (Heodo)", "value": "91047e535e6faa7632c926ed40985ced", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417174, "uuid": "71cffefd-893d-49f6-9ddd-4a575f692437", "comment": "Malware payload (Heodo)", "value": "b54762edabc0726fec7c9f957e609ae245f592274e7224938cad6964d1ad549f", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417174, "uuid": "8441f12b-16ae-4f65-aca8-a290beb74f8f", "comment": "Malware payload (Heodo)", "value": "7f9a62c72adfa7b95e4b6430e090bf10b36e565b", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417174, "uuid": "59b6e16a-567a-43d7-bf7f-57117b51bbba", "comment": "Malware payload (Heodo)", "value": "dc5b70b7ae509812c645172832c140c83656db8c1becb05c4e19682c1364ec3a87c303e09b9816d689d0e7cce6f9d7f7", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417174, "uuid": "c0e2ee88-f7be-4aba-aa03-87c152b69a7f", "value": "T12AF2CF2DA3A0EF5ED61DED38849881EA421579154506EB4FA85CEB0D6F493C33B1F0DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417174, "uuid": "58fb5395-4b1a-4a49-a80f-cc2ee7811bbd", "value": "768:sjFhNKbeXizXT2LxdFfPdkqstJ1goE6vS:sBTGeXgXUndkqegoE6vS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647417174, "uuid": "7c437159-d9b9-46dc-a1cb-244d7dad481b", "value": 34391, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647417174, "uuid": "05908f53-3b57-45f5-974e-adf4c679c249", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417174, "uuid": "c866bd5f-550b-43ef-8bd2-f26fe9951a87", "value": "form.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81835151-a510-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647425085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647425085, "uuid": "733f0d3b-b9b3-414c-803a-4911d78b1344", "comment": "Malware payload (Heodo)", "value": "d30f2b217f3ae3e8ac19c81129e7de3b", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647425085, "uuid": "b01d1be6-7364-4e79-99f2-7e3be51f8dfa", "comment": "Malware payload (Heodo)", "value": "b548389c0a77f5e77b0fe07725d79732e9c76162349b1f4dc506bdf29f96e511", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647425085, "uuid": "0dd4876c-73b7-4ab2-b99f-333c4f9f8bcc", "comment": "Malware payload (Heodo)", "value": "a7b076a6b84be14691e3071a219c7cbfce94adb0", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647425085, "uuid": "6106c483-e1ac-4a10-ba61-31f15a22e650", "comment": "Malware payload (Heodo)", "value": "48759fed15792d04a7772b68c3f31f00b67d36bd69ddc08beedb8d7a4ebfc2237189dad4272e45711e57928dc6e0debe", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647425085, "uuid": "cfe7a1fa-904e-43e5-8e88-e0699bd33e48", "value": "T1CCE2C02DF2A0EE1DC21EE939446895DA421DB4558502EB4FB95CFB1D2F0A5C23B1F0DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647425085, "uuid": "b11b8308-ab98-4fa4-8b9d-df1e4d061329", "value": "384:wjzZPFhNjqEBOA7iEibbwBLg0SCdiVXUKgUrNU/qWhZOdBNPJM+kqr9eCgh0k5lY:wjpFhNNlizXT28dFfPdkqstJmE6/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647425085, "uuid": "b72c2d2e-c343-46c2-9fbf-8b8fb0896af7", "value": 33750, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647425085, "uuid": "84059bf8-0fe9-4c69-a349-6dd88a675779", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647425085, "uuid": "553407f9-fc81-40d4-b9a3-3c2c5b7d9280", "value": "Informationen.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b15f8678-a4fd-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1647417005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417005, "uuid": "d921996d-1fd9-481e-8fb6-a3ac40749924", "comment": "Malware payload (Loki)", "value": "90408cdcfdfda10a2a5e93868a82b11e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417005, "uuid": "eec0c641-a4c2-4aa5-8104-9d20ffae00b1", "comment": "Malware payload (Loki)", "value": "b5610cf55d79479ca8e18a19216173b8144e11e2ff3f553cd198d7b05bd3fa3c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417005, "uuid": "d7f9163d-fbfa-4268-94dd-1b9690ba22e0", "comment": "Malware payload (Loki)", "value": "821334b4b528a527a86a1367938410eea161d8f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417005, "uuid": "30db6509-4ca9-41bd-adf2-7fff36727692", "comment": "Malware payload (Loki)", "value": "cb3ce08fb04f4068209330a01b44b9bc4206ac0542872992aae854e0a0cf64a903c64e16acbf80f9f4f501ae549ce843", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417005, "uuid": "5a9ae71c-73e2-4fcb-b690-2365fd75fb98", "value": "T137542393E3D15677CAF6413E6D9FB7ADF3288B74019A1D4F1B748ADA3A100864F0605B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417005, "uuid": "9c40c632-bf86-4b65-b9da-319c3aa7c133", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417005, "uuid": "7c14fa83-b484-4869-a563-50050822cc57", "value": "6144:rGifRXA/QH0ppbnCX6sKw5CpLTYGlrRACet/JBN/Wf+kKWaK:TC/QHepjCFK4CpLTYGNDetkf+kXaK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647417005, "uuid": "c39c8a7b-ec49-4d8c-a498-dccb596795c9", "value": 304371, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647417005, "uuid": "4985e6f8-05ce-429f-a466-d4d6f64442f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417005, "uuid": "b2058cd7-b30f-41aa-ac59-49a41bad3572", "value": "DUE PO28-02-2022.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84fe6da8-a4ff-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647417789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417789, "uuid": "79f49d84-3124-4631-a158-35f3a4c27940", "comment": "Malware payload (Mirai)", "value": "b7de46b613e939e9c9a04ec9adfa382a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417789, "uuid": "785bd5ae-0322-4d34-8cd3-4e12014d64eb", "comment": "Malware payload (Mirai)", "value": "b5943bebcf903843ed57a8c7a2dd4b88efaf46ed0408dde054c9346b4cbd59f4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417789, "uuid": "12a690e1-5ed6-41d0-9e22-71bcc250ad29", "comment": "Malware payload (Mirai)", "value": "c728b58bc1bfade33114c026536d6f0200ae3992", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417789, "uuid": "7ecd33c0-1fb5-4efe-a922-2d3f1fcd12bf", "comment": "Malware payload (Mirai)", "value": "73da3bbd6756e0c23504cde0e15038f25b8a14e8120c30af06a197641321fb317375c89ca257d24747b6d747ecf3231d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417789, "uuid": "8f70f62e-2924-4287-882b-582c98f103fb", "value": "T17503F15363AF5676D6E138FE744CC282306E2DF4D97B7093274D238AA6C714E29218A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417789, "uuid": "c9eb24dd-8358-49f9-a440-1bf5f7f40a76", "value": "768:gnkpZxySrp7GNpubhJIRQPHevK9veggLybN6zmS6tMq3UISL:gnk/gSrpgpshysH++mgg2amS6tD0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647417789, "uuid": "68bd9f59-8f20-4580-a011-07e707c9a2c8", "value": 39636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647417789, "uuid": "c89e1d60-e97b-4513-9909-21a62752eace", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417789, "uuid": "20bd91a6-49ff-4382-b976-38f7ffcde126", "value": "b7de46b613e939e9c9a04ec9adfa382a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4eab2dcd-a51b-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647429724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647429724, "uuid": "5f92eb7a-5421-4b37-8865-49c9813b2f48", "comment": "Malware payload", "value": "728f13a93b62699e8f94f2d14a989bac", "object_relation": "md5", "Tag": [ { "name": "CaddyWiper", "colour": "#AC43C6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Wiper", "colour": "#614E92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647429724, "uuid": "b8dee0c0-5efd-4498-ac00-5d7e881d39f9", "comment": "Malware payload", "value": "b66b179eac03afafdc69f62c207819eceecfbf994c9efa464fda0d2ba44fe2d7", "object_relation": "sha256", "Tag": [ { "name": "CaddyWiper", "colour": "#AC43C6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Wiper", "colour": "#614E92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647429724, "uuid": "951ce468-e13b-496d-9784-c82859fbf6bf", "comment": "Malware payload", "value": "776e573676406e2311de0b40b9f2e98fd5b1fc4d", "object_relation": "sha1", "Tag": [ { "name": "CaddyWiper", "colour": "#AC43C6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Wiper", "colour": "#614E92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647429724, "uuid": "372ea0f1-733c-4119-95c4-c23b531882a9", "comment": "Malware payload", "value": "8b54675d5fb87bf423f4aa5cd628bd2de9359cdb487f437d4e22107c0c13130ad4cfeaa0ca0a4ebc924595d91a884818", "object_relation": "sha3-384", "Tag": [ { "name": "CaddyWiper", "colour": "#AC43C6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Wiper", "colour": "#614E92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647429724, "uuid": "53371598-66fd-4ac0-ac14-a2ab71941358", "value": "T113C17E4B7E1C8833D50217755B66D72611177722A3EC8D48FFAD5143B8B1BD4BB85460", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647429724, "uuid": "fb72b9f9-18f1-40a3-b5d5-5695780adad1", "value": "bae2d138abe43164fb5e95f313de3d14", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647429724, "uuid": "cd0884ca-794f-4d6a-85a6-97d155d79ab4", "value": "96:z/1bf6swJKhN1xaYTbkD2masZwo23HkRl27ffat:z/RIJK+27tHnat", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647429724, "uuid": "85ab795c-a79b-4d9c-9068-6832d329688b", "value": 6144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647429724, "uuid": "9d04a4d9-8323-4bf8-b4a2-e57645798425", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647429724, "uuid": "5091274b-595a-4c4c-8da0-55b131fdf5e6", "value": "b66b179eac03afafdc69f62c207819eceecfbf994c9efa464fda0d2ba44fe2d7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b78c61a2-a51e-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647431188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647431188, "uuid": "119f6692-8a52-46df-bc2d-3fd97ae4c901", "comment": "Malware payload (Heodo)", "value": "32389fa979f1f4da5a5c08b402c705e7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647431188, "uuid": "8ceaec48-6920-4b1c-b961-e39195dd360b", "comment": "Malware payload (Heodo)", "value": "b6c0d3a893d9086cd81b95d5e71ee7d98dd4d2e3bd08b0e86266f1999265a3b9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647431188, "uuid": "21b7291d-8a0a-4ee1-a4c3-947934f3d297", "comment": "Malware payload (Heodo)", "value": "b97788e6060674cb4bf219d31c82947759a20111", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647431188, "uuid": "e2b60f82-5510-4357-9343-decc9862e68a", "comment": "Malware payload (Heodo)", "value": "331102c49215137a61abcd1194ef94d88335bdfeff805c2fe01081543028d34a5b351ec704fe34f7cbae3f5c5553ff46", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647431188, "uuid": "6b00fa2f-aa67-439f-ab83-f1c614baaccc", "value": "T1B8E47C12F461B2B9D04B04741F1723A86EEF5E518629CA13AFA8ED5E1F31251FC3FA16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647431188, "uuid": "5edc5051-d653-41a6-b9a2-99d48f9c02bb", "value": "066d4e2c6288c042d958ddc93cfa07f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647431188, "uuid": "7c56bae7-48de-48e4-b933-a81c24196032", "value": "12288:DtAanana8Meee0GBGu3qI+3DNJ3vE6v5eJxS332d7t5hT/hexLx:Kanana8qGBGuoNxEDxCM7o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647431188, "uuid": "54f6a239-54b0-4d8b-a5f2-0c4efbf02903", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647431188, "uuid": "458a556f-bf50-4fc4-b656-424343d2b9bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647431188, "uuid": "f577f897-e7ec-4c75-8299-1b825cfe3b2f", "value": "32389fa979f1f4da5a5c08b402c705e7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4fdb12a-a541-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647446243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647446243, "uuid": "dda2b321-2d6f-4990-81f3-28707f7bd3e3", "comment": "Malware payload (Heodo)", "value": "85aaf7a720491c244c70c92bbcd5b10a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647446243, "uuid": "550492c0-e4da-4dce-afcb-b1b33bab6afb", "comment": "Malware payload (Heodo)", "value": "b72eec88c3e5202d857f4199efbae3b1f6424d000370a2139ec8f7721d82f997", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647446243, "uuid": "88b5180b-9b55-4ceb-a1d5-d7eb00effef9", "comment": "Malware payload (Heodo)", "value": "fbda60c0eeee9126425c623fc2d713eea40a5138", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647446243, "uuid": "9569a9c2-e0a1-46b1-b26d-a0ecdac165d5", "comment": "Malware payload (Heodo)", "value": "5043554ba4e60e49049af8581f700b61c3515f00a4396f4bbb02642aadaea99ebde6e635d713b8c287b2926cd40d983b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647446243, "uuid": "eda90cd5-f3e7-4aab-9b50-ed6bfa83773c", "value": "T194E47C12F461B2B9D04B04741F1723A86EEF5E518629CA13AFA8ED5E1F31251FC3FA16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647446243, "uuid": "87990f6f-1e78-4967-8609-31409c00e6d0", "value": "066d4e2c6288c042d958ddc93cfa07f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647446243, "uuid": "0aacf565-9fad-4147-99ff-af41d8154871", "value": "12288:DtAanana8Meee0GBGu3qI+3DNJ3vE6v5ekxS332d7t5hT/hexLx:Kanana8qGBGuoNxEyxCM7o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647446243, "uuid": "abe528b2-f36a-4a0a-a002-a023662193c6", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647446243, "uuid": "d443a9c6-6cac-4e7d-932f-1129efb7d1e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647446243, "uuid": "4995b6cd-e8d3-4dff-96bd-b0d0b4293c7b", "value": "85aaf7a720491c244c70c92bbcd5b10a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d695a204-a55f-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647459158, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647459158, "uuid": "f4b341af-2904-4a1e-8ddf-df3de1f66915", "comment": "Malware payload (Heodo)", "value": "2057673db9e58ee8af37b54050c9f2b3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647459158, "uuid": "92a8967f-5c52-4211-809d-eefab88990c5", "comment": "Malware payload (Heodo)", "value": "b7854273d2878371af5427bb5d12082259d3d4e922b2b3124c20ebe4e8bf7ded", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647459158, "uuid": "e19da8a6-7b2b-46ea-830f-361124fefbd9", "comment": "Malware payload (Heodo)", "value": "7f1c53f5db2191408fc472fbe8c9003ec31a6bd0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647459158, "uuid": "c9fa5512-b831-44a6-8b6c-d84b033dcf09", "comment": "Malware payload (Heodo)", "value": "6954b66b13bd2aae39b36011084910ec34d5621840d69eb8442bdb81d34f7f22286b9693017866d39a5411e5c9e3294d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647459158, "uuid": "d7239d39-4146-47b1-99a0-81e27bdba202", "value": "T195F4DF1176E1C076C1BF12304956A38D23FAFD509FB986976FD02A6E3EB41828E34767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647459158, "uuid": "eabf44e9-4fff-4dbe-a5f4-15667e1d1609", "value": "66a21a1bcb4077b3ed89c00ee693486b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647459158, "uuid": "a243fa99-3f6b-4b5e-aaad-85d80c3b6ed9", "value": "12288:g6O4TpP0XjxCCFJuf07j+Xk7hB8rLneTfABCJoWRWwfpW:BeCCF88j+XY8OTYA7pW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647459158, "uuid": "2f50ee74-e466-4030-94e4-69034689b3c6", "value": 749568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647459158, "uuid": "048eb1b5-6354-4e11-bb44-72c29c4bd1c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647459158, "uuid": "9703573e-3dfa-4b45-ba1a-1524dd8b6435", "value": "2057673db9e58ee8af37b54050c9f2b3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf7a90bf-a4eb-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647409324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647409324, "uuid": "4e54e572-2d09-4995-ac65-d029b39aa8ca", "comment": "Malware payload (Heodo)", "value": "6ed28c0ab9f9ad6e6feaf98863fba06c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647409324, "uuid": "be9458f3-45da-488b-bc4f-1a9a0b980234", "comment": "Malware payload (Heodo)", "value": "b7a31d9154bde0bb2c430ccf94bd848cef3a68940769909a14af0e99987ab455", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647409324, "uuid": "a5f6270d-9e42-4773-92e8-c301c657039e", "comment": "Malware payload (Heodo)", "value": "a47e42085d216f9b53d2d40cef889182e07b4e74", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647409324, "uuid": "6de67db6-dfb5-4a3e-b499-91086c7c63f7", "comment": "Malware payload (Heodo)", "value": "eedca658bdabf7aa69bd960decda528c58a3f08c408f83734c600cd19b9867a393d37250917632e6e3bc2c9a2f1a7a09", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647409324, "uuid": "a1e40fb4-7bd3-471b-a0ee-71febfeeec2f", "value": "T1E6A4F64124A2AD71C3D7C9B2ABD90C2639E6E2D2CFF79007BAE45B3CD964982C337515", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647409324, "uuid": "c73a4175-6201-4345-83ca-beaf33a82593", "value": "a38617efee413c2d5919637769ddb6a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647409324, "uuid": "4cc95c75-ca42-462f-8289-9825b8fdbed9", "value": "6144:cfF1NzGtVoGsil4OahPx1Sd4BHTVDjK1wj1z+fc+jD9:KFxGsTPy4BHT4Sj1zfW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647409324, "uuid": "f81e8290-ee7b-4ab8-b4e0-7207a9ef74df", "value": 449783, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647409324, "uuid": "9f1bf41b-05b7-468c-b684-a9606c64ee2a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647409324, "uuid": "b36606ce-af15-4985-82f2-1801403f96df", "value": "emotet_exe_e4_b7a31d9154bde0bb2c430ccf94bd848cef3a68940769909a14af0e99987ab455_2022-03-16__054200.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb4070e1-a52f-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647438523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647438523, "uuid": "48ceed0d-33f7-4c49-915e-1d4fdbe43458", "comment": "Malware payload (Formbook)", "value": "6a083c0d808588ec0c4d09350d35a644", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647438523, "uuid": "60bdb7d0-4e7f-4139-ad87-f8b90633f238", "comment": "Malware payload (Formbook)", "value": "b7a756c577e078ad9d76c1e7aadb4d0370b1b5ee868f07fad21f33194febe1ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647438523, "uuid": "c170fc4f-6176-4687-a373-f2936f3d15bb", "comment": "Malware payload (Formbook)", "value": "67cfb82137003b557d5f6b54e94a01957ad60521", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647438523, "uuid": "0977994d-6bcb-4242-8641-2df9516faa06", "comment": "Malware payload (Formbook)", "value": "2c3ef19ed7dcb6af1bf0631c71adfed88f71dfc60d349d4d1d7ccc3a29a049d9fc6a6ded76729a818e8b7668d71cb40e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647438523, "uuid": "539ff962-3127-47ea-8264-aa9753befdf8", "value": "T168B4AE49312035DEC96ACF31C9709C68EFE56D76931FE22754C335AE9A7CA8B8F04462", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647438523, "uuid": "9497f09a-590c-4e10-ab26-8d70add2cfe7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647438523, "uuid": "106b80e3-17ad-46d7-ac2c-b385d3b72989", "value": "12288:5CpoHPGLkEdTNDN3RpPupIkkMnyvRUcZ64kQlRpKO+7G:Wc0kYD5U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647438523, "uuid": "99bf1934-eabe-40d8-b92d-0d8243411920", "value": 512512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647438523, "uuid": "f5901aab-bc9d-4027-a1c2-ac821e32cd78", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647438523, "uuid": "006b693e-5134-4772-819b-23a2c25dc167", "value": "PAYMENT COPY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70791eb0-a50f-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647424627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647424627, "uuid": "90aaf279-835b-4a2c-9c4b-628ecf7f6fe9", "comment": "Malware payload (Heodo)", "value": "7a88a154a2018941f1935f5c27e5c829", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647424627, "uuid": "a4d8e9b1-4159-45c6-9b7f-a156def2b83a", "comment": "Malware payload (Heodo)", "value": "b7b66fd02cc337b5f29f62eec85df81e64f1deae3ae01a4bb4e9c347a53bf914", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647424627, "uuid": "5122ae9b-6e74-4966-ac80-33b90d50694e", "comment": "Malware payload (Heodo)", "value": "773ae322e271ff178b547b4f0edf37cc39bdd77e", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647424627, "uuid": "2965cfaa-78f1-4e07-9021-c80f241b63ef", "comment": "Malware payload (Heodo)", "value": "1ab432a966662ba909bb2997dfc36e8f2257f803ea6e1e9e34bd38500ab10f8bab59db081fa88fc0c4f62913c13ddd73", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647424627, "uuid": "5320e5eb-9711-4a0c-a289-7c632828717a", "value": "T1D4E2C02DF2A0EE1DC21EE939446895DA421DB4558502EB4FB95CFB1D2F0A5C23B1F0DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647424627, "uuid": "651d78a3-5267-4850-8e3b-f707a2ae4dd8", "value": "384:sjzZPFhNjqEBOA7iEibbwBLg0SCdiVXUKgUrNU/qWhZOdBNPJM+kqr9eCgh0k5lY:sjpFhNNlizXT28dFfPdkqstJmE6/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647424627, "uuid": "8d7fb9e5-15fa-4478-a844-a1eb55b2a6e3", "value": 33750, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647424627, "uuid": "88295627-6c7d-4ecf-b531-9a52e6e0d04b", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647424627, "uuid": "c5b716e2-dd64-4447-a3d2-5d7d415712e8", "value": "Rech 2022.16.03_0909.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02672d07-a556-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647454936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647454936, "uuid": "9c6b54dc-1a63-4c0a-9bc2-910f08f22dd8", "comment": "Malware payload (Heodo)", "value": "66e14f728180e46b55d71fac28a29dee", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647454936, "uuid": "c761d40d-2dc9-4eb7-aaee-46b354e29b47", "comment": "Malware payload (Heodo)", "value": "b9c3ff3f56a671000603ce61d7213e005222c3ff7fd6f6685e300c88a8e40146", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647454936, "uuid": "58a6486e-bfb5-413e-a2a6-dd877ef63203", "comment": "Malware payload (Heodo)", "value": "429284e48779da9d427138dc2244cc0385174416", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647454936, "uuid": "a8465fab-d341-4c08-889f-d1ef638bf6aa", "comment": "Malware payload (Heodo)", "value": "83709948d2957db5448e10234e3d0661a034e4632a490d8cb3708075b57cddda8f8c5b26795482465349a4d58c920a78", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647454936, "uuid": "6f035441-84e6-43d7-ae0c-64ed462cc76c", "value": "T1C2F4DF1176E1C076C1BF12304956A38D23FAFD509FB986976FD02A6E3EB41828E34767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647454936, "uuid": "a16c3754-364e-4bee-81d3-7bb451bfd1a4", "value": "66a21a1bcb4077b3ed89c00ee693486b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647454936, "uuid": "9c55fffe-4a28-4664-8da9-ea6df7c49e90", "value": "12288:g6O4TpP0XjxCCFJuf07j+Xk7h28rLneTfABCJoWRWwfpW:BeCCF88j+XH8OTYA7pW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647454936, "uuid": "2ee10315-1277-47d1-bb2a-f7443c6a752b", "value": 749568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647454936, "uuid": "ba4c1100-28e3-4347-a329-660891841dda", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647454936, "uuid": "26d9313b-816f-4e45-8c0c-5458d6d95191", "value": "emotet_exe_e5_b9c3ff3f56a671000603ce61d7213e005222c3ff7fd6f6685e300c88a8e40146_2022-03-16__182211.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6927b0cd-a50d-11ec-9275-42010a9c0029", "comment": "Malware payload (RemcosRAT)", "timestamp": 1647423755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647423755, "uuid": "59278aa0-8e7d-4149-9069-d5a8971a4097", "comment": "Malware payload (RemcosRAT)", "value": "b663baf338fb2409f89e7682d967809d", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647423755, "uuid": "07d53c62-5537-4179-883f-098416ddfa51", "comment": "Malware payload (RemcosRAT)", "value": "b9dd78eccf758403ae8c28bcb0e375b43437d534d39b376729e00bb5c4a8a858", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647423755, "uuid": "e3d60b45-05a7-4dd3-947d-19e08b2160de", "comment": "Malware payload (RemcosRAT)", "value": "2a976b3928eaa957e8fc7f04138f08d46ce947d1", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647423755, "uuid": "5ce08a51-ff4e-4e0f-a357-ef417b9956a6", "comment": "Malware payload (RemcosRAT)", "value": "7dafc4930ac26d7e22752a40ef8d7f469c741a7be01efa849f09f00a81d01f235e0aa4f1a1f67fe4d00839695b39bc16", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647423755, "uuid": "58cc6785-b0ad-4005-aad7-a324bdbf08ac", "value": "T1D124E09132B86B22EA7E97F61D20145047B5B97B6571F30C8CC770EA16B3F028B92B53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647423755, "uuid": "4f37839f-9bc1-4166-868c-950e7f4e0991", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647423755, "uuid": "9330d755-eb40-4622-8f2e-4a7203552c27", "value": "6144:KnSltyYc+YBd1g6FJ1b866i7wnbakztX:A+Ytn1b86fwbakRX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647423755, "uuid": "f8efafec-2209-48f1-96e2-6a662ce27a2f", "value": 219136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647423755, "uuid": "9f32423d-a1e7-428d-a3ad-2d35a314181f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647423755, "uuid": "df2cb8ab-3aca-4acf-a7e6-a26bef090e5b", "value": "DOCUMENT.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80387906-a547-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647448705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647448705, "uuid": "590bce6c-3d5e-400c-b228-cb37aaeb2545", "comment": "Malware payload (Heodo)", "value": "a47e5e5505b839ea66078a3d88e99735", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647448705, "uuid": "4ed85cce-df5f-4a54-8613-6adb99c6510a", "comment": "Malware payload (Heodo)", "value": "ba44a7617d855387fff2c18e7215eb89df91d82f62051b327cfa1b181007d27e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647448705, "uuid": "736d85aa-6c6a-439a-9ba9-9b9f66f2e805", "comment": "Malware payload (Heodo)", "value": "5613ad679c224e5f6d28d89a031d591ab9988f68", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647448705, "uuid": "7f59c903-fd36-457c-89c4-4e88a302cbb7", "comment": "Malware payload (Heodo)", "value": "192ced65d1f434313a29e8b3285feeecb030ecd22be92a733f48e34b0f4b1864f93ef118db25e3eacf0be4684fc9e6fc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647448705, "uuid": "c2dc14fd-7032-40e5-9100-3831e9aea767", "value": "T1B2E47C12F461B2B9D04B04741F1723A86EEF5E518629CA13AFA8ED5E1F31251FC3FA16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647448705, "uuid": "3db777cd-d342-449d-afca-916a4f9db290", "value": "066d4e2c6288c042d958ddc93cfa07f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647448705, "uuid": "40fefc2a-cdb3-4fd2-9fa9-7bc24eb09518", "value": "12288:DtAanana8Meee0GBGu3qI+3DNJ3vE6v5eAxS332d7t5hT/hexLx:Kanana8qGBGuoNxEqxCM7o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647448705, "uuid": "84d96f7e-e930-4941-a941-98dc2722e592", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647448705, "uuid": "7ee228a5-5ee0-465a-ac9d-7c6abdd2e417", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647448705, "uuid": "702c8960-a386-4ecb-8206-70e7363c7515", "value": "a47e5e5505b839ea66078a3d88e99735", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2aa8c4dd-a522-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647432670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647432670, "uuid": "146b74c9-58cf-4c28-b38c-1bf147772391", "comment": "Malware payload", "value": "d393bf358d095eab3a747a8813a3ded8", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647432670, "uuid": "8a62bc43-5e3b-48ca-ad44-d81dfc890acb", "comment": "Malware payload", "value": "ba529e60591ab2116aa135b30e4533d0008c9e55e521ba64424c3220241bc5ad", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647432670, "uuid": "051b07e3-5ea4-4573-b5ff-ca2f35574bfd", "comment": "Malware payload", "value": "69b15d3f5f5f2138332527adf9dbd79c8e472055", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647432670, "uuid": "aa2ac2a6-1398-47c6-8b9a-00bd64b65b1b", "comment": "Malware payload", "value": "2719b4141fe70df6bd5bb50b6f8055f8df9d87743a69709638948abd8d2877aed1450d7bdb1da17eb1a044034e7a27f1", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647432670, "uuid": "7a2ce13e-44bf-4842-a71a-7173c658da69", "value": "T1A695220250A71FE0C96941BA84CB9B52335CEF8B910BD35B53B4E26F3EB37B0E929551", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647432670, "uuid": "878b52b4-0ba2-457f-85cb-73c3af904b4a", "value": "49152:NEeLAEWBrxiQJXCmRaVo+VXTUy4yQU0YRKpMuUNUr5LQ:WeL8vMyMo+VXTUtyQUFyyelLQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647432670, "uuid": "9379fb88-c692-4bef-b787-b95836915147", "value": 1942383, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647432670, "uuid": "1ecfb196-d69e-4b16-9e9b-e4d293d49384", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647432670, "uuid": "cfdc2767-64bc-4eb1-a5ad-219ed75af9f8", "value": "e-transfer.pdf.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac0d2f42-a51c-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647430310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647430310, "uuid": "fe463823-a6b2-4941-99e2-91ca308b4159", "comment": "Malware payload", "value": "f9110a6819fa8c0c6a386ad306f5688a", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647430310, "uuid": "a5d54c54-37ff-4985-ba49-07251218ff20", "comment": "Malware payload", "value": "ba8e47341f8b26c95eae11e807d29299690954f7effee72ca3d8d0ee47c87fd8", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647430310, "uuid": "adcd9586-c56c-4ff4-ae07-038f97d22ed0", "comment": "Malware payload", "value": "6121001ccd50887180b7cc85690ce151c44d38b7", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647430310, "uuid": "60f34457-9ba9-41d2-8377-6d08c7302767", "comment": "Malware payload", "value": "d7ef6ce5d0e951d99a1e9d37a1c85b41b24bf25297f90ba63a76d7e5aa70b13e8d2a2ab6a376270ac5a62426f5b02788", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647430310, "uuid": "3f18f405-cbec-4dd9-b70c-441048fb5f8f", "value": "T1A1323B7CE47706E8CF89B2A8A529BE4D2AECFA4DC3C59506327C77712742E5DA127430", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647430310, "uuid": "ec80215c-cbf7-46c0-8b29-e74e88e0a151", "value": "192:CLYT40z7xDiq+jBbe849ouMj1VCaC+RJj2llrewtaExsQabUnPWEJ75W2oRMeu:n40nNrAFfqY1VCDl6wOb6J7Su", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647430310, "uuid": "c3582a06-0557-40d0-aec5-17e0f0336e84", "value": 11890, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647430310, "uuid": "5bf207e1-687d-43ca-b37d-363f68fe908c", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647430310, "uuid": "7c49f5ff-5f35-4c49-a6a0-626a8dbfc675", "value": "RTG58634.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45cc6c9c-a525-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647434004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647434004, "uuid": "91417383-9f98-48a8-9353-934c73e2547c", "comment": "Malware payload (Heodo)", "value": "0742e4f281e389af82b4a0657ada05c4", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647434004, "uuid": "957cb3ae-0f16-4b8d-83ef-f65df4c8a0c0", "comment": "Malware payload (Heodo)", "value": "baf8ccff5bf504d12fbd3b5f37ca2b8f4ab241ddf606a5f37726165ec987ea1a", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647434004, "uuid": "75031467-ac0e-4449-9abc-4c7cadddcc14", "comment": "Malware payload (Heodo)", "value": "2df0785b704349a05c274b95b17b0ae18547b1db", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647434004, "uuid": "ea5c5d96-e808-47eb-b093-264dd3a60f71", "comment": "Malware payload (Heodo)", "value": "ed2b86291f57ef835a34c9a1972336957b43a3ad6e5fd523cc80a95b679c7fda1cf7290ef6638c36964b58b7b9edc225", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647434004, "uuid": "291a080f-dd89-4701-b783-be45528a5264", "value": "T10EE2C02DF2A0EE1DC21EE939446895DA421DB4558502EB4FB95CFB1D2F0A5C23B1F0DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647434004, "uuid": "1b0f7c93-437e-4e60-a837-ad347ef99962", "value": "384:gjzZPFhNjqEBOA7iEibbwBLg0SCdiVXUKgUrNU/qWhZOdBNPJM+kqr9eCgh0k5lY:gjpFhNNlizXT28dFfPdkqstJmE6/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647434004, "uuid": "f9dd32a5-b139-4ff3-b9d0-a506452cc60f", "value": 33750, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647434004, "uuid": "d1375c5d-4ef1-4da1-aaa8-f6bb69845aff", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647434004, "uuid": "b1e9318f-8d35-4e82-b47e-8bd0f8cf2926", "value": "RechnungScan 2022.16.03_1316.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddd3c827-a583-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1647474632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647474632, "uuid": "018f5478-4b0b-4b7b-9e59-5e1688717d8c", "comment": "Malware payload (Loki)", "value": "8d5df7eb5d25e776e151da7c57a2889d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647474632, "uuid": "0f88b4c6-f3e1-4dc8-b026-26369f2bb873", "comment": "Malware payload (Loki)", "value": "bb2962391590af019ec5ae22eae3786a962c538c11188e060029df7362681e27", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647474632, "uuid": "db1c2bb2-d2ae-4c36-bd0e-ef6bbd2f9dd2", "comment": "Malware payload (Loki)", "value": "bb59e6f6e5ec7bd98057ea515a58ae7fd1ff9539", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647474632, "uuid": "5a3d4de5-4e56-4274-8a0e-1ddf497ae0cf", "comment": "Malware payload (Loki)", "value": "fbb10dc812ea712c8423f90ba3560698397223358fffe982c5cdbb506e691b1db9795fca3f174c6a95c5216ffcb12ccd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647474632, "uuid": "a5d3055c-0452-4bf4-ba91-1bc568df10ef", "value": "T18D54121BE5E9A3F7D3805473A2A663A5F7FB84C400254357CFE06EA93C757920E2860B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647474632, "uuid": "52af286f-081f-499d-a28b-ac3ec18c5d0d", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647474632, "uuid": "c4ea249e-a281-49e2-a7f3-2c9891659066", "value": "6144:rGiKRiQme4dxlDYJhRO6704ibnxPu4eWrZ+wr:ympDYJmbxuX2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647474632, "uuid": "5c3b488d-c07e-4c4a-a5db-119aeddd49d1", "value": 305727, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647474632, "uuid": "0ad19cba-2ac9-4156-a47e-dec04e9d3c16", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647474632, "uuid": "4c9d7a85-c650-4dc0-815c-14fa3fe3a027", "value": "8d5df7eb5d25e776e151da7c57a2889d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e266f57c-a51c-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647430401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647430401, "uuid": "b15b98f7-bb47-446e-a2d3-c42c71d78cc6", "comment": "Malware payload (Heodo)", "value": "2c6f52449d81da501da5dae6aa464a10", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647430401, "uuid": "2eb570cf-fd60-425c-b03e-e525518238cf", "comment": "Malware payload (Heodo)", "value": "bb3fda5be5e966128344b88145d4097a07dfe5e4b4ce62e86cd9c3e7a4eadc78", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647430401, "uuid": "3f84faa7-1221-4aa4-9b7c-58dbe49e3ab2", "comment": "Malware payload (Heodo)", "value": "0843b1033bb7cf8230c05fc302cdb7cc10060a6d", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647430401, "uuid": "07a77599-023d-4353-86b0-fa69372bfa39", "comment": "Malware payload (Heodo)", "value": "c206ee3f9ecf46639b72235ba4e6ef83fbed38a6eb660738201adf72520b77637e4787ff3d6cd349231a8a40d4512b20", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647430401, "uuid": "8989ec2e-2643-4ddf-bc69-660b85f773af", "value": "T1B6E2C02DF2A0EE1DC21EE939446895DA421DB4558502EB4FB95CFB1D2F0A5C23B1F0DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647430401, "uuid": "6f32f9ca-86f4-4db0-8d68-40f699d96d8b", "value": "384:cjzZPFhNjqEBOA7iEibbwBLg0SCdiVXUKgUrNU/qWhZOdBNPJM+kqr9eCgh0k5lY:cjpFhNNlizXT28dFfPdkqstJmE6/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647430401, "uuid": "fca8d92f-1983-417f-9c45-cf19b2600c03", "value": 33750, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647430401, "uuid": "dc95777a-5ce7-4de5-ac2f-cd1f29aabb2b", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647430401, "uuid": "e9b78e52-3127-4fb6-b828-791b6496696e", "value": "IhreRechnung 2022.16.03_1133.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43da4906-a525-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647434001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647434001, "uuid": "0d12e138-99eb-4bb7-86c1-7482101e6281", "comment": "Malware payload (Formbook)", "value": "7005345acf7b48ded8d81c0209a13822", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647434001, "uuid": "a02499f3-4238-404d-84ac-45c0aacb8a37", "comment": "Malware payload (Formbook)", "value": "bc408b9f362db28b2e931ff336ec5661cc0ce27b0cdc0ce215fec1b7381aca7f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647434001, "uuid": "2ee78f82-5ff3-4e21-b7f5-f3f8e6fdfcab", "comment": "Malware payload (Formbook)", "value": "b52264a498f726da49b74b9a8003042cca82a201", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647434001, "uuid": "26cc0b41-f21b-484a-a6b6-c70125d0c6fb", "comment": "Malware payload (Formbook)", "value": "8a93060c302e303b1692d1a2a0dfd4525f6e69768f3ae0b81b2102034ee2a5eb5d429b4571fc4d111b9af1b9718981cb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647434001, "uuid": "8ef81964-7e4d-42f8-878a-6efc8cc8d28c", "value": "T12D35C03927DB8072D1379DB89C609FD04EBFD6CFBB10AD001D9494AA7F9BE814B81925", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647434001, "uuid": "3dcf28b6-970e-479f-8aa2-700719539802", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647434001, "uuid": "e7ee62b3-3ff9-4172-9356-5616b3770ac5", "value": "24576:S6ZRw+PMckaWlfiA8ivsbZIzjW+iKpxkij:SXuulfBENWWA5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647434001, "uuid": "0a8ff1c0-3770-4784-8754-3ab1461bbf04", "value": 1116512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647434001, "uuid": "322e1df8-780b-4e67-9038-ac4f78ddf422", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647434001, "uuid": "a8d38b8c-f377-4db5-a335-b5ea8e7c9b5b", "value": "purchase_Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ff14838-a518-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647428411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647428411, "uuid": "e956c0c1-08c6-463d-8e4b-220f15424fbd", "comment": "Malware payload (Heodo)", "value": "2d12d279ae5974acc61853a9158d7271", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647428411, "uuid": "fd464662-6336-468f-a425-e1f081ce19d8", "comment": "Malware payload (Heodo)", "value": "bc838555e1aa93832ee7ffbd8d340d289d0878b03c34cf0b024ca105c8b31604", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647428411, "uuid": "abc32ff3-b065-483b-b51d-09f82ef0baec", "comment": "Malware payload (Heodo)", "value": "b3e90b95bf1be7deb1cf57df8844b1ba273cb08a", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647428411, "uuid": "d48213bc-abe2-4e8d-ac29-e85cadd1b14d", "comment": "Malware payload (Heodo)", "value": "ade3debbf1b23a109714cf1479a19357caaf0541de4f3b8e40a383f745b112f41e1de870b0a23fa5ddbcd99b26823278", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647428411, "uuid": "71325535-0f27-4f8b-a213-90cba2c2d28f", "value": "T189E2CF29B2A0DF5ED61EED3584688AE5425978258406EA0E784CF31C2F493E2771F29F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647428411, "uuid": "10b8747b-3728-433e-8d5c-822610c0e986", "value": "384:b842JZPFhNjtOA7icg0SCdiVH2KgUrNU/qWhZOdBNPJM+kqr9eCgh0k5M2E6v:MHFhNZliH2ydFfPdkqstJhE6v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647428411, "uuid": "2b9fc1e6-4d62-4272-9036-fc80d26de46b", "value": 31305, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647428411, "uuid": "59da6181-2a8f-4e25-b46b-decf9e23d236", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647428411, "uuid": "0c9836cd-36a4-46ed-87d2-caef22b1a106", "value": "MAIL_275526335.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e84ea331-a548-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647449309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647449309, "uuid": "b0ae3dd0-c8b8-4c11-91a8-cc0cdb4479f3", "comment": "Malware payload (Heodo)", "value": "0ce7ece1eb7f478377ac9d492d0a8ef3", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647449309, "uuid": "bf9d918c-29d9-4ae0-941f-88f7bc57b5f0", "comment": "Malware payload (Heodo)", "value": "bce6bf15b7802e149aa05c57be9f91ee74716e143dc75a067d8e3f17c6c875af", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647449309, "uuid": "49c811e1-67e7-4537-ae85-87508ac2dc3e", "comment": "Malware payload (Heodo)", "value": "628c06a5b0706b0fa31a5cf5dd2749e77ffd1fb3", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647449309, "uuid": "c774ddc0-ab08-4bfa-8c71-5275348e8fe2", "comment": "Malware payload (Heodo)", "value": "449aa1033f13686ca7b7aa26afe4f8d31353ab42dae06a51190c612844894c27d23dc787d9d0d71ad0ff97cacb86f17b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647449309, "uuid": "79933f21-eef2-4b9a-8102-d4ca24decd2a", "value": "T1EFF4CF11B2D1C076C1BF06741916A35D63F6FD608BB9878B6FD02FAE3EB45828A34356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647449309, "uuid": "f0d919b2-6e3d-4145-b3ed-904249f13a93", "value": "66a21a1bcb4077b3ed89c00ee693486b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647449309, "uuid": "8c6181c0-4d96-4ddf-b560-c426c8418c3a", "value": "12288:WZjb8BOPxue5dKV9M/98f0koPoXvkgKtuBdfMAofD:WCBAdKV9Xf0kb3KMBdkAofD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647449309, "uuid": "7cf41c77-7f81-4dae-af34-53ee55d84ad2", "value": 753664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647449309, "uuid": "1f60b5d5-1744-45f6-9e75-e3b9e53488eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647449309, "uuid": "1b53dcc9-59ff-48ff-b42f-cf39febd3be8", "value": "emotet_exe_e4_bce6bf15b7802e149aa05c57be9f91ee74716e143dc75a067d8e3f17c6c875af_2022-03-16__164823.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75047c67-a4e0-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647404448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647404448, "uuid": "009293b0-c675-4cbd-b970-180a8e18df78", "comment": "Malware payload (Heodo)", "value": "a8015f48388f5072b48a7d2601495196", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647404448, "uuid": "2c58b9d3-aea0-4654-9af8-1702f565fa2d", "comment": "Malware payload (Heodo)", "value": "bd2c9564fae2f6320bfcc3601f5a45c47fd6aa13841babdf14a4108ca41d911c", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647404448, "uuid": "61d8d163-3ac6-4bc2-9339-003605d961b5", "comment": "Malware payload (Heodo)", "value": "f77a988ca389f722cb2f137d75f4e55ee27b0a97", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647404448, "uuid": "24d4ef2e-cb9c-4361-b186-957a58d8dd23", "comment": "Malware payload (Heodo)", "value": "dc6138d7c8e715d4e5554a151c821af9ecfb862912a4a034a08acdf4b1a57745a3f1727891bad1a60e6870b416bd5433", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647404448, "uuid": "c90de3d6-9817-40b1-b60c-16f70bd3520f", "value": "T115E2CF29B2A0DF5ED61EED3584688AE5425978258406EA0E784CF31C2F493E2771F29F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647404448, "uuid": "05e7a628-2c04-4bc4-a321-fe2c0d7d5891", "value": "384:b842JZPFhNjtOA7icg0SCdiVH2KgUrNU/qWhZOdBNPJM+kqr9eCgh0k5M2E6v:MHFhNZliH2ydFfPdkqstJhE6v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647404448, "uuid": "3ad3eec4-753b-45c7-bd46-5954404b1eb1", "value": 31305, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647404448, "uuid": "27519487-93c4-4bdb-a388-dca20c7c1c9a", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647404448, "uuid": "2a37fea2-c6d7-4965-9202-b4945f8f63a6", "value": "attachments_75074834.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7d4c95d-a57a-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647470783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647470783, "uuid": "7191e6d6-7642-4ad0-97ed-8221955616ff", "comment": "Malware payload (RedLineStealer)", "value": "91a4c9febdf073c77f431a14782a4491", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647470783, "uuid": "8a89f6bc-de37-4f55-9885-19488e4abdf4", "comment": "Malware payload (RedLineStealer)", "value": "bdce363b49f59ea0cdd6841aa6384c295353c9e62fd9f2f7a7dabfc8aa1625fd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647470783, "uuid": "ef81561b-8297-49ce-832e-1b58b9e5609d", "comment": "Malware payload (RedLineStealer)", "value": "da34e4df6a08ca2342c074959389e05894cb2bab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647470783, "uuid": "e882a456-6b57-4e31-911b-548fb6f131e7", "comment": "Malware payload (RedLineStealer)", "value": "e730554c235cb44832b294257e94af246e5b26f71a2055581a60b6f0b2238ee2c401f9fe3b25b45fa631bf1c6a463c25", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647470783, "uuid": "9895449e-cb26-4a4a-844c-f80f45d18b94", "value": "T15E84F11279A0C036C156A4746C68C272BA7FF4725879C90BB7985B294F223D7FBB9307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647470783, "uuid": "16a4b7ba-f9b8-4678-93e3-1eeb1761cee4", "value": "66b9fd20d1e8b115e5f4733f6821c555", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647470783, "uuid": "479dc03b-0d02-4419-843d-4c488a518e30", "value": "6144:z0LVFTLMk4kqUXTl3A3woa+/PHnT3eCvuYzuZFHWp+9l2JX:zAFT4iHWCGPHT3et+uZF2Q9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647470783, "uuid": "1c65b21a-70b6-4642-977d-e480dc032a7e", "value": 377344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647470783, "uuid": "32b241b7-6b3a-473d-b92f-7e435e2362d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647470783, "uuid": "f750b579-08d5-4388-a5f7-504d675c36e8", "value": "bdce363b49f59ea0cdd6841aa6384c295353c9e62fd9f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13bb7a88-a4f5-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647413304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647413304, "uuid": "9bcc9ae2-4ff4-48b6-9c05-1eae571d13d0", "comment": "Malware payload (Heodo)", "value": "a6b757549fad6b98687462133ad2c9b4", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647413304, "uuid": "88249029-d283-4d51-81d3-bb660881108c", "comment": "Malware payload (Heodo)", "value": "be35f502d4108f8743db0669592556ad1165ba3ab4b99c701c29443173291548", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647413304, "uuid": "1b395e9a-a293-4bc0-b780-77e31027764b", "comment": "Malware payload (Heodo)", "value": "e6520ac0a3dbc8ab222b97887e27ce8633ea7b75", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647413304, "uuid": "0ce16dc8-9975-4742-a8db-ce2dc0610426", "comment": "Malware payload (Heodo)", "value": "7ece1fd1af2cbb54eab524daa6170af318f2a4e8340f223a631f9d32cab1c4aaece224a57beabdf35c2daec6a8d502a7", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647413304, "uuid": "4f80ca96-cd87-462e-8e88-8b1b9d4548a8", "value": "T107E45B06AF22A1F0C06B03B40555125AC2EF7ED0A72ED657825DFB7EDD339977A30226", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647413304, "uuid": "ca5032a0-dc5a-474b-ad31-3ca7c5d6c136", "value": "066d4e2c6288c042d958ddc93cfa07f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647413304, "uuid": "c13b0ab2-67aa-4fdb-96cb-7fa84eb56fb5", "value": "12288:jc899XKPmN4WMkoK6ZPJSFTdtXlcIL9v6O8:7GP7RgFTdFL9v6F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647413304, "uuid": "308c4167-eb5e-4e1f-84d3-262ad9625b3a", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647413304, "uuid": "c0f67170-185e-4e91-acad-7236b46405ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647413304, "uuid": "c5cafdab-c8b5-4b41-9f9a-07d48dd22683", "value": "emotet_exe_e4_be35f502d4108f8743db0669592556ad1165ba3ab4b99c701c29443173291548_2022-03-16__064819.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e3a0dd2-a534-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647440461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647440461, "uuid": "04272928-c041-4300-831f-7e85687d7671", "comment": "Malware payload (Mirai)", "value": "cbf067a5665a4437fd61d1673ff0ac25", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647440461, "uuid": "fbf86eff-2351-4a2c-9212-cded4d9eea9b", "comment": "Malware payload (Mirai)", "value": "be9831680b34bd4a30d58ead762e34bd7c208936d3dfa1bdc5b3fc56f9ef100b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647440461, "uuid": "3636b257-6d63-4dac-88c0-815b8b3c5227", "comment": "Malware payload (Mirai)", "value": "70b3570762a29d9815f11c862604d4963219d0fc", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647440461, "uuid": "662a880a-9e0c-445d-a4cc-966bdf18c53f", "comment": "Malware payload (Mirai)", "value": "7523f8f232dc9682900f7e6806e19b7dc65069b0c55d66d263b65cda5a35196cac5257d829f5b518abb7baf4ad91231f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647440461, "uuid": "b0fdfcea-2710-4f62-9d9a-a4cf200f1392", "value": "T13863091AFE419F00D09520BAFE0F1649B357C7A8E3FEB3529E24575056DB8178F2B829", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647440461, "uuid": "7d5ccbde-ac35-4952-990f-68dfc77285ad", "value": "1536:NHnCPadmK8b3IpbXD1X9lb2irPXs0YflUA0FqBVd:cPah8TIpbXdDP8dflUAzVd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647440461, "uuid": "af985004-75a1-442e-913d-096d2d0c313d", "value": 70068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647440461, "uuid": "6c798f9c-29a6-406c-9bb6-29368f199a7a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647440461, "uuid": "6925032e-62f7-445e-8942-a7833a68332b", "value": "arm7-20220316-1420", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bac7924-a51a-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647429263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647429263, "uuid": "72671d0b-b065-4bd3-bdc2-932ad7368521", "comment": "Malware payload (Heodo)", "value": "7a2fe3b56cf8c2c6517f4d533a26f100", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647429263, "uuid": "2cf03a00-56a7-4a81-8401-0e9b168ef3fd", "comment": "Malware payload (Heodo)", "value": "bec04da6f1eb81cd756f9fb970fe9e3d0a74c4972e814abd642ca3ec0426ac9b", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647429263, "uuid": "fd194cd2-e629-4015-bfe3-361e96d64bbc", "comment": "Malware payload (Heodo)", "value": "23ea477d2688ec8f6a555fbcc06a0d559aeddb00", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647429263, "uuid": "e43e5d1c-b7cd-41ad-8d40-312b37e5c41d", "comment": "Malware payload (Heodo)", "value": "fa735ea0fe46f3785f9c9e31d300b4b52f64b63012251481a74a8a6d825db89058973b8e7e139a1c4dd5c0609d0f06c1", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647429263, "uuid": "23974d6a-940e-431b-b6b4-d8bfff40eefe", "value": "T166E2C02DF3A0EB1DC219D939446981DA420A74258506EB8FB95CFB1D1F4A6C2770F09E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647429263, "uuid": "3ca50341-19dc-40e6-9bdd-f68f7c6ddc96", "value": "384:gjxzKpZPFhNjHEBOA7iEibbwBLg0SCdiVZKgUrNU/qWhZOdBNPJM+kqr9eCgh0kB:gj1uFhNClizXT2tdFfPdkqstJOE6K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647429263, "uuid": "824772ce-4111-4ed6-bc47-da8d065bf32e", "value": 33745, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647429263, "uuid": "8fc564d9-a7a7-439b-827e-7eca8476724a", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647429263, "uuid": "7888305d-813f-4e59-a0f3-5383b6ab3391", "value": "Scan_16032022.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7843acc-a4fc-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647416693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416693, "uuid": "2c08f7c9-b973-4cfe-910a-553f3a821083", "comment": "Malware payload", "value": "541425c51cf43e03b1537fa29573fd67", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416693, "uuid": "8915df66-61b1-48ab-b09d-d0e833d7de68", "comment": "Malware payload", "value": "bf07b9299ff450f30ecebc076e0b7d0c8a1477a8da114700098f9c5c479424b0", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416693, "uuid": "df50dbd6-1274-40f6-9a36-d15db3e2109d", "comment": "Malware payload", "value": "84aabc07d865284a8faea868b6274dc635294ad2", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416693, "uuid": "d8f43745-cffd-4a5f-8129-f510bbbb7cab", "comment": "Malware payload", "value": "a5471ad5d9e8a1c865d6cc7a7d829b918160b0ea88c6b48cddc8fd8de3659ccba0b73d365704b3f0488b2a7860308cc2", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416693, "uuid": "2f1d7680-7fed-4185-b1ee-da25bf17dd4c", "value": "T15714021DBE017F04F2195BB7A2AAD9D1C664FC7D2EE8820E76C7B104D6BD3642910D3A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416693, "uuid": "73492959-7170-4495-b8ba-08ed17c80107", "value": "3072:PTUCie2QOhMfTLUNdaomRrN+z+k7jVQbHxzm6DSnoPMXjXSNWt0aVoXRfMJB:b7ie21GLLoeRkXVCm6+nBhtHV8RfMj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647416693, "uuid": "692e10bd-8c47-4b21-9c0f-40aed5c4026d", "value": 190424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647416693, "uuid": "f14636c5-4d0e-46af-a7b4-7f60ce838362", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416693, "uuid": "a786668c-8568-4afa-8ef4-2ba8c2d781ef", "value": "PAYMENT COPY.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1dfaf1b-a50b-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1647423099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647423099, "uuid": "6653c6ef-1c7a-4d59-95e7-4699f6ca370d", "comment": "Malware payload (Loki)", "value": "8272502814c7354090117967c103a5f2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647423099, "uuid": "3c44f49d-3773-49ec-a86f-5f3713854dc6", "comment": "Malware payload (Loki)", "value": "bf56f0b99635eced6278b4ffa0122f368a20bc810bcd52571a7714770854f603", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647423099, "uuid": "0237e7d7-36b9-4429-a0e0-a953b8e1c68e", "comment": "Malware payload (Loki)", "value": "bb2a7d21fdc2ea632ad6ff63f2f8c2bd8a897166", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647423099, "uuid": "675eb50c-0ffc-4f72-81cc-65af5733a331", "comment": "Malware payload (Loki)", "value": "6bc0383d29f3cf5d590ce40dfa29901e15d4713349b8172f02d851ba6c9a579fa16aed5c97021d437044abf10a40deae", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647423099, "uuid": "1ebadc41-3147-4574-a3ee-ef0657972b87", "value": "T11D542351B2C059BBCD9F2B3084FAE3BAF7B249B943530346ABBC5D216D51497180A7F1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647423099, "uuid": "38d3f141-2bc0-414f-83e7-6c2f7b9b94aa", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647423099, "uuid": "ea631837-1a0c-4e71-8703-52ed12f64a77", "value": "6144:rGiHEWYWsxsZMpHGapknBpJxxZPnoXAl+vwTIziomQ:IWYDpmaynzrLow8uIziomQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647423099, "uuid": "24220324-9e3c-4327-86a1-0d770328fe31", "value": 303313, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647423099, "uuid": "745060be-ba29-4840-94ac-c1e2a36dd147", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647423099, "uuid": "59246a86-c883-449d-a841-1b4a91cb9e69", "value": "8272502814c7354090117967c103a5f2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ac61a18-a4bd-11ec-9275-42010a9c0029", "comment": "Malware payload (GuLoader)", "timestamp": 1647389452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647389452, "uuid": "a1590931-5300-401f-801f-880acf8a04c0", "comment": "Malware payload (GuLoader)", "value": "8a43dcd486c37cb965550bc44f6506c9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647389452, "uuid": "fbcf7b02-fb56-4f6e-972e-8a9914caebaf", "comment": "Malware payload (GuLoader)", "value": "bff5fef1cb4201414edc95579c63c657bd70872efe487e3ea36292f91f9b007c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647389452, "uuid": "36b4ecce-1f28-4f70-a931-fc919b74de1b", "comment": "Malware payload (GuLoader)", "value": "c730593fe545fb8bb252fc67100676c132c9e9f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647389452, "uuid": "7ceeee42-1e87-4041-a579-d2fbd9ef0562", "comment": "Malware payload (GuLoader)", "value": "89f109add7347bf30f25e5d03582576400ded0eaa605090553116f994b878ec0fbcc7e066a88d228ac55d32e1c7f0506", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647389452, "uuid": "e0a99e4f-400c-4e0e-a6fe-50bc41f70ed3", "value": "T1B01502841D48C18AD9111F398AB75A375237CD2EBD7EAA0ADDF27DAA2F335C5F908041", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647389452, "uuid": "d2e278cd-4fe5-4868-8f39-ad527f1c8759", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647389452, "uuid": "fc6991e6-c1b1-4b0b-aa95-51d54b9cb2ea", "value": "24576:mbrc8rrK84OteWb4fH4jnLxT2VHmTZRERXXD:crJrK8aE04bLxSVGrGXT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647389452, "uuid": "ed31a16c-afe2-49b9-b9f7-9c372a6f7f98", "value": 931352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647389452, "uuid": "d51e6da0-9505-4dc8-8017-0265dfc711c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647389452, "uuid": "aacdd667-9d92-40aa-9359-8c105d6791fd", "value": "Whitlock9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a35cc5c-a52b-11ec-9275-42010a9c0029", "comment": "Malware payload (AsyncRAT)", "timestamp": 1647436562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647436562, "uuid": "01a68b62-df75-4a54-8d12-e05c063e2470", "comment": "Malware payload (AsyncRAT)", "value": "6869b3394dc7f4ceaeac89905f6929ae", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647436562, "uuid": "7a78c8b3-6552-40fa-9e67-c82fd4f25f38", "comment": "Malware payload (AsyncRAT)", "value": "c0a6b562ce71149c052ed504556f0e4c8dbe2d075aef54299e548ed33f88a3c9", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647436562, "uuid": "9321cb1c-23f4-4529-a289-8082e60f83e3", "comment": "Malware payload (AsyncRAT)", "value": "a51965b20d56468ef035b0d1c5800a850ce1439f", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647436562, "uuid": "f5c52655-5221-4ae4-8778-32dddcc91b2d", "comment": "Malware payload (AsyncRAT)", "value": "f42fd7e6d807fd7acdb1123378dc78ef002293012c95f83045bd5c2959adfbad580640753d5f4c5c9bcc88bec90c2118", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647436562, "uuid": "6136f536-3431-4c11-b0d1-acba68649f15", "value": "T1CC1523FE52488E77C7EF0D3BD44AA29657F1DA7736D2EB422C8159FA8A87319041C183", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647436562, "uuid": "2adf34dd-1c52-4976-885f-ed7f469b5e3d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647436562, "uuid": "61982d3c-b499-4a97-b471-d9fbbbbcd4dc", "value": "12288:dHwOEo9wPXJ1CnOtbKu9Mp+ea2wf5ea8JVeyiHZlLKbu4RpPZFZe/d9TlSHapp7/:9wOkP5BbKuR2g8yFzqfvHZe/d9TlSKR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647436562, "uuid": "3be0f5a4-dfd6-4f2c-993f-a09e1bbb51a2", "value": 911872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647436562, "uuid": "ece79783-109d-4cac-bd02-0fd2bc743d96", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647436562, "uuid": "dc1656ea-f204-45dd-92ce-3a8f436e3945", "value": "PO NO -10948.jpg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5b57ab9-a580-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647473383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647473383, "uuid": "ee8930a2-9f57-4624-9469-f1050384ee4f", "comment": "Malware payload (RedLineStealer)", "value": "6c8f4e92134bbc275dab5b51066919f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647473383, "uuid": "557d0de5-4c33-4b23-8b9c-62f14599c4e5", "comment": "Malware payload (RedLineStealer)", "value": "c0ff986890d83e9dcd75a14899eb3097a01b91b66d76dbd12eb096a93edd2ba7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647473383, "uuid": "6f2cd39d-182a-4faf-b8f7-0689b3423dc4", "comment": "Malware payload (RedLineStealer)", "value": "730327bc6ece315ab93422c724b1a580821178f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647473383, "uuid": "446260bf-802e-4302-b1ba-3b7cc27d0862", "comment": "Malware payload (RedLineStealer)", "value": "d64f52e4707497b1e2eed6089bdfdb94848efa97d5da6931259d1b4293398327088f9635a660b0e0f801f08d72d8bc7d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647473383, "uuid": "d9bfa50a-679c-4d53-b1f2-9aac3e1f6d21", "value": "T1B084E02075D5C877E1A611758C56C7F58A3BF8762A359B8B2F94C63CBF213D2CA11382", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647473383, "uuid": "fe981f4b-be21-47b8-a036-a0051ab72c69", "value": "8bf5b143e05858e2b0962f577f578971", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647473383, "uuid": "f6de683b-3c51-4471-a82b-adbf5a378eb3", "value": "6144:xIOHERgaIAnyGWOkN673ZuA0pdvttWk7AQ8dAQ+1yPF:xIQEmAEBNaZ90pdtuj+TS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647473383, "uuid": "d9a7473a-1f7e-430b-9507-e375e189e638", "value": 384000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647473383, "uuid": "69194db5-1c25-4068-b837-216cb6eaf049", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647473383, "uuid": "408404c1-4ff2-46ac-afa8-d3bd89b5416b", "value": "11435030.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00b4476c-a556-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647454933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647454933, "uuid": "fd816280-42c7-4567-b273-aa1424b5e1c5", "comment": "Malware payload (Heodo)", "value": "3241ed6fecb38394610177193fd15c87", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647454933, "uuid": "01640fba-579d-4e68-8946-156f83585c40", "comment": "Malware payload (Heodo)", "value": "c1072b4c8fd328213e8a7943b46c8b24fbc045b91e9e3b4a72b5003989609132", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647454933, "uuid": "d9c58558-eb52-4766-bdbf-2e1456089ba8", "comment": "Malware payload (Heodo)", "value": "feb89846bd51783c92f19067bef5e6c2c02920ab", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647454933, "uuid": "b277932d-c96e-426d-a664-dad764fa4899", "comment": "Malware payload (Heodo)", "value": "7ef23d0639bed1c7e214a7a77f3b6581d2fcbd9c39639f2b13ba99e7cc8dca1c5c9043b9a51e459ea6fb64b7013d2d17", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647454933, "uuid": "b1cbf6b4-2f48-410e-9cc1-c85e045e5b2d", "value": "T10DF4DF1176E1C076C1BF12304956A38D23FAFD509FB986976FD02A6E3EB41828E34767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647454933, "uuid": "ca1862f1-91ed-475f-94c8-f547a45de372", "value": "66a21a1bcb4077b3ed89c00ee693486b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647454933, "uuid": "23470620-5271-40af-af74-4e56c6ba7a64", "value": "12288:g6O4TpP0XjxCCFJuf07j+Xk7h58rLneTfABCJoWRWwfpW:BeCCF88j+Xg8OTYA7pW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647454933, "uuid": "4bbfff31-8193-4f1f-a782-cea24e86e3a0", "value": 749568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647454933, "uuid": "df178b94-cf3e-4dd8-984a-b61e27eeefd0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647454933, "uuid": "9bbf0852-7481-49cc-90b3-88b9f624182e", "value": "emotet_exe_e5_c1072b4c8fd328213e8a7943b46c8b24fbc045b91e9e3b4a72b5003989609132_2022-03-16__182206.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "228e8870-a4c9-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647394431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647394431, "uuid": "7b1bc3a1-4fb6-47b6-a2bc-a63ec997d847", "comment": "Malware payload (Heodo)", "value": "556e1bbb5aa5ad6f22b418a4623084de", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647394431, "uuid": "2c474506-b48b-4f9f-a8ae-0cb4b3316ee1", "comment": "Malware payload (Heodo)", "value": "c123354c3d9d54ddfeefab88f26554087f5e59f53cca71f6a0c1f5795dc18389", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647394431, "uuid": "e186b2a5-e618-4e6f-bd7e-18c12af82ed8", "comment": "Malware payload (Heodo)", "value": "8934993bd0271a5c97c75d99cff6917ef54e3323", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647394431, "uuid": "7a766cb2-574c-4e4b-bd93-d96e388c6f34", "comment": "Malware payload (Heodo)", "value": "3d8e27554af7edeea4c37c31d7cf3b69105ee559f3a9bd7d8735975f879fabc228d1efb42dc7aab49e2d05033ef673d4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647394431, "uuid": "3a5d98c7-26e2-4b95-b5c0-a5e72e558b5d", "value": "T152E45B3071F74031C3AA1D3905D2DE64DAF5AD4B87B2F0D32F99AB4E99F5AC12B20616", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647394431, "uuid": "f6c968de-75de-4eff-bfaf-2af14c1080e2", "value": "a38617efee413c2d5919637769ddb6a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647394431, "uuid": "776bc63f-0dea-4167-b556-6be2a929aecc", "value": "12288:E94YBCR2xP7guDo463OP4eUsiSOZjb2woE+MhJT:2kRAguDogPIddb2woEBJT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647394431, "uuid": "3df8905c-228f-4363-bf5c-f89b68ddf5f1", "value": 684032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647394431, "uuid": "9de4d32c-d56e-4d82-9d18-56edb2fc34d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647394431, "uuid": "68d98ab0-c14e-4ef3-87c4-dfaf4547024b", "value": "556e1bbb5aa5ad6f22b418a4623084de", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88098530-a556-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647455160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647455160, "uuid": "52f1a2de-b16b-4d0b-83a2-77cb6698017b", "comment": "Malware payload (Heodo)", "value": "bc48f9f70bb62cc5c1af8a0caccd2c20", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647455160, "uuid": "912c72a9-8bf9-4dd6-85db-1ffbf583d553", "comment": "Malware payload (Heodo)", "value": "c25f87e9c802424c273f8a0ee1b3eaf5f8945a1030b50f5028db32d83f150df6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647455160, "uuid": "26b6ca6c-06d4-4793-a842-89ca6e00ed99", "comment": "Malware payload (Heodo)", "value": "8e0fe4214db1acb8dfc07a732d637e359c76b9d9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647455160, "uuid": "597661b6-80a9-49cd-a09a-568284e77ba2", "comment": "Malware payload (Heodo)", "value": "5c28f7df1c54eb8e53c2bf82b1b3b97459b42532398f13af088e7b04640a59e4b99c5b394cd7e0baed10d8e1fabbbda2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647455160, "uuid": "6f9eb4bc-0abb-46d2-886c-5b34915e4bff", "value": "T161F4DF1176E1C076C1BF12304956A38D23FAFD509FB986976FD02A6E3EB41828E34767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647455160, "uuid": "939b22e8-3f3c-4de7-829a-22cb74bbd2ad", "value": "66a21a1bcb4077b3ed89c00ee693486b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647455160, "uuid": "87eca3ec-b859-4c0f-af3b-5459fd64a705", "value": "12288:g6O4TpP0XjxCCFJuf07j+Xk7hw8rLneTfABCJoWRWwfpW:BeCCF88j+Xx8OTYA7pW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647455160, "uuid": "2dfd7b07-c12c-4858-8a0a-7524c96e8359", "value": 749568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647455160, "uuid": "7455fc41-9f06-4433-be22-379903c62ca3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647455160, "uuid": "98cbe71b-1ac8-48c5-b80e-14cc604fec86", "value": "bc48f9f70bb62cc5c1af8a0caccd2c20", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b355959-a507-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647421209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647421209, "uuid": "836d17b9-0667-4cf8-a9d6-0f737f01f4ce", "comment": "Malware payload (Heodo)", "value": "22ccd6aabac6fa532e9863b38fb3dd49", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647421209, "uuid": "cd85d479-6845-441b-830b-059fe1fcdb3d", "comment": "Malware payload (Heodo)", "value": "c287ad33c5b774fa96a89b2dce37b637476a51ecd6ebace4b34024421bc0b22f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647421209, "uuid": "0336cc40-e147-48cf-9749-995f2b19c8c8", "comment": "Malware payload (Heodo)", "value": "aa4ac8f7f064de71057cb3d1ee2a09255969bc11", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647421209, "uuid": "790d9513-1073-4ef7-8728-e58e49a05224", "comment": "Malware payload (Heodo)", "value": "a2e396ab6a3084b5b30a7bcb4986a6882abf9ab18db59583fcaf1f73eee0d739d873c1871659f138a39dbb655c97b413", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647421209, "uuid": "39247242-7563-4f41-9832-40aa3ec11b20", "value": "T156E47C12F461B2B9D04B04741F1723A86EEF5E518629CA13AFA8ED5E1F31251FC3FA16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647421209, "uuid": "ace5ab29-d2de-4e09-8d86-06572fb47768", "value": "066d4e2c6288c042d958ddc93cfa07f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647421209, "uuid": "b0788fb7-3adf-40f2-a2c2-a382bff7cb52", "value": "12288:DtAanana8Meee0GBGu3qI+3DNJ3vE6v5efxS332d7t5hT/hexLx:Kanana8qGBGuoNxE5xCM7o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647421209, "uuid": "48a85b93-98a8-4562-a9e0-8b50106333e1", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647421209, "uuid": "f9c87a4d-7dab-487e-ad26-a09e2a9f04b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647421209, "uuid": "5a9ef7d7-b27d-4df1-b6c3-159d0103918a", "value": "22ccd6aabac6fa532e9863b38fb3dd49", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26fe28c2-a507-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647421067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647421067, "uuid": "c2255c59-ba04-44f5-9268-211f9a478e56", "comment": "Malware payload (Heodo)", "value": "5e64d85f4a113840631502d8598dd7a1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647421067, "uuid": "dfd271d8-2bc2-497b-b94b-85b063fe8671", "comment": "Malware payload (Heodo)", "value": "c2cf1cb25221ff7dde79371853945aa4fc46e1ff96c8270d9b8cd435a2c8ab9e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647421067, "uuid": "856c2cdc-07f8-4672-85c2-02b5c1f99b15", "comment": "Malware payload (Heodo)", "value": "bce9ce505408a607f16a14891d19afcaa7d4d61a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647421067, "uuid": "2b666bcb-c593-49a9-a7e4-3b36cf907649", "comment": "Malware payload (Heodo)", "value": "1370fc7179478a754a18ac7b10b8d0fedd81f9ca3653c0c85e66e2b1b7e475f8d3da96fe4af32d324d5981c236bb6dbb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647421067, "uuid": "605d9a79-0481-48d3-88bf-e2b2dc4a494a", "value": "T14CE45B06AF22A1F0C06B03B40555125AC2EF7ED0A72ED657825DFB7EDD339977A30226", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647421067, "uuid": "743be664-9842-4e1e-a20f-415b5724fcdf", "value": "066d4e2c6288c042d958ddc93cfa07f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647421067, "uuid": "20ac3df3-946c-41f9-bd78-1bbeea29932b", "value": "12288:jc899XKPmN4WMko/6ZPJSFTdtXlcIL9v6O8:7GP78gFTdFL9v6F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647421067, "uuid": "8b113322-23a6-450b-8f7f-95cafa7f99c2", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647421067, "uuid": "58e8e6fe-b1de-42c2-8cbe-bd99a3f74ba1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647421067, "uuid": "b0da01bf-26ed-430d-a3de-81ffe2600735", "value": "5e64d85f4a113840631502d8598dd7a1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c9f0d72-a519-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647428835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647428835, "uuid": "6ae87fde-0e73-41b3-a047-7ed7302485b4", "comment": "Malware payload", "value": "b9a7741d885570129d35fda78e9ad09a", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647428835, "uuid": "ea4bc836-2339-4d89-b30a-8b1b70dd4637", "comment": "Malware payload", "value": "c31dcbfc1f76319d6c91bfebd20628a6a58a28021b5ffaba3cc8f56162b76cef", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647428835, "uuid": "a245b813-efa1-4475-982d-6d774997b502", "comment": "Malware payload", "value": "05f304c90aa55617175f4aac6d3ac289bc9bcff6", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647428835, "uuid": "ede312d1-d7ab-4cfc-856b-10b458688294", "comment": "Malware payload", "value": "f7df9538092b0c2cac3e08ac010d91a9dc9a1c5156bd268a3a66d919f8fbaa13b040bf8e4697f2292d6a888a7c910bad", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647428835, "uuid": "a2086422-008b-4e5d-9bcb-78aa366d3d25", "value": "T1C8E6335BE74CA9AFC8BB11324E79032101971E2A06D79BE72D55722C29B76C05F9EFC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647428835, "uuid": "653b1a3a-35da-4058-bba9-ada928039641", "value": "196608:+Ry+vcrjfb4OEKGcNDDkjtwmC1BOJvlxl7URBbcf/gTVsCDJUW6+/18EkCje4SVf:+Ry+efEANUjudWJv+3YQZsCDJIbCDSwa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647428835, "uuid": "e718ece9-7531-458c-a983-2d39e0bd432b", "value": 14551921, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647428835, "uuid": "f73b5c2e-959f-4a81-831d-7574fb808a39", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647428835, "uuid": "19c58cc5-e151-4bf9-b3da-64b60c6bde17", "value": "Purple Shiny Wallpaper.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b58949a-a535-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647440805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647440805, "uuid": "1290e7a1-61d3-498d-88e6-a02a36f478c6", "comment": "Malware payload (RedLineStealer)", "value": "300bc4560756a68c8749d2b077c57e37", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647440805, "uuid": "87cea0f8-3d68-459b-ab28-d2586f196c78", "comment": "Malware payload (RedLineStealer)", "value": "c356b89a26beda1b3a471354436efd5924d3e0cf8ed83377c7d1d8dbb55ea358", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647440805, "uuid": "c67d8bf7-071b-417d-9b86-d88f87499e63", "comment": "Malware payload (RedLineStealer)", "value": "20a060b65db59273da56db5f3e7aa5ab5950af48", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647440805, "uuid": "98193481-6d4f-4567-9a55-f02248576019", "comment": "Malware payload (RedLineStealer)", "value": "e75461454ee9edcdbb4e28d80ca6a9e04c12c9ec92e197327932d280e934ba4c81d13084de5411da6db3849f7962a928", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647440805, "uuid": "9c00d5f1-ea83-4f6d-a6b7-69fff021e834", "value": "T1B516338B35EBF957C95A1DBD3A3F7FD08B302374544CBEDBB5616AA806181A3B702904", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647440805, "uuid": "65f238a9-0b6c-4580-9f82-5e6cba532bd2", "value": "445554923421947cbff896012e27345a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647440805, "uuid": "9d387643-8dcc-49b6-a0d8-227412900cd6", "value": "98304:FKW0+Y3o6oRLhRIiBKkci1vn3Wlb/YH60fk:FKWbH62Lgi4kccMDYHFs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647440805, "uuid": "49c792bf-815e-47a1-96cd-ebaa3a8aab7c", "value": 4131840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647440805, "uuid": "fafb8c26-3d9e-4679-9167-4dafbda6e525", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647440805, "uuid": "c2e62e85-8357-4270-81a4-de7fbf5f33ba", "value": "c356b89a26beda1b3a471354436efd5924d3e0cf8ed83.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1d0b245-a55d-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647458291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647458291, "uuid": "c49b1120-77ad-4a5c-abd9-cb8c2a5b4e8b", "comment": "Malware payload (Heodo)", "value": "5463e4f291724581215c3991669d6aa6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647458291, "uuid": "91d809a8-6e3a-4e10-997a-669a9c991eeb", "comment": "Malware payload (Heodo)", "value": "c49af5079bd294e5d79e905ee5f5adefcf236c8df2e1a6c4dd50af011ee31ed0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647458291, "uuid": "109d6b98-5797-463c-ab01-475a615a6c44", "comment": "Malware payload (Heodo)", "value": "f5dc7ff5667d9794a5ebb8fa03c947fc60ba8fc0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647458291, "uuid": "ba8bc23c-4fbc-478b-9f42-11dda43574c7", "comment": "Malware payload (Heodo)", "value": "bd2f7a1a87555ee90c6e0ec642a6decf7e7d20a1763c6e203388af7a00ce567ea33cc78f3a80664a5b2768a120a3ebee", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647458291, "uuid": "1b183e01-6849-47b7-b65d-a10308e71bcc", "value": "T152F4CF11B2D1C076C1BF06741916A35D63F6FD608BB9878B6FD02FAE3EB45828A34356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647458291, "uuid": "2194c9f6-f74b-4910-b8ba-d1ae5f3d95d8", "value": "66a21a1bcb4077b3ed89c00ee693486b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647458291, "uuid": "e4b4aad7-ad1d-4cb2-a79c-ce8cf851c5fc", "value": "12288:WZjb8BOPxue5dKV9M/98f0koPnXvkgKtuBdfMAofD:WCBAdKV9Xf0kE3KMBdkAofD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647458291, "uuid": "ba14acf9-bb3b-476e-82dc-aced91a95b0d", "value": 753664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647458291, "uuid": "7e65476b-5744-46f3-80a6-e21223cd3d25", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647458291, "uuid": "47994083-1988-4dc5-ac98-5a7d5da417b0", "value": "5463e4f291724581215c3991669d6aa6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a522e6f9-a51f-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1647431587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647431587, "uuid": "dbe27be5-2dde-4023-b435-a8e65c8bf4e4", "comment": "Malware payload (AgentTesla)", "value": "6e884be91319c550bf680c8a07ca4408", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647431587, "uuid": "3a288685-1c72-4a09-b283-21af8f23605b", "comment": "Malware payload (AgentTesla)", "value": "c51dc87aef087ced26d35ec1e310c358adc2dea8ad447d779bbec3e516a841d2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647431587, "uuid": "09417853-816e-4cce-8803-24583dc7d069", "comment": "Malware payload (AgentTesla)", "value": "c5f06d34966ad490d0f4a3ef587f2c8f5d3c8d60", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647431587, "uuid": "3504652b-f4bf-4ed4-be41-0c0ee3153731", "comment": "Malware payload (AgentTesla)", "value": "4d1c5399340a9f6cf8c2a34785fd0571bccbf35ffac6fb31b0d95d60eac73d1b38d6a7511d82018cf72ec5c3b6a0dfcf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647431587, "uuid": "148427e5-28d8-453a-9ec6-7ef70ca0a693", "value": "T167340782E9006664EE68AB346E33CD3503127D7DAD74D52D24E97D4B3FBBAD3A029413", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647431587, "uuid": "6b858bbc-10a1-479f-b84a-448403f6fe8f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647431587, "uuid": "f7522b3a-3a32-4d25-b774-5d9acfd8632e", "value": "6144:AE08tYLCZ0Egrdm4Vz0Rpppppppppppppppppppppppppppppd:Aqgrdm4Vz0Rppppppppppppppppppppb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647431587, "uuid": "19cab479-d96e-4a4a-85e5-221b09fd0540", "value": 246784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647431587, "uuid": "c28c2367-189a-4bca-9671-0fafc0ad41e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647431587, "uuid": "ca7962a0-d66f-4a1e-889a-c1ae3d7a7237", "value": "NEW DOC- SUNIX INDUSTRIAL TRADING - PRODUCTS LISTS.XLS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a9791e2-a532-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647439622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647439622, "uuid": "7eaa2339-0e70-43a2-997f-a6e017966bd1", "comment": "Malware payload (Mirai)", "value": "f8824411b9bb74a426a36fa2c28ab32d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647439622, "uuid": "dba53e23-2d85-4d3f-9234-8183b6072d27", "comment": "Malware payload (Mirai)", "value": "c5b59448865949eddaf8c83c97237ebdf303f0faf141981543e52f6d081c46c7", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647439622, "uuid": "6e988077-9731-463f-a538-ace0cad4bbfd", "comment": "Malware payload (Mirai)", "value": "d1061dbe43ff8594af4bcb7eb443fd27a37053c0", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647439622, "uuid": "fb9aa5e3-9135-4ddf-88e2-725c8fa385c5", "comment": "Malware payload (Mirai)", "value": "958df5fb589b6d507039405a9af414f75dc3f28a334ff8bbb345339c8f42fe1600ac1e9512630a91e30320f42a5772ef", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647439622, "uuid": "112b6bad-068b-4652-afef-326dcf157939", "value": "T1E6131755BE9D9A01C4E01072FE0F43897B2AC3C4E5FEBF834AA56B481A474661FFB509", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647439622, "uuid": "21015388-b2c3-4af2-84c4-d14f3a601051", "value": "768:HmedBJPmPy5gwvNeUPVYvUHNlUZy1d+rEvI4i6STP:Vd3PGKNEOlUASrEvI4i6Sz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647439622, "uuid": "57c4c9a5-f4a2-4692-9acb-3a56b92f1c13", "value": 43964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647439622, "uuid": "05df9b4f-13a5-43bf-9aeb-67c1ee58f504", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647439622, "uuid": "e01a406a-78c1-49b3-954b-8e7641063098", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27224676-a4eb-11ec-9275-42010a9c0029", "comment": "Malware payload (CoinMiner)", "timestamp": 1647409042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647409042, "uuid": "d5ed5592-4855-4c73-966e-9307c965d2c2", "comment": "Malware payload (CoinMiner)", "value": "81dfef3dc8256a00551dc8d776961739", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647409042, "uuid": "ba254a64-e734-4e8b-9f9b-b8a63a6833fc", "comment": "Malware payload (CoinMiner)", "value": "c5d6f2c6e70b04dc167adaf72857b6dde342826d1f9cac1413f9e439aec49da0", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647409042, "uuid": "76a7e34a-cede-4157-9dd2-a8e33a8161c8", "comment": "Malware payload (CoinMiner)", "value": "fb4c48f64112d7008244c5ed7adaf17c502d014e", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647409042, "uuid": "33732593-77c2-41ed-bbc5-46a465722c3a", "comment": "Malware payload (CoinMiner)", "value": "bcf2db77158033f00efc4007236546af112df3e70a80b10d9590126ea18c78d590f368412255474ed744d64e0e8f86fd", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647409042, "uuid": "9024ecb1-d43e-4919-becb-8035bd38c9e9", "value": "T158B5CF5D72A540F9C6AFC178C91B890FF7F13849436495EB12A15AAA2F277D0C93EF20", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647409042, "uuid": "63b20520-b324-445a-95ab-1a2b3dd202dd", "value": "15d37b2dbf429fe98369cfe1275b025f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647409042, "uuid": "b346d5a1-f644-4e97-9aa9-61dd2c9c9a82", "value": "49152:31G1NtyBwTI3ySZbrkXV1etEKLlWUTOfeiRA2R76zHrSax9AMkibTIA5CJvIb:31ONtyBeSFkXV1etEKLlWUTOfeiRA2Ry", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647409042, "uuid": "da8caa92-2d75-4841-871e-2b813d6b156a", "value": 2433345, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647409042, "uuid": "9d0a0055-398f-42f9-a989-b40715cb0476", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647409042, "uuid": "8e4a6112-ddc2-44c0-b482-7bd25185fd9f", "value": "c5d6y.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "273a7aa2-a51c-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647430087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647430087, "uuid": "ab8f75d7-232e-4ce9-92eb-a33af907c465", "comment": "Malware payload", "value": "668351aec8e03c1163e52560f92dd086", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647430087, "uuid": "a0506a41-daee-4cdd-9f70-1e5c377d187c", "comment": "Malware payload", "value": "c60830ab9c3c2910f7161fe8386db1d7f994f71573d105209a49219360dbdd62", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647430087, "uuid": "07d780c4-0280-454b-9dbe-829d7ac0587c", "comment": "Malware payload", "value": "14b6ae15b7edfc6ea1bb7915c86f5f7685d84f58", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647430087, "uuid": "ced5cbb2-7846-43c1-a461-dd13cbcffc59", "comment": "Malware payload", "value": "b71897693e31b01fa813e29113ad946ed8ebbf0d94be0a1b3227e4a40635814c2b14b04b8c4ec1febbda2a064d27b277", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647430087, "uuid": "411d3019-ece0-4957-9ddb-609ad337a44f", "value": "T10252C660B2A944E7EC7B19314D1BCB2102717DBED4D3D32E61CAB61B49F3310856B66B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647430087, "uuid": "ee41dcab-1ae3-4aad-a7c6-eac4d3f103d3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647430087, "uuid": "11321b82-b47c-4e3d-8073-156c89838ddc", "value": "192:+7Nol5rRNRau4eEyy1SqPCLYQQj+qjxuG:yN4RNRau4igCLYbjvjxu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647430087, "uuid": "97b25dfc-9f12-4992-9dc7-b19e1f94e8f3", "value": 13824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647430087, "uuid": "fb5f70f0-d90f-4ef3-b21c-7471a4cfc3d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647430087, "uuid": "b1cf302e-5453-47a8-8192-2f03f5c13e15", "value": "Swift Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51e8ab2f-a578-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647469673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647469673, "uuid": "54cb55c6-a2c7-4b44-942f-a12bcf2501e4", "comment": "Malware payload (Heodo)", "value": "ea366fdc7f9412d647263d79f157a570", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647469673, "uuid": "5f47a558-36b8-4a3b-abae-c1268addc951", "comment": "Malware payload (Heodo)", "value": "c611dd2ce50a50f45fe2808bc68c09b275086a742e0579734748212e8bf3610d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647469673, "uuid": "9ac98020-ae58-4065-8420-94934a420a28", "comment": "Malware payload (Heodo)", "value": "9e5eb0e69976ed7de1321b3fea4c2194afb2e7b2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647469673, "uuid": "3551b576-6253-47eb-90cb-df1eb1d6b359", "comment": "Malware payload (Heodo)", "value": "ea4056f653372063beaa45038f7ba0bfbb3ca03d80dc0051f335f733f73e89679822ebf61edb10628732f68c8f979191", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647469673, "uuid": "99cf3e0e-0184-47bd-b0f1-16a2140fe14e", "value": "T1CCF4DF1176E1C076C1BF12304956A38D23FAFD509FB986976FD02A6E3EB41828E34767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647469673, "uuid": "ce3cb092-cabe-4634-94b2-9bbbef8c1399", "value": "66a21a1bcb4077b3ed89c00ee693486b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647469673, "uuid": "a44b104b-abde-42ec-9934-babf9037666d", "value": "12288:g6O4TpP0XjxCCFJuf07j+Xk7hF8rLneTfABCJoWRWwfpW:BeCCF88j+XY8OTYA7pW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647469673, "uuid": "25892b8e-1111-41a2-98ae-f3cc1aae48dc", "value": 749568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647469673, "uuid": "48500d5b-6a83-4a5b-966b-007020ec2a5f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647469673, "uuid": "91ae9029-b826-4dbb-854d-06d8bd7ad1ba", "value": "ea366fdc7f9412d647263d79f157a570", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e6d0e56-a4fb-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647416033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416033, "uuid": "2689f28d-4a61-42f9-bf32-ad1de5d4f053", "comment": "Malware payload (Heodo)", "value": "fd3113f3e9972b4eac37c17d20f057b8", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416033, "uuid": "44f0d028-40ca-46a0-90aa-7fef4e8b6b42", "comment": "Malware payload (Heodo)", "value": "c7bb2bc0b80d8b1f6d16a8acd68bc9848ea9b6f9b5a2cdc4cb2b9291ab98a817", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416033, "uuid": "d5177d37-1cb2-4ed6-a269-a155782f1f75", "comment": "Malware payload (Heodo)", "value": "9ec665f686c46a7b5f52d263700628e5b262f188", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647416033, "uuid": "41776c49-575b-46f4-a588-487223343301", "comment": "Malware payload (Heodo)", "value": "e6084d7c5a59bac31c085f8ea8cdba962917e63715363bbe6490927713312ab022364a54c60da611bb39adc5a8d7ee83", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416033, "uuid": "2ccee8cd-a825-4639-996c-d2e59d80ce2e", "value": "T123F2CF2DA3A0EF5ED61DED38849881EA421579154506EB4FA85CEB0D6F493C33B1F0DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416033, "uuid": "a2dda716-72b3-4536-b9e3-a77fe70b35d8", "value": "768:ojFhNKbeXizXT2LxdFfPdkqstJ1goE6vS:oBTGeXgXUndkqegoE6vS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647416033, "uuid": "229047b3-9228-49ad-8482-1127a270aa3d", "value": 34391, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647416033, "uuid": "b60ecd01-a519-4126-80a8-a3127f50fc88", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647416033, "uuid": "2838ea35-df72-47d8-9f72-a0b53a78ce7f", "value": "form.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c370384-a549-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647449557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647449557, "uuid": "7843ad67-0ee0-4a88-8c1d-14c03e3ee092", "comment": "Malware payload (Heodo)", "value": "2d0f1647d0fc1851ce38ffaea052081e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647449557, "uuid": "13a29330-8003-40b8-9447-0ab450f50b9f", "comment": "Malware payload (Heodo)", "value": "c80fe55800bff1e1ddc0d32e95bb094071d4f5181f1647e63536e3173b00c6d7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647449557, "uuid": "44c694e6-f4a8-4546-b1bf-e19f602f06c6", "comment": "Malware payload (Heodo)", "value": "814e44418a481d9cdbc8361ab3f0525b61f3191b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647449557, "uuid": "f411e52b-1ec4-4b25-8ddd-c7b425e478dc", "comment": "Malware payload (Heodo)", "value": "e92c001651f571bbf253ca7b93f90b7795fa060123094a57b2a044f62ba805a75908349a853438039f9d0fffa699292b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647449557, "uuid": "3a80a537-5ac3-4c3a-8cc9-aab74fb85291", "value": "T154E45B06AF22A1F0C06B03B40555125AC6EF7ED0A72ED657825DFB7EDD339973A30226", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647449557, "uuid": "185ce34e-e615-4558-b807-8b547645c351", "value": "066d4e2c6288c042d958ddc93cfa07f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647449557, "uuid": "191c901f-4cee-4184-bece-4c689987d65f", "value": "12288:jc899XKPmN4WMko96ZPJSFTdtXlcIL9v6O8:7GP7mgFTdFL9v6F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647449557, "uuid": "c55edd02-661d-4986-a9ff-4f8542ccceb1", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647449557, "uuid": "362c3546-fdb1-4cf8-b1eb-b3d203b21665", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647449557, "uuid": "5649999e-fa18-4807-b3d2-b8fa75d3cd59", "value": "2d0f1647d0fc1851ce38ffaea052081e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b20caed2-a56c-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1647464680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647464680, "uuid": "34376d33-8ebd-4730-9f3f-97e5cc7b45c3", "comment": "Malware payload (Formbook)", "value": "7c191deebb77971498ae1b238287ad18", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647464680, "uuid": "65f4cdfd-ced7-4522-86c2-d338d05c5868", "comment": "Malware payload (Formbook)", "value": "c8f1d68423b8b8f43600ad0fb409f71283cd5a9c732d7b1e641b414f6313625e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647464680, "uuid": "57c18283-f13b-4475-a29a-d7738eb6e764", "comment": "Malware payload (Formbook)", "value": "76cf576734196bbdb1aaa2d6b73ea4e70cc26527", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647464680, "uuid": "59ffec09-db0c-41b1-8eff-975971388040", "comment": "Malware payload (Formbook)", "value": "168837391ccd1798ae8413224d702344ed1e2a1741784dc4a6d2944dd18b733eb592658d8c9e73c35936648540b9a105", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647464680, "uuid": "a4ef3690-241a-44df-b3ba-06713a0eb92e", "value": "T174F49EE2F2518836C1171A759D4F56B86D3ABE10EE18AD82EBF42F4C7E7C3807926153", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647464680, "uuid": "d29bd723-4cac-4872-9ff7-ecc5ac2cebc6", "value": "f2bdaf9594ad1018c72c522ae344bebc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647464680, "uuid": "18dbb4ad-101e-4115-8b59-eeb24cf92295", "value": "12288:9X2hBsMWINdoGVgS2/q5x5QOMTvRi2cuWpkzADKesNHqI6F3HAh:9GHeGoGVg7/qn5QTR9LvlZNHqTHAh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647464680, "uuid": "2fde34de-cec9-46ae-a9ea-86e409549cc1", "value": 780288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647464680, "uuid": "05e9f709-ace5-47e1-8c0f-4742c0f57cb0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647464680, "uuid": "57ef56d8-0185-412e-8ab8-9cf16cc45cf5", "value": "vbc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "baadf5c2-a4fe-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1647417450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417450, "uuid": "a09ec7dc-e429-4954-9b62-711301de6602", "comment": "Malware payload (SnakeKeylogger)", "value": "b3b9148aacdf7ac1304afc30692c8cac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417450, "uuid": "ee1bf87d-725f-4ffb-b31b-a08bb7bae274", "comment": "Malware payload (SnakeKeylogger)", "value": "c90c4cac0caa3b91b0e74e77dab1a366bbf96f547bb5cd41115a97c0dd13937d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417450, "uuid": "ec14ee76-891e-4771-8e18-2cc5f9a8bbe4", "comment": "Malware payload (SnakeKeylogger)", "value": "1fc17fe0b9bca9dfa956dd896dad7f6841040819", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417450, "uuid": "1a87dc11-6855-4c4d-921a-57aca0879c8a", "comment": "Malware payload (SnakeKeylogger)", "value": "4cd2e73cb3656fa1b10f520a746ee2b9be42b5ce879dca854b199efa988ef3a9afe553112075cf4a60df207b400645cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417450, "uuid": "d5b8cd04-3068-462f-bb97-1d5f7cbcebb4", "value": "T109256ED1F1508C9AED6B09F1BD2AA53025E3BE9C54A4810C569DBB1B36F3352209FE1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417450, "uuid": "8bdae0bc-a9e9-463a-86f6-b2ef7166781a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417450, "uuid": "7cdf41af-5dca-4cb9-bf3d-339cf9b22ae4", "value": "12288:QmEowOEi6mOx74oz9KJYSLPdmMYOX3MGlbRrNN:QVowOzhOx74obWxYeFT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647417450, "uuid": "9c01dfd8-6871-4775-96f9-6650f8bd4cea", "value": 1004544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647417450, "uuid": "f44efe59-e0e2-4a33-bc07-5e251b2523dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417450, "uuid": "9d893f19-b501-4ea9-8f6f-ddfa127e221c", "value": "hesaphareketleri.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2db4bc81-a565-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647461451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647461451, "uuid": "49f0ab56-0883-41f7-a054-441a6885895f", "comment": "Malware payload (Heodo)", "value": "c2a749a59f1060a943365ed463b85713", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647461451, "uuid": "9f0f7caf-ae3c-4147-be7f-3927d2ee17f9", "comment": "Malware payload (Heodo)", "value": "c91e08d91bf22fc071eedf81ae03522f7b624a7ebb96b07c673b7a87ff9a1c35", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647461451, "uuid": "87be2ac8-676b-4e36-95d7-3473dc6a80a3", "comment": "Malware payload (Heodo)", "value": "af0bf645d212b227df3797d783e2c8aad313fbc1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647461451, "uuid": "4cb3404d-befa-45e1-af5c-3be10eee8cfa", "comment": "Malware payload (Heodo)", "value": "70f168bdfa538585db97972f68133afa1d01dbfc528d3ace8e3a3d21eb6edcd0411270a87e824b564eaa907041ee7077", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647461451, "uuid": "87837d45-9900-4492-91be-1c6276891e4d", "value": "T138F4DF1176E1C076C1BF12304956A38D23FAFD509FB986976FD02A6E3EB41828E34767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647461451, "uuid": "8ca29b32-5193-48a6-a492-c5e0b4ee1289", "value": "66a21a1bcb4077b3ed89c00ee693486b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647461451, "uuid": "d867adda-19ec-4b6f-a231-df9324500708", "value": "12288:g6O4TpP0XjxCCFJuf07j+Xk7hH8rLneTfABCJoWRWwfpW:BeCCF88j+Xe8OTYA7pW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647461451, "uuid": "0dcb6279-5fcc-4d60-b4d7-3784994249e1", "value": 749568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647461451, "uuid": "8f5dc71d-149a-4be6-b3f3-69f2b1ee3c9a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647461451, "uuid": "4a7701ef-2859-4f5b-b026-667d50a6232c", "value": "c2a749a59f1060a943365ed463b85713", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "204360cc-a54e-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647451550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647451550, "uuid": "3787dc10-6b21-4513-8ffd-2f17cc003638", "comment": "Malware payload", "value": "01f3df1050e06f54402a2933dc6945e2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647451550, "uuid": "654a5e42-f3cf-4142-b423-6d5737ce37e2", "comment": "Malware payload", "value": "c939ce949377b0bda7de743d59d8495fe403f35dac0bce0cf4972bf1c42484a3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647451550, "uuid": "7b7bbf31-ec31-4f82-b9e0-04812580d6bc", "comment": "Malware payload", "value": "e2c089ba1dcf918d734fb6ca994380aac91d1406", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647451550, "uuid": "83e09a82-8128-4dcc-85b3-eb368cd83d0b", "comment": "Malware payload", "value": "83a11feee300eb057e36c33726405f331aee9a9745afe785b3e7000b5de65d9a690dd9769036748596c2af161270da04", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647451550, "uuid": "a86cf676-8ea3-4f8e-9335-275990f7f68e", "value": "T155D46D55BECA6EA2EF7F43B78361DA3D1126736D03A1A6CF6603059D3951EC2443EA03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647451550, "uuid": "5daecf39-c578-4f6c-b6d4-3531b403d965", "value": "be710ba34b048ab0098050ccf62e369c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647451550, "uuid": "4e5ae0f9-a046-4780-9c29-f405a05e617a", "value": "6144:1xOJXk57IMp7oyR4y6Qf3lbp83A6zbKsS5ukTP2YmqtkSGUmuqZGw+gSe81HN2:1x2s7IMrR4yVld8bzbBSre6qZGDxN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647451550, "uuid": "435b3cda-08f2-4cfa-9e53-5ca177295b44", "value": 643072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647451550, "uuid": "a3102b39-aa2e-4700-8b24-37bbc565b269", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647451550, "uuid": "7068149e-1635-4467-8a37-76a02e94b06d", "value": "01f3df1050e06f54402a2933dc6945e2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "337c0301-a572-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647467045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647467045, "uuid": "a4b3bb78-3442-48be-b254-287e2f4c250b", "comment": "Malware payload (Heodo)", "value": "c311d685a174121b4794a32ac17640c1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647467045, "uuid": "da2fdf08-2fd0-4c60-b0bf-1667b13aa700", "comment": "Malware payload (Heodo)", "value": "c9ebe7e662f8b4d9a19f13b7f384ffa13849701a41c71d0d714f35733386220f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647467045, "uuid": "fa0435da-e3cf-40dd-9a29-11e9b3e31d01", "comment": "Malware payload (Heodo)", "value": "47946bff8681aa076877dcf9bf0cca8e8ab81e0f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647467045, "uuid": "66394d4e-a0be-4a14-a718-2980394fcc7c", "comment": "Malware payload (Heodo)", "value": "194634aa65014b129fe1630a821ad97590b09a7843c7b99283bc808c99e9431806ad5f017db587444da9adf97a31f5ba", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647467045, "uuid": "b4241d59-ab7d-435d-9f6c-b3541301bfd5", "value": "T14FF4DF1176E1C076C1BF12304956A38D23FAFD509FB986976FD02A6E3EB41828E34767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647467045, "uuid": "8b09dc5d-172d-4ef2-92fe-1b4ef4ea83bb", "value": "66a21a1bcb4077b3ed89c00ee693486b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647467045, "uuid": "014ab071-cb64-45f3-ae5a-73466732f609", "value": "12288:g6O4TpP0XjxCCFJuf07j+Xk7hs8rLneTfABCJoWRWwfpW:BeCCF88j+X58OTYA7pW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647467045, "uuid": "8c9eb34f-22fc-4690-987f-cc1e73ee7fe8", "value": 749568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647467045, "uuid": "258dc1f1-ca7e-43e9-86ce-7fe2ea42b4a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647467045, "uuid": "45977969-61a9-42c4-b4c7-ac2e6f66c529", "value": "c311d685a174121b4794a32ac17640c1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b6db2dd-a53a-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647443006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647443006, "uuid": "1392c475-ef95-4f8f-aaad-01d8e9e495da", "comment": "Malware payload (Heodo)", "value": "0ed546b7f1892178e795bd592c5568ef", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647443006, "uuid": "c8a74a4a-2f43-485b-80e5-e0ddf831cc83", "comment": "Malware payload (Heodo)", "value": "ca13b9b08bbd14f84e6d47f29a44fa3d38ae71f73fa6714896fd1b22b9472df5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647443006, "uuid": "d94e0ea2-4ec2-4ba0-b443-6620dedc20aa", "comment": "Malware payload (Heodo)", "value": "bb6153f2392cb1efcaf2b330944014f2efc5185c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647443006, "uuid": "7ab84e49-4787-429a-ad7a-08fea8ae5fb8", "comment": "Malware payload (Heodo)", "value": "f40d5bf9bb3b2e6dbd49c3bc10073592f52c1fe83c2433c7be2cf4eb99d67f81a4f5c099b4500408a2d95fd026a8ec72", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647443006, "uuid": "e5784750-e685-4a6f-bb79-3581199cd555", "value": "T1F6E47C12F461B2B9D04B04741F1723A86EEF5E518629CA13AFA8ED5E1F31251FC3FA16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647443006, "uuid": "f64033d1-8752-4a43-96e7-b988e2998ff8", "value": "066d4e2c6288c042d958ddc93cfa07f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647443006, "uuid": "6a02f8b4-e7e7-45c2-b978-231a541823e0", "value": "12288:DtAanana8Meee0GBGu3qI+3DNJ3vE6v5eKxS332d7t5hT/hexLx:Kanana8qGBGuoNxEsxCM7o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647443006, "uuid": "bb4b8165-6345-4695-aa31-855e63d51b6a", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647443006, "uuid": "db13dea2-40a3-49ad-aaa7-4e073e428dfe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647443006, "uuid": "390377ac-6516-45f2-82d9-89c9ed28348e", "value": "0ed546b7f1892178e795bd592c5568ef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d51854d1-a557-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647455719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647455719, "uuid": "14f4cbce-8929-4ea5-b9e0-b78a2fcf5666", "comment": "Malware payload (Heodo)", "value": "2a274c70dc72a8390fee01a68cab08b4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647455719, "uuid": "f77b1de8-437b-4258-832c-9460e6febaad", "comment": "Malware payload (Heodo)", "value": "ca75b91a45fc81d39e2a77a7ebdd727cce3a088ec6c6b79db65e44230d05bc7a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647455719, "uuid": "3023082b-500d-4d9c-a056-a47f5e0950a5", "comment": "Malware payload (Heodo)", "value": "cf5508267b44644679033fafadc4b84e4a0958be", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647455719, "uuid": "a962ea45-2dcc-4866-aeeb-8289f2489030", "comment": "Malware payload (Heodo)", "value": "b33e9661239ca55101a0db60db79285fdbb37c4ee28a973b333e8ba3b18967c3283ea3f3aadc1a0a3b21bba052383ebc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647455719, "uuid": "feb6c667-d94f-4968-91fc-c740191ee57c", "value": "T1EBF4CF11B2D1C076C1BF06741916A35D63F6FD608BB9878B6FD02FAE3EB45828A34356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647455719, "uuid": "4269b6cc-1151-4f0c-9d9a-8f2a33780f75", "value": "66a21a1bcb4077b3ed89c00ee693486b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647455719, "uuid": "cbb95199-d6d9-489c-b803-f1adf31d7d7c", "value": "12288:WZjb8BOPxue5dKV9M/98f0koPsXvkgKtuBdfMAofD:WCBAdKV9Xf0kX3KMBdkAofD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647455719, "uuid": "385d06bb-2e54-4e84-a10d-c3893f46aedf", "value": 753664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647455719, "uuid": "806ecc88-7f4f-4ef9-9229-2c4c2c8b544c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647455719, "uuid": "fd83c5fb-bc5e-4d4a-ac26-eb9a2cb5b473", "value": "2a274c70dc72a8390fee01a68cab08b4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6979ac57-a502-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647419031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647419031, "uuid": "bce3a2c9-9e83-4bc5-a98a-b4f8377ce2f6", "comment": "Malware payload (Heodo)", "value": "24d0a28f83a90326d211a6cdcebde32c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647419031, "uuid": "c5a7bf1a-0f39-4b1c-86b9-7a5e31a0fa23", "comment": "Malware payload (Heodo)", "value": "cacbb636ea6845551ba76f297abe972297205ca1ddc480ba00ab8c35ca31fb46", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647419031, "uuid": "96782d6e-7453-46ab-84a1-bfb8ef9d6c09", "comment": "Malware payload (Heodo)", "value": "3b4554b3383350a736979d4ef9e274bafe9ad5f1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647419031, "uuid": "fd59492e-70f4-4bfd-b411-59e4c0c2a001", "comment": "Malware payload (Heodo)", "value": "6f0476ac46d2ee24d350151013d9115e113a3919871093504c795f4c8aa537e588c8e274bedf4ae14987e2cc4ec86c1f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647419031, "uuid": "43ea0ae2-8d5e-48a4-91d1-0f8d84925f3d", "value": "T165E47C12F461B2B9D04B04741F1723A86EEF5E518629CA13AFA8ED5E1F31251FC3FA16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647419031, "uuid": "60fad7c9-7a92-42dc-8f6d-84fcec47e475", "value": "066d4e2c6288c042d958ddc93cfa07f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647419031, "uuid": "e4f1ca40-9c21-461b-8b88-798eb3b5a301", "value": "12288:DtAanana8Meee0GBGu3qI+3DNJ3vE6v5eCxS332d7t5hT/hexLx:Kanana8qGBGuoNxEAxCM7o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647419031, "uuid": "6a38c6c6-2015-4ffa-89ec-cb26ae944654", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647419031, "uuid": "b7cad827-bb58-45a2-93a0-83e37bd53df8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647419031, "uuid": "dd5df51b-bc24-4529-b6a5-96377c9a9fcf", "value": "24d0a28f83a90326d211a6cdcebde32c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38e51b48-a500-11ec-9275-42010a9c0029", "comment": "Malware payload (Smoke Loader)", "timestamp": 1647418091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647418091, "uuid": "d34ff376-d17d-4f28-a342-d26a332f876a", "comment": "Malware payload (Smoke Loader)", "value": "8fadd97a177b1ec6fc36390fecc74394", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647418091, "uuid": "52c05ff2-6b3c-407c-8089-fa542181c3b1", "comment": "Malware payload (Smoke Loader)", "value": "caceb4c568320158ccb095b50a3434f71ac58bd6c16542edcd34a99593c59ad4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647418091, "uuid": "a93b8dc5-84e7-4db6-8231-778e07ef0d48", "comment": "Malware payload (Smoke Loader)", "value": "d8d8667297fc75fb9191fd861e597affcb69831c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647418091, "uuid": "bf595b40-8df2-47a2-9bb5-07a3257fa1b6", "comment": "Malware payload (Smoke Loader)", "value": "ed6b4fc080a97a822600ba7f54251abcccdce865db21775b54293bc80fd11348f5574c4e6966ee3493ae8f11e5a9f7ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647418091, "uuid": "4c93d13c-dce3-4f1f-aa54-870f4c5df73d", "value": "T1A2F47D22F1A28837D1332A3D9D6B5265982BBE013D38698A3BF51E4C0F3965179353F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647418091, "uuid": "2c629e74-0ff5-4064-b60d-87b7b850a4ee", "value": "fe8fe697a2113c9983ebb64a3ad85165", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647418091, "uuid": "547bae97-2496-4eea-af04-133d840208bc", "value": "12288:2S1PtiVzhCYsLMsmHZDkEIsyHzf80+uAZmi1mfxvv2PQKVUnTLvO+J63:h1i3CMsmHZDq5joZmIm5GPQKmnt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647418091, "uuid": "f2089e67-def8-4cca-9425-5e9304a2c43a", "value": 743424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647418091, "uuid": "a6d834f0-247f-4f51-be42-dae9bace9880", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647418091, "uuid": "d8a7ce47-45bb-40b7-8881-b1edb9df1cbe", "value": "8fadd97a177b1ec6fc36390fecc74394.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "529e0e7a-a534-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647440468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647440468, "uuid": "6d35a4a0-bfa5-4196-8745-bda4c1891d54", "comment": "Malware payload (Mirai)", "value": "d44aec2251e8701ac50fdd975707b158", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647440468, "uuid": "da8d346e-799c-4599-84eb-5a4b0722e552", "comment": "Malware payload (Mirai)", "value": "cb831797364c879007f172e820da3e69d6501a8a576729f4bbc476174907d4c1", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647440468, "uuid": "32d7ee54-c244-454f-82b2-13c8cc5512f2", "comment": "Malware payload (Mirai)", "value": "80d35c0f86463d7ef4e28fea6371a3242260b6aa", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647440468, "uuid": "8bf370a4-924d-43c2-b04d-89ac788c91ab", "comment": "Malware payload (Mirai)", "value": "b9ce11f1b9e20f43c2f1991acdc57affd58b4a5080cc731167ab57240f6dbb57abbb16a5edda8417ef8ae2202f746368", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647440468, "uuid": "5fb93b51-7c32-43f3-be14-1940c1ea8245", "value": "T1B0032797BD498201E1F04176EE0F63046238DEE0F2FAAB3785649244E9532796FE735B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647440468, "uuid": "5e75e7c2-b514-4d56-843d-88221f861643", "value": "768:gPSB9MtqUaUmPrDbhFvNINlUZy6Dd6pexf5PUIq:gqUoUdGvSlUA6R6Yf5sI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647440468, "uuid": "31c0da0f-45ec-4223-9e70-75a0537e8af2", "value": 39440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647440468, "uuid": "60e825f2-df31-4758-a2fc-917bc8f1fde9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647440468, "uuid": "a17c9392-5741-4150-89c4-84975b575c39", "value": "arm5-20220316-1421", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6582250b-a507-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647421172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647421172, "uuid": "0c0301af-9623-4acf-bb2f-d0e9e564bf86", "comment": "Malware payload (Heodo)", "value": "8a74127fef8ba60f4a8ed2715faa3113", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647421172, "uuid": "3f41af10-9a5f-46e3-b173-608d7820d838", "comment": "Malware payload (Heodo)", "value": "cbf14c166dcc59a5bca9ed81f75fccedf834ee5294a4f8c321a65886840dbe9f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647421172, "uuid": "132a6856-f09e-4ca2-b7c5-5550808c8c08", "comment": "Malware payload (Heodo)", "value": "3e180bc229d60be291d6c1d5416d4927004f5964", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647421172, "uuid": "a0c4c7cb-4c02-4b0f-b942-b62e1e145057", "comment": "Malware payload (Heodo)", "value": "e010cb50ca49dcac018b7cdaca5a482dba4a0473f8654d899da07df191e4b491b50782c1de4c2c37a3c50ac9a06730a9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647421172, "uuid": "3a718064-61cb-4232-8de8-6e542a0905ba", "value": "T11FE47C12F461B2B9D04B04741F1723A86EEF5E518629CA13AFA8ED5E1F31251FC3FA16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647421172, "uuid": "7a6b09fd-4b27-4c36-b9dc-7d3126434625", "value": "066d4e2c6288c042d958ddc93cfa07f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647421172, "uuid": "ada6ba4a-0ebd-4def-b2df-80209de39140", "value": "12288:DtAanana8Meee0GBGu3qI+3DNJ3vE6v5etxS332d7t5hT/hexLx:Kanana8qGBGuoNxELxCM7o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647421172, "uuid": "72f9fed5-773d-4ad4-b705-f6d4e887e9ee", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647421172, "uuid": "0b8c0398-59e7-43db-b9c3-37c23ca7fe82", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647421172, "uuid": "2e05a721-53de-432e-aacf-94b24d497c32", "value": "8a74127fef8ba60f4a8ed2715faa3113", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e0ed556-a4ff-11ec-9275-42010a9c0029", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1647417643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417643, "uuid": "ba5e6d1d-1de4-4b49-b3b6-e941fd35f56e", "comment": "Malware payload (AveMariaRAT)", "value": "22af5842416167d19a4db501afb4c95d", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417643, "uuid": "f2474ce2-67c2-4b93-a402-1efc419d8b8b", "comment": "Malware payload (AveMariaRAT)", "value": "ccb0911d8f7f12d93607017617f351df36dac26d51544c53fd737073345b7b7a", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417643, "uuid": "e94d54b7-36e5-4b91-be4b-f722e44eeb2c", "comment": "Malware payload (AveMariaRAT)", "value": "51d600a5acfb7d7ddb4db0796e9147f7d6204f4c", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417643, "uuid": "11a00d36-5996-4b67-9eb2-cae5fdc185d6", "comment": "Malware payload (AveMariaRAT)", "value": "e8f056bc6de50d21176fba7cbf6a657850b95f32ac09919948155d5a8a473fbd1acd4b04de9bbd44f9327d000f92a212", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417643, "uuid": "3ade396d-2cef-41bb-922b-eec489b41ec4", "value": "T12633196F49A798D3DFC389F6B2F0E3054DB3A290AE76568B3069E0815D9A750370D4CD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417643, "uuid": "ddb27323-ca5e-4a7e-a98b-72793ae1584c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417643, "uuid": "3c91629a-6642-47c9-823a-e68be30c0c4c", "value": "768:ZQWXAJ2oZU1ZdWNJTEpo/ofX3whOpo/ofX3whI:qWwBe1ZdWPEpowPghOpowPghI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647417643, "uuid": "78f44029-4a6f-4341-a343-d4cc9d3b5ea8", "value": 54432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647417643, "uuid": "c4a5efca-c3f5-438d-a2bd-d6bd53ba4463", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417643, "uuid": "467f9538-20c7-43bf-9360-3dd11f6ca26f", "value": "PO_IN00043INBOM_Specifications Sheet^^^^^dwg.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d79f466-a56b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647464082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647464082, "uuid": "66293ce2-ef6e-46bd-a197-50d091fa79c6", "comment": "Malware payload (Heodo)", "value": "37b4a2257c8bddfe218f083b0586688f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647464082, "uuid": "1285bc10-e68c-4bbe-bf62-dd4b7fa96aca", "comment": "Malware payload (Heodo)", "value": "ccba8659f23c3760a99589836a2a013298ab1c51881014d9d388d64992f6f773", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647464082, "uuid": "8932b99f-1ae0-4761-acd0-85e6eb26d300", "comment": "Malware payload (Heodo)", "value": "86e758bd9b1647e36bcd48640f2f4043c606dbf7", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647464082, "uuid": "105699b5-209f-49e4-b168-11836d46e829", "comment": "Malware payload (Heodo)", "value": "6d30d84642e4eeff783edd206a97d329b82486cc766a8f77a0ed11f344668ff239cf8b98cd3ffae31f54bb53feb227ff", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647464082, "uuid": "6f019263-8f9f-456d-8cff-d04b9d3b9e11", "value": "T152F4DF1176E1C076C1BF12304956A38D23FAFD509FB986976FD02A6E3EB41828E34767", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647464082, "uuid": "36613c40-ec7d-4cc7-9482-e81a8738d7ef", "value": "66a21a1bcb4077b3ed89c00ee693486b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647464082, "uuid": "6dec00b3-8f4a-4481-a180-9f8fcee3462f", "value": "12288:g6O4TpP0XjxCCFJuf07j+Xk7h38rLneTfABCJoWRWwfpW:BeCCF88j+Xu8OTYA7pW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647464082, "uuid": "4eba6576-f88b-44c6-a5eb-1be92e8336e1", "value": 749568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647464082, "uuid": "0d09ad22-a2e7-4255-966c-8c68f579ea00", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647464082, "uuid": "fba8f322-70e9-4e70-9e0e-068c9ac5ec10", "value": "37b4a2257c8bddfe218f083b0586688f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "273ab0a9-a516-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647427510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647427510, "uuid": "d238c399-9791-4a1c-806e-a32e89796bd3", "comment": "Malware payload (Heodo)", "value": "cd0bc00456d05ce6978801da289f4d7e", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647427510, "uuid": "ae0548dd-f326-4fe8-b4c2-261815078310", "comment": "Malware payload (Heodo)", "value": "ccbdb243934d65e5801f441a9266ce1cc4c4d8976613f0e7e59cbc56653d3587", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647427510, "uuid": "ceb0c5a2-72d4-47a9-ad29-fd01f1b081b1", "comment": "Malware payload (Heodo)", "value": "2542fed9c21005a05f920b7feb1b219097507828", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647427510, "uuid": "a3704d30-ee69-43b6-b402-312852d52218", "comment": "Malware payload (Heodo)", "value": "a972fd29b2f7e929920b5be51360b45b0c20ba8634dcf06f5e370e330caa4bb95a796876ac60599bd693787c9f0773ca", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647427510, "uuid": "0849fd56-54c9-4c80-b95c-33e27bcc500c", "value": "T13DE2C02DF2A0EE1DC21EE939446895DA421DB4558502EB4FB95CFB1D2F0A5C23B1F0DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647427510, "uuid": "5a992948-a9e0-4592-851a-4e7850b2b69d", "value": "384:gjzZPFhNjqEBOA7iEibbwBLg0SCdiVXUKgUrNU/qWhZOdBNPJM+kqr9eCgh0k5lY:gjpFhNNlizXT28dFfPdkqstJmE6/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647427510, "uuid": "7212ea65-1775-4bb4-b57d-de40ce99cde1", "value": 33750, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647427510, "uuid": "58ca1782-e584-4d91-9c36-ec6fbbdf0a82", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647427510, "uuid": "55388999-2d07-4a9a-bd39-0f27bb32532a", "value": "N.717 FMC 16.03.2022.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d75a75c5-a541-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647446274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647446274, "uuid": "7072cf4a-6939-4ac2-8d1d-e20d1651a7e0", "comment": "Malware payload (Heodo)", "value": "0ac0b00350df24cf9e6c1fe6dbd841e8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647446274, "uuid": "7a58d21a-d971-410b-975a-d7a0d9971279", "comment": "Malware payload (Heodo)", "value": "cdf275926fe7edc2b115c73c9b06b7f85142f24946aae3d28e95771fe1419d07", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647446274, "uuid": "e9cd26e3-78a7-4a8b-ad02-9cb4ea6a1835", "comment": "Malware payload (Heodo)", "value": "74d4828797fe27f340dcb1b02394e7074c978f3d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647446274, "uuid": "530d203a-55bd-4610-a8d5-1bb9c73e4d4c", "comment": "Malware payload (Heodo)", "value": "1f546aa4ec327e5d47db81d4b9bf79e638a0f139e7e86a1301185582b4fbcbf2e87f1af5a518ad55dcd41f6e35fd9006", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647446274, "uuid": "fa1209ba-0822-4528-9084-cfaad2ea2537", "value": "T16AE47C12F461B2B9D04B04741F1723A86EEF5E518629CA13AFA8ED5E1F31251FC3FA16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647446274, "uuid": "187161bd-8242-44ab-8d08-fa4d1d384e58", "value": "066d4e2c6288c042d958ddc93cfa07f1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647446274, "uuid": "12453318-c7b7-4619-a5ba-e0ee704838b1", "value": "12288:DtAanana8Meee0GBGu3qI+3DNJ3vE6v5eYxS332d7t5hT/hexLx:Kanana8qGBGuoNxEWxCM7o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647446274, "uuid": "32189a3a-cd49-40db-97e2-64a897feac0d", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647446274, "uuid": "87fc0d7b-9b94-481d-bb5c-a9a109f14609", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647446274, "uuid": "fdee5c83-acfd-4bef-b443-c2606b1b8d98", "value": "0ac0b00350df24cf9e6c1fe6dbd841e8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd1a31ec-a4fd-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1647417024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417024, "uuid": "a79a438b-2d8e-487c-8cb7-3e10f3fa882a", "comment": "Malware payload (RedLineStealer)", "value": "a285e00759f13669538db1402595bf87", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417024, "uuid": "5c7a5ff6-18c4-4482-8b65-c9dec2b84a56", "comment": "Malware payload (RedLineStealer)", "value": "ce62636da4315bd029d24c0c7385cf7aacee861b2a460a88b6e2307fc1aedfd9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417024, "uuid": "41869a57-fc1d-4bcb-9b8b-22deaf89f244", "comment": "Malware payload (RedLineStealer)", "value": "6975eb197d186b14f2e8b1a57e7a36b217136f3d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647417024, "uuid": "ff45631a-5df7-49c7-bb6a-994dc58c38a4", "comment": "Malware payload (RedLineStealer)", "value": "a4b64bdc846d4927c229eee65ddf732a31c47e954e3038872ccc0f1e9f7f268f1c794732cd47eb977a7d0565d5cc3a37", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417024, "uuid": "eee8d183-f7dc-4e15-963d-558d0f0f6ecf", "value": "T189759E009FF8E62EF7BB87B47C71E21409367D8B8A20DA4F1938115F29D27C791526A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417024, "uuid": "87c4467a-b8ca-4f75-b57f-076dc987a302", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417024, "uuid": "8b2320c5-b95e-4b5f-85b3-f057f454e31d", "value": "49152:eWfXMEWERB7h5EPMcfXyFRORaI8AOOflta:NbsUS4RORa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647417024, "uuid": "e244582f-2ce4-45bd-bca0-65844b904094", "value": 1654272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647417024, "uuid": "613b43c6-2030-46a6-9e6e-710f5e7328fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647417024, "uuid": "00f85524-640f-4999-87be-cf83eebe4e41", "value": "MACHINE SPECIFICATIONS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc71fe57-a55f-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647459168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647459168, "uuid": "a1014634-4312-4080-a05e-13c94bb5be97", "comment": "Malware payload (Heodo)", "value": "59b4e18a6b0c7d378655b0f1db73badb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647459168, "uuid": "b3437be1-df93-4065-9244-97ce7823a7cc", "comment": "Malware payload (Heodo)", "value": "cee08bd9a6d70090c796d62ee94d399c767450c9f0d00c9e8405b43300ea6e50", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647459168, "uuid": "f0044753-ddc9-492b-98c8-4e47f1423789", "comment": "Malware payload (Heodo)", "value": "e5bf01aa559a656027842441028d6ba5915a95ee", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647459168, "uuid": "81cdf375-e727-4daf-a386-8992ba230627", "comment": "Malware payload (Heodo)", "value": "d3c589fa52344f9d970d3578b7ae4f50f0d988a2bac23a648a9493087426d07b49ccdfb706f02b8097b98a69e69819cf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647459168, "uuid": "8fa80edb-8522-4626-8749-e8a5e77a7d48", "value": "T19AF4CF11B2D1C076C1BF06741916A35D63F6FD608BB9878B6FD02FAE3EB45828A34356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647459168, "uuid": "888b0a89-5f5f-42f6-97ba-95990c3793e2", "value": "66a21a1bcb4077b3ed89c00ee693486b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647459168, "uuid": "d0e738fb-4491-4a60-8423-29fe31882ba7", "value": "12288:WZjb8BOPxue5dKV9M/98f0koPRXvkgKtuBdfMAofD:WCBAdKV9Xf0kK3KMBdkAofD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647459168, "uuid": "92293f0f-fdf2-4a7f-8ed0-086710fb6079", "value": 753664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647459168, "uuid": "c0a1047a-3b04-46fd-99fd-bed84fbfe000", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647459168, "uuid": "586206cb-ea80-489a-8cdc-d81b52bbfadb", "value": "59b4e18a6b0c7d378655b0f1db73badb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81337204-a53c-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1647443982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647443982, "uuid": "1fa61b7e-873a-4562-abcb-77053ea2b943", "comment": "Malware payload", "value": "2bbf15713c96f994a4a5ede6243ad889", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647443982, "uuid": "6426c038-fb5e-4b3d-8ed0-1ffdfd9a1df8", "comment": "Malware payload", "value": "cfcad7053bab82b508d7a397892af4953ce9d6f37affcaab139299d83817d5d6", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647443982, "uuid": "8fbe7da4-1d63-430c-b471-b4e2b50568dd", "comment": "Malware payload", "value": "875a59ea2f7c3255e8fd4e254fa5abda9a7eedb6", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647443982, "uuid": "357152f2-03d2-4185-8394-62f7a14aa254", "comment": "Malware payload", "value": "c80712e429d6d17142bc5c82ba553748f6db3ed628c1cc0a5cb472d3fd78ff0d138ff4dd7afc95b15a7c4f14cef4054d", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647443982, "uuid": "785d4b62-4eee-43db-83a8-39e922818e8d", "value": "T1A182D1B26D803F073DAA16C2A346505FAD791B2F32C5B9651EF2B338887D921850B847", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647443982, "uuid": "0ff152d4-7b03-45b1-ae22-fe02c349f336", "value": "384:ZG+SXUYDtCHlAgmXz2PuOa+BdRo9j4ftc+OS0njuX6UNq4UWyG8pg4gztHR0vZVC:JhPuOa+ZUOtc+OS0juKUg4UWJBz0vrC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647443982, "uuid": "c664c772-cbd4-4e3a-a261-b7e4be3bbae5", "value": 17955, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647443982, "uuid": "1a254992-3523-42c1-b2d8-735f5a2f99e5", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647443982, "uuid": "e03581cf-f66b-4c2b-8aec-dd0904888199", "value": "FTT Payment Advice.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "890672b3-a4bc-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647389020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647389020, "uuid": "69c876e4-b636-4ed2-8b9c-7ee3d3e25529", "comment": "Malware payload (Heodo)", "value": "4fb9fc21b873d19b82274bc8fc0fe839", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647389020, "uuid": "f64b9433-b528-4670-915f-8bce446cff6c", "comment": "Malware payload (Heodo)", "value": "d00a2cd7433df15fb44a19ada70a4d4c48ac01f9258b029fab1b0ed233c06046", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647389020, "uuid": "4c023d38-16ec-488d-87b8-fb3c734bb8d1", "comment": "Malware payload (Heodo)", "value": "24b039f506e3e215fcbced9d61e86d7e151d2cd3", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647389020, "uuid": "c74d2a75-1b7e-4dcb-9cdc-dba51d17e47a", "comment": "Malware payload (Heodo)", "value": "c381d439891600fc82baeb063dd1a795b1853c9d1ff9b1f356b9d18102bf1464dc8423054e8a266a2c4b0fdffaf721a7", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647389020, "uuid": "2b375163-6802-4843-9721-0955b526a804", "value": "T177E45B3071F74031C3AA1D3905D2DE64DAF5AD4B87B2F0D32F99AB4E99F5AC12B20616", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647389020, "uuid": "fac8a3ff-ae2a-4d47-99af-7d35d335ebd7", "value": "a38617efee413c2d5919637769ddb6a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647389020, "uuid": "2e7cdc52-25cf-4e3b-b0e1-4143d7cfc938", "value": "12288:E94YBCR2xP7guDo463OP4elsiSOZjb2woE+MhJT:2kRAguDogPRddb2woEBJT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647389020, "uuid": "ff28b522-ab3d-4a7a-96cd-07998ea5a245", "value": 684032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647389020, "uuid": "b67f2a52-3a4d-44e9-8135-68d3fbd5266f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647389020, "uuid": "466e2683-7536-48f2-9682-172c1d3a0a57", "value": "emotet_exe_e5_d00a2cd7433df15fb44a19ada70a4d4c48ac01f9258b029fab1b0ed233c06046_2022-03-16__000333.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87d947d9-a4bc-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1647389018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647389018, "uuid": "d4c7f362-846f-462c-88f2-af07b91f132c", "comment": "Malware payload (Heodo)", "value": "e08fda5d6ca6649cab4a158b003b901d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647389018, "uuid": "3a9a53f2-70b8-49f0-8acc-e62a07ce523a", "comment": "Malware payload (Heodo)", "value": "d0769073531d1ccfc36614e9d32a57c5cf3f74e5d55b04eb3c864f4e1c6251b7", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1647389018, "uuid": "7625869c-af81-4395-9a89-9b5b72744e11", "comment": "Malware payload (Heodo)", "value": "abb1dc9c7353a4097b96a4433c361c5adb7aafd3", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1647389018, "uuid": "adc06b4f-5490-436a-8c7d-87d6354a17b6", "comment": "Malware payload (Heodo)", "value": "3fc535d8e53fd6158cb5edb69f10e04aa3c37b8f27aad88a3b6877b73538c579c26352eef5f0ae5feb98cca8ccdf39cf", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1647389018, "uuid": "8c3755cd-1dd9-4943-a818-faeeb4211d74", "value": "T1D4E45B3071F74031C3AA1D3905D2DE64DAF5AD4B87B2F0D32F99AB4E99F5AC12B20616", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1647389018, "uuid": "5426ffb1-405d-43ca-93be-79c87398364f", "value": "a38617efee413c2d5919637769ddb6a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1647389018, "uuid": "71f99b53-fb36-4399-9060-bbef82db1df2", "value": "12288:E94YBCR2xP7guDo463OP4eesiSOZjb2woE+MhJT:2kRAguDogPCddb2woEBJT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1647389018, "uuid": "b048bf68-5a6a-4e18-96ac-0fad53448023", "value": 684032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1647389018, "uuid": "a60f8c21-070a-413c-b3b3-a61ab2a7a620", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1647389018, "uuid": "c620eed4-e93a-4b1f-98c6-626509d796e4", "value": "emotet_exe_e5_d0769073531d1ccfc36614e9d32a57c5cf3f74e5d55b04eb3c864f4e1c6251b7_2022-03-16__000332.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f3f9298-a50d-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1647423846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1647423846, "uuid": "8459a399-8b0f-4cc7-92bc-536e7f35fa8e", "comment": "Malware payload (Mirai)", "value": "cbacc4d24d472f86ea3ec05553ffa9e8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1647423846, "uuid": "dd77a0f2-01be-4cb9-a430-ca39