{ "Event": { "published": true, "date": "2022-01-21", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2022-01-21", "timestamp": 1642809782, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "8a75b069-eaa0-407a-a688-f26bff00be7f", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f7e68d6-7a88-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642748667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642748667, "uuid": "11741a2d-edae-434f-ac00-a974dc700227", "comment": "Malware payload (Mirai)", "value": "1780fa4bcc6aa107d0bbbc7bf00dfd0a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642748667, "uuid": "fb0a2d52-5f84-4063-8e3d-d4c0c2cedd2f", "comment": "Malware payload (Mirai)", "value": "0033a14ee6ebda0d95e4b9db23926c1fc0a201c8d51fa3beabd2409a3b5c5d97", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642748667, "uuid": "1cb5f7b8-8ec4-42a6-86a8-27802ded63a2", "comment": "Malware payload (Mirai)", "value": "9f8a838e4b0f42289cb04c047b4534f4d034e90f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642748667, "uuid": "3efcabcb-fbde-44d8-9560-2aaf115d1040", "comment": "Malware payload (Mirai)", "value": "814af88008132fd47ed7f0c2bf7c5ea631b00a1ea7d58434c03d3be82a8e7f7eeab024a517487072e83bb8b43fa4d344", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642748667, "uuid": "a1e9850a-2fb1-4699-b3ec-05a8da6d011e", "value": "T1B0734B13148098FDC45AC2706FBF923AF932F07D0234B69D2B94BE17AE4AD111B6E595", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642748667, "uuid": "73beb7f5-27e8-42db-818b-defee8218437", "value": "1536:9DbhNzyVTW72M0p6jI2n4ms0QpRm8yfjChkgUDQHQzeTBnk9:9RNzgoRY6jbn9sl48GChklQHQzeTBnk9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642748667, "uuid": "1b556991-85fb-4f3a-bfa7-2e3e6a6c145f", "value": 74656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642748667, "uuid": "e404b24d-ace8-4c37-b1de-a5e11d6262f7", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642748667, "uuid": "fce521b6-fc1e-42fd-beb6-53284ee9dc02", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b84d5c19-7a97-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642755259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642755259, "uuid": "15d922dd-ba01-40b7-8ad7-3e85d9f31e96", "comment": "Malware payload (Mirai)", "value": "28309840c17a1d398f9150ae258b5cdd", "object_relation": "md5", "Tag": [ { "name": "CVE-2021-44228", "colour": "#92C2C1", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642755259, "uuid": "3535a77d-1227-4ed4-9901-e4a248a74d38", "comment": "Malware payload (Mirai)", "value": "00787cc45e636b3f2e0cbb32dcf2b497af9d37498a9a627627c320a144b13d3d", "object_relation": "sha256", "Tag": [ { "name": "CVE-2021-44228", "colour": "#92C2C1", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642755259, "uuid": "f82aa0d4-e648-42de-929e-25339f479ea5", "comment": "Malware payload (Mirai)", "value": "893f297840c0ea17faac5ffe634b53da647cc4f3", "object_relation": "sha1", "Tag": [ { "name": "CVE-2021-44228", "colour": "#92C2C1", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642755259, "uuid": "6994118a-9a8b-41d1-b5e5-52614917b9bb", "comment": "Malware payload (Mirai)", "value": "6210776d10b2ecb5f2dad0443eaaafc1bdc9ba718aad0cc42b5f96f52bdb6b4749e03bf93840becafb88a76ede9a1fd0", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2021-44228", "colour": "#92C2C1", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642755259, "uuid": "19c16f7c-2f11-417f-8503-02a3a9b6c5ed", "value": "T141134CC4E543EAF5EC1502B43037EF365F76F03A602ED9C7C39995236892642E9472AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642755259, "uuid": "20e98bc0-bd35-47c1-9187-3b82745b7ff7", "value": "768:Ms1yfBjf74x6DhdZMddQmJTy5G8q5gYEu0plod4M4K+Rnb:py5jf74x6DB8mmJTy8gY4plodX4K+1b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642755259, "uuid": "5b52a415-ecba-4f9f-8f26-10d3a4de621a", "value": 41744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642755259, "uuid": "7b7946ce-6301-4be3-95a7-85e0a85f52e6", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642755259, "uuid": "2373cfd6-d668-42b2-870e-0b01b97aa195", "value": "Josho.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eda27204-7b12-11ec-9275-42010a9c0029", "comment": "Malware payload (Vjw0rm)", "timestamp": 1642808176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642808176, "uuid": "918afcd8-74d4-4c18-88cd-96c569908671", "comment": "Malware payload (Vjw0rm)", "value": "93ede5d435cb9b8f16263bbafab6a449", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642808176, "uuid": "edb811e9-095a-4882-9737-2e89949cb9ed", "comment": "Malware payload (Vjw0rm)", "value": "007ee67c4bec255a19ab2b6fa0f159e9d9636c74dde34f9ddbf3b45ced74cebe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642808176, "uuid": "9931dff5-64ee-42d4-bf77-2ca06e188e1c", "comment": "Malware payload (Vjw0rm)", "value": "c5392f8e367924c2dacb646c6e3c1ea393b317a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642808176, "uuid": "c10a5e7d-99ff-467b-9e13-749fa8a3f89f", "comment": "Malware payload (Vjw0rm)", "value": "79bd334551da7ae3213cb59df9fc80b32697dc777fb3d581812d31f879c030f88e50b8197deeb3c5be3530114f1d6100", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642808176, "uuid": "4a8b6472-f083-4dfe-9da3-fb3badae4f60", "value": "T19F06AE0163E3C1E9CE179172D8A4C232DA71FC1E9724A9DB26D08D5EFF12EE21579782", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642808176, "uuid": "2fd433af-d135-46a1-9b79-0ead3c7a5c00", "value": "46978de0f8944a65af1673d613222a98", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642808176, "uuid": "e4bce35b-f4b9-457a-9d63-9243dc278c38", "value": "49152:5UsrC6aEeWfmde0IfNxS3/tb8e8SX9cC31cHFMakecJMGklhqvFXjjxYDUvc0:BC6faFb8atcH6akeR0hjjKUvc0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642808176, "uuid": "247d858a-68d6-4feb-8009-c3ef55f9db1d", "value": 3747328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642808176, "uuid": "83fb324e-fd2b-4072-b2f4-70f66389a701", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642808176, "uuid": "bd67d336-342d-48f0-bd7f-849d61772173", "value": "007EE67C4BEC255A19AB2B6FA0F159E9D9636C74DDE34.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b67db096-7ac5-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1642775013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775013, "uuid": "ccd84269-c39e-4f6c-bd26-6c9cbfff728b", "comment": "Malware payload (RedLineStealer)", "value": "37f7c276b3afec9c7279c968f518b68c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775013, "uuid": "a797b73f-73dc-494a-a195-f5427cbc3111", "comment": "Malware payload (RedLineStealer)", "value": "0182f2fafdac8b9fa879e6a64279b752b0fcd17dfd427748809152fd623ab4ca", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775013, "uuid": "4ed2869b-4ed2-4b83-82c7-ae1a54834fe7", "comment": "Malware payload (RedLineStealer)", "value": "23b00e90f63a0db6fff503e21b6a39c07cb78d88", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775013, "uuid": "3f99582f-7cc1-4490-b565-d9853070249c", "comment": "Malware payload (RedLineStealer)", "value": "8079f047c1e354f2efaa4d365ed2860fc99229eb872ed31dec32188d21df22bca1a55ac7d2dfc75df537066429494816", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775013, "uuid": "95ae8d93-834f-4de2-855c-74871cb692c7", "value": "T141C63331E866CCB2D97510391661F66268AFBE302F24874E479CB56854F3382DBC8F67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775013, "uuid": "1effc2a8-b491-40b1-a7c0-a5046d58c6c9", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775013, "uuid": "c7d0d429-837e-4c41-83cf-9af4e77b0e36", "value": "196608:SCgqAb2MvgDnqrA327fRAJlnSEmuks52h8JOwpfg+S4Ux9VUFgpO99P:SC1Ab26gDqtR8NAurEYOQ42qeFgM9P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642775013, "uuid": "f1c4d20c-8135-4c7f-baa6-e8968bca5b2e", "value": 12588224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642775013, "uuid": "0202dc66-ef3c-4a02-a401-a7c6e434be9a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775013, "uuid": "482308e0-c5de-4c42-a727-2bdce53b3fde", "value": "37f7c276b3afec9c7279c968f518b68c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8668950-7aec-11ec-9275-42010a9c0029", "comment": "Malware payload (Smoke Loader)", "timestamp": 1642791766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642791766, "uuid": "53a33091-5d88-4aeb-9520-56a4cfe8cf91", "comment": "Malware payload (Smoke Loader)", "value": "287c28e82db95aeb863ed4ecbd96350a", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642791766, "uuid": "e20a756b-96d2-441c-9a2e-ac7e40aec2cc", "comment": "Malware payload (Smoke Loader)", "value": "01b6b3c657834f95e7aa06fd5e16c1208c1e9af8b15aecd918a42594090ed410", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642791766, "uuid": "46d0466c-9308-48de-b797-6ba3d92e266a", "comment": "Malware payload (Smoke Loader)", "value": "a63267a4df30131cee6a375ded6cf4398cbc1a14", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642791766, "uuid": "86b7d9c7-80b4-4b14-8693-41c33b46ba7c", "comment": "Malware payload (Smoke Loader)", "value": "8ce1c6a6b2f6ca414964156a02a104cf721b8952a166cf14f9d3659234bf32aaff42d18d1dca0ebfcbf32fb30f59ade0", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642791766, "uuid": "aebee953-b27b-4179-88e3-cc2c2a4a9ed8", "value": "T1F3647C00ABA0C035F6B711F44A7A97BCB53E7BB16B2451CB52D52AEE5A346E0DC3131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642791766, "uuid": "d678659c-ccb0-4310-b323-afadd3cfe6fb", "value": "9da0e72ef0ce0c441e86840001cd2ef5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642791766, "uuid": "4d27c1b1-ceb4-4db5-9f02-17e13510f12f", "value": "6144:3Xf1o4eCqJjagCkyog3fadfe5btDb4kdDJpcId:3XdEJt7CkTg3yI7DbPddp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642791766, "uuid": "9078b32c-9233-45da-b474-bed0ad26130d", "value": 335872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642791766, "uuid": "59d2148f-9700-4b77-977d-00f6d04c09a5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642791766, "uuid": "cd68dee6-5bf6-46b5-99bc-90936bab882a", "value": "287c28e82db95aeb863ed4ecbd96350a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b4c6834-7a92-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1642752928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642752928, "uuid": "00f6fb22-a062-4cf8-bf00-ff5db698e763", "comment": "Malware payload (AgentTesla)", "value": "f2e9aa3d522a3b686342a5a77491439c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642752928, "uuid": "0a44d236-b4e6-4391-9650-48dceb18d597", "comment": "Malware payload (AgentTesla)", "value": "025284221fc921e25dffb77825e526c94205372dea931233dc6d5ce8ce35c462", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642752928, "uuid": "9bbae772-6424-4991-b8b5-5ec387deb09f", "comment": "Malware payload (AgentTesla)", "value": "3a9b3610121e5709b29fb9d9e7f6bae431c67334", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642752928, "uuid": "a8e26807-dd14-4e53-98de-a36c9bfc2bd8", "comment": "Malware payload (AgentTesla)", "value": "38da8a65e48fa90886741b90c11987ba753664f3e2168a42603f25a3840abd47468aeb5b28ae61b31620717b381cb10f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642752928, "uuid": "9e399f2d-60e0-442f-bdef-fa64a8742b96", "value": "T106F4CF8076A58641DC7E8BF14435C4B0077A7D1AA8B4E21EAECA7DEF3DB3B419611723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642752928, "uuid": "c7aaae98-608c-4d77-af66-af46f81bef9d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642752928, "uuid": "c84b6584-0554-4697-8676-bdd884f1057f", "value": "24576:RpQKnf+2S9bvv48CZz7LqmV3v6+ievYFP:Rpz3StveZznqmg+itF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642752928, "uuid": "91c4934d-0083-42e8-a659-ad07c7e993ea", "value": 794624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642752928, "uuid": "6465cdd8-1b51-46d4-888c-f76e72cd86ec", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642752928, "uuid": "931ed59e-3828-4c4e-b435-da058756f96f", "value": "Purchase Order .exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "435af9d9-7a61-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642731870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642731870, "uuid": "9673afb8-7fcc-4446-9063-4af689edee23", "comment": "Malware payload (Mirai)", "value": "ad5b47053c4cc1bcf48a5d2f4320059a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642731870, "uuid": "9f239393-a598-42b8-9501-40e91e8b9546", "comment": "Malware payload (Mirai)", "value": "02db689afa81881b8c2e297e1f6fdc252d282761c1be49b8aa86ad1ddde90668", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642731870, "uuid": "bab4aa94-26ce-40e1-a397-94103410af14", "comment": "Malware payload (Mirai)", "value": "fd1b7e40e60132757707c9eaee5a90f0ad868ebb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642731870, "uuid": "c4bcce84-3415-4321-8417-d6c8581ceb9b", "comment": "Malware payload (Mirai)", "value": "311963c9db6830280ddf3998bd267a404e5961900fe4a41ab8f4d0c2e29117461944507245ce1aa299a6ed8352cc4301", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642731870, "uuid": "debc5c76-f7da-49ab-af6a-8186e0403e85", "value": "T16F23E8C27942B639C3D06777EEAF014E3355A7DCD1DA339388281B947A8A90F0D67B46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642731870, "uuid": "c568d10d-859d-432e-86e7-7040d2a9e7ad", "value": "768:UND8/ml/OGkX9NRFp21XnP81Kmjkz4lx3MOprJM5W7k7wCVy/rCxHghW1/Kw/tH6:U8mwZX9pDXMOJG5mfhWC5V64", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642731870, "uuid": "35aff71d-5481-4d85-bcd3-c827a93537aa", "value": 49184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642731870, "uuid": "9ca932f7-d6bd-49c7-af99-868b1cb50020", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642731870, "uuid": "4d424b03-8bf5-4528-9ab5-504d7a06a892", "value": "ad5b47053c4cc1bcf48a5d2f4320059a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8566310-7abc-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1642771177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642771177, "uuid": "760e81de-b8f4-4963-9a87-270643bfc179", "comment": "Malware payload (AgentTesla)", "value": "764e02573697c8ac988af2cdd7a51961", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642771177, "uuid": "8a363a85-a5ab-47b5-85e6-759f3abda64b", "comment": "Malware payload (AgentTesla)", "value": "03ef94b0497ed750d000a75a8295aa3d055906eeb8b929b482cbacc5f12ca5f5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642771177, "uuid": "e89f4e28-2c47-442c-9e38-3f7123d58de6", "comment": "Malware payload (AgentTesla)", "value": "10951f48beb3f883a31caadd8e9fac8cf7934b79", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642771177, "uuid": "9896e917-37c4-4d50-845c-78a141971a82", "comment": "Malware payload (AgentTesla)", "value": "b240184fdea591f06b09c2080d02dd9cc90769c6e87bdec013e5cc9c81ae6f7baca268f5935f61b2f2579e2b41495af0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642771177, "uuid": "50455cae-b54c-42de-ab33-fb3eb7b327d2", "value": "T1DEF4E04132F88F05D87E87FB48754090177ABE0AA864E71F6ED1B2EF0D71B819A26353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642771177, "uuid": "31806ec7-5d3b-44c4-862e-1eec7083afc1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642771177, "uuid": "89a652f2-ca54-44a1-bdb2-95d0b9f10e20", "value": "12288:Z7uXobh1VstcBR4OPU2q/umPcvJlf1MT1sq9jYR1pQcq6+ievYF:h1VkcYr/um0xltMTVFYR1pQH6+ievYF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642771177, "uuid": "52ba6c71-6202-4ff1-9e00-b1196d085a16", "value": 729088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642771177, "uuid": "4864ed8b-6598-47c0-a35b-048d822b297f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642771177, "uuid": "7da997ac-569f-414d-984f-68f5d088893d", "value": "AWB# 102235516763.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a5e8ca8-7a60-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1642731398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642731398, "uuid": "dcc3e927-92b5-43bb-9b3e-f4a20d432e21", "comment": "Malware payload (AgentTesla)", "value": "7ca2e5a2e084c524976eaafc655d6338", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642731398, "uuid": "09f3efaa-5f8f-4e6e-97fd-59b176a72227", "comment": "Malware payload (AgentTesla)", "value": "040240ddbb154907ded6e0cb43b04e393764bb24f593ab7fbcf67f2792bc86e6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642731398, "uuid": "316c2196-05b8-4319-9275-1914faf5b85f", "comment": "Malware payload (AgentTesla)", "value": "a7123dd6a0941f043cc851fcbca00087c24ac679", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642731398, "uuid": "2c857906-c3dc-41b6-85a3-3921e98c0e4f", "comment": "Malware payload (AgentTesla)", "value": "0a3901da8cf8b3423d30ebe9337e3b9929e9c27cff2ec55ef688a4700ea8d7d3cd2f9d71642531b2d05821d20a4725d9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642731398, "uuid": "57a0aa11-6b95-4a62-b55e-e3664e83b402", "value": "T1C635BF7261095FD9F13FD336832275269BF25A1BEB25E1AE3D8464E70880F4B8367D12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642731398, "uuid": "63759e78-fd1b-40d2-822f-abe0391f8903", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642731398, "uuid": "8e012367-e0a0-44b9-a225-a2fb17e250ba", "value": "24576:/5ljA3sggFNfZ7PBt0b6WUF1gekgwM0N/:E8ggFpNPBt01UFq+90N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642731398, "uuid": "c646660a-1aed-4731-a09a-0727c3072cc3", "value": 1132544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642731398, "uuid": "9c75795d-457d-4370-8319-02a899fc1a3f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642731398, "uuid": "103064ca-7474-4fc6-b814-0cf274e47ac2", "value": "shipping documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03153b4b-7a71-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1642738634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642738634, "uuid": "243c90e3-f84d-49c7-b5aa-f7e8c6970431", "comment": "Malware payload (AgentTesla)", "value": "74ccb6dbe5eaf8d7d49b16bc3adbf9d0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642738634, "uuid": "7d63d867-83b3-4d28-a24b-0e9d3709e8cb", "comment": "Malware payload (AgentTesla)", "value": "0476e40087a7f7bc64e3bfd2f008fa8ae7293cf2ca5515fb3d98d1b732cbc8cf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642738634, "uuid": "e7294e70-8029-4ef9-b993-c352642b41db", "comment": "Malware payload (AgentTesla)", "value": "817408133e1f2cbc1e7adfb611e3a7879c6f9b1f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642738634, "uuid": "198ba595-a1dd-4ca4-baa8-bbc481c3b258", "comment": "Malware payload (AgentTesla)", "value": "cdc3d20a2a35b9f61e67e4959dbee69e01fcb2bda0ea40d732ede2f0de128e8068c30b1d62b1b809d8af203f4e4f66a1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642738634, "uuid": "db2f36d1-f6a2-49d0-9d44-971d41bac877", "value": "T141E4E00179288E43CC7C04F9445245D42BBADA1BA81DDBCBAED17AEE56F27834E1325F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642738634, "uuid": "8f5f5afd-e2f6-40e3-a0e3-5a94397acf06", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642738634, "uuid": "ef024f10-3a28-48af-a5fe-c42dd333f6c0", "value": "12288:4tO0bpQsnhHnglxAQCl4YTYG9xWFplcu3Q422nGUCXJq6+ievYFltW85:wpQsnhHnSAPpYwcz3QsnOA6+ievYFfW8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642738634, "uuid": "f4808f27-3431-45ff-9593-39ea5653ebc8", "value": 706560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642738634, "uuid": "a31697b3-c7ee-4f4c-81cb-0e6bb8bc1df6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642738634, "uuid": "6a4b9ce5-2dfe-47cb-94cb-edd460e1a657", "value": "QUOTE 002242020.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cf2dd26-7ac8-11ec-9275-42010a9c0029", "comment": "Malware payload (NanoCore)", "timestamp": 1642776097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642776097, "uuid": "f22a75e7-c3d7-4562-9fd9-1388375ef3b6", "comment": "Malware payload (NanoCore)", "value": "bcd0e154abbf8d56286d31f4f6708787", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642776097, "uuid": "5a942993-700e-46b3-87b2-d0d2eae6ca20", "comment": "Malware payload (NanoCore)", "value": "05c90630b0ffbe6a2a54c4b79663e9f04eba842717a30e58afb1a8c428e8fbdd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642776097, "uuid": "685d163f-52c5-4531-ba91-f7a87808dd39", "comment": "Malware payload (NanoCore)", "value": "a063d9993b8c3bfd02761018d15d8d277bff1f45", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642776097, "uuid": "fb71e90c-b220-48b7-ba84-e61b255a0918", "comment": "Malware payload (NanoCore)", "value": "8bf116bdca70bdc15b3762490fe79c9b093a0b2082d87045231c3b3dba8d924849c75c3493c6e6a74a19bb4e3a5bacbd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642776097, "uuid": "c3182c09-b7e8-4184-9351-0be807840075", "value": "T14E55DF7261455F99F53FE335832275268BF69A1BE725E29F3D8024EB0880F4B8367D12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642776097, "uuid": "17d5dafb-258a-454f-bddd-0c4277e289b8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642776097, "uuid": "e9f287cc-41df-48c1-8302-6edc150347e0", "value": "24576:TeZ6jAfsy8mOkZoj+msbML8FL117nq5nUIlUF1gekgw00/0:4EDk8sbMIDq5pUFq+d0/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642776097, "uuid": "707a2366-917b-4c02-88b1-322ca2539c18", "value": 1364480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642776097, "uuid": "e7fd5b86-fde2-4ee1-882e-97dc6c39b566", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642776097, "uuid": "3af9b5e8-dd5b-4aa6-81ca-742ecf2a6163", "value": "bcd0e154abbf8d56286d31f4f6708787.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3c70073-7a8d-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642751037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642751037, "uuid": "5f57e98c-06aa-4490-ab84-dc53ceb494cd", "comment": "Malware payload (Mirai)", "value": "9baf33eb341f319f2f8db23652185cf2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642751037, "uuid": "881fe6e2-4085-442b-a310-19378762e621", "comment": "Malware payload (Mirai)", "value": "06e603b9920de767b23d8c7c45b9d892f779dbe16596f62d994c77f0934196b4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642751037, "uuid": "bd5a4f6a-8a8c-44cd-9a6f-fab169febca5", "comment": "Malware payload (Mirai)", "value": "60ff834b69873aae15b76b29b3b4840196edd358", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642751037, "uuid": "81f955b8-e462-4489-9d97-77ef60d401fe", "comment": "Malware payload (Mirai)", "value": "1c648dcf6a07b3c45b323a637ddbfae278817e112b8215e6432875911fb3eb2a847ff90c09bc6058a5b6c2f3d1429273", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642751037, "uuid": "a77b5ecf-3f6f-4754-9e09-0ad3576f5ba4", "value": "T187732901F709094BD1F35EB07A3B27E5C3E6AE8220B06249795EFB899671D33514AECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642751037, "uuid": "d8f443b3-09d5-4724-be51-eaada00ed460", "value": "1536:e3OJxqMMqtWrhWjoH73z8zloqdaUrhImj0WJ3Ogolfay2w1LL49QS/7PvUGFHGby:LJxqMMEWFWkH/8NfIGtolOzUbxXM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642751037, "uuid": "984d3ce0-4dfb-46f1-af66-da771ef021fa", "value": 78744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642751037, "uuid": "bf2721d1-acde-4a84-ba36-db28b08baa09", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642751037, "uuid": "6d178ed6-0a4b-45de-90b0-f85dcc874e10", "value": "9baf33eb341f319f2f8db23652185cf2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16fb3048-7b04-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642801803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642801803, "uuid": "d8d62937-c06c-4341-90e9-571f60ed687c", "comment": "Malware payload (Mirai)", "value": "36faf8fc4526b74ff8d0c54e5887f04f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642801803, "uuid": "9f786f19-bceb-4dc4-aa77-57020b7202de", "comment": "Malware payload (Mirai)", "value": "07f92ce337623b4246f3220e46d9f4a9e7912ef1e98b78134e97fdd10b73ebdf", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642801803, "uuid": "7f5e4231-77de-4b6c-ab2b-31111352d205", "comment": "Malware payload (Mirai)", "value": "7a4679ac7717fc77a5343795e35dbfd076d8923e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642801803, "uuid": "a91d4821-6e56-4e59-8656-23140d15b0e0", "comment": "Malware payload (Mirai)", "value": "49457ed7080f0e75cf17c05a3a686583f762232db0fedb0de81c1186d1ef61d2e1cf450c68fbe3aabcb3acc5eb8f27a1", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642801803, "uuid": "48e2509d-eccd-4765-b1ae-2489fe5137bb", "value": "T18D33F152A2721F72ACB8C877F5B400466A998B7C60CBF6738248DADC4562B4BF05E4D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642801803, "uuid": "9ab42ed3-9762-4d54-85c4-9834b7f8120d", "value": "1536:5OIlMtSFSIhqUXKpdhi41Hf/ZVNLv8WHE:5OmMoBlapbief/ZTLFE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642801803, "uuid": "b7eacbb9-a598-4334-95cf-260d2187ba61", "value": 53636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642801803, "uuid": "1b3caf4d-7513-47b0-8d17-359ce9714d19", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642801803, "uuid": "9754306e-f719-445d-a789-7eeb97a72a98", "value": "z3hir.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1883b98c-7a7e-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642744253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642744253, "uuid": "79722e65-468a-47b0-8119-c1052cd54d72", "comment": "Malware payload", "value": "8d74fe8561b351daf49756e831fd4372", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642744253, "uuid": "0d4b35b8-f019-454e-ad72-86eb530c641a", "comment": "Malware payload", "value": "08ebc3dce718d45574a91cb983f42b8410f8fba06ab112a5bcb8fa1a7d826e25", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642744253, "uuid": "1ba3a524-9e99-4d19-8ef3-5c9ce50c7bee", "comment": "Malware payload", "value": "eed4557952e4403b7b57492304e377d8b62c2b12", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642744253, "uuid": "cb46f866-48b1-4264-816c-29f64556b31f", "comment": "Malware payload", "value": "c9608ccce0304b350c6247c6fb0c8af20e5289fc6c36f15728b6d76ea071cb38ba5aa1cbfb92fe524800d19e2b3fa2f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642744253, "uuid": "bcc4e3dc-3257-43ef-a4d8-c44d19b8b640", "value": "T10D87333737764351E094083A94BB2E5532F2635A9147FCB9FAC7ACC114A2CB6B707A93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642744253, "uuid": "71090765-198d-474b-8b6f-6518417e258d", "value": "9e2b9640b4fec119d8c87d3f7fe5ee35", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642744253, "uuid": "105a230d-7934-41d2-b7be-e5eefcf48b8d", "value": "786432:vTJUL6PAGu59ZqzfE6VhxG2UHJwylgenm2UrpFqu6gQB9x8O:vTKLkAGu30zFVmBH0MUrpFqu6LBY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642744253, "uuid": "147e6f45-338e-42b7-8be4-1003a512ed48", "value": 38731776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642744253, "uuid": "caedae02-033a-43d8-a13a-59adb6564cff", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642744253, "uuid": "54d14fa5-a773-4c6f-bf44-bc40d6f4bd13", "value": "7.1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9bd780c-7ad5-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642781890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642781890, "uuid": "8d7dfc83-7de3-4f63-a988-f382404343e5", "comment": "Malware payload (Mirai)", "value": "225641dcfb4383e27eeb571ae9b05bc5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642781890, "uuid": "4f14c83e-566e-40d4-9889-7627ddd66d1e", "comment": "Malware payload (Mirai)", "value": "0978503c4c3c78ee0ccd255f63bc8967615033f2900a1277f9b0529fce09d066", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642781890, "uuid": "a293e1aa-0ca5-4abe-ab48-448ba847b234", "comment": "Malware payload (Mirai)", "value": "d7d89f6c28e77a0c15fb863bec7a72f8cee0d136", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642781890, "uuid": "eba842ec-32be-4c67-a60a-266ea92ae6ce", "comment": "Malware payload (Mirai)", "value": "13ca283353e64411249b339931d939d2551aee4fbffd8b5c7395d772ec5dc1dc9bbbfc9defc9d7a949e08c8ecf6e4c35", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642781890, "uuid": "7ef39da1-1150-47bd-a134-dd1b5b6e0ef4", "value": "T13C534B9AF4018E3CFA4BA67E54160D0AB971B39152934F2772A7FDC3ACF30697A02D51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642781890, "uuid": "c3c5495a-c450-44ac-b85c-49554d020cce", "value": "1536:LE2dKd40y5tgq28qOPgN8l8MsINprfm7uCciPY:I2JqCg6um+iLiPY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642781890, "uuid": "2d5abd35-862b-4dec-b471-2befadb1f0b0", "value": 61216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642781890, "uuid": "ef5b03dd-5d89-4497-8ff2-ed3f05bc5044", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642781890, "uuid": "a20acc20-da84-48c1-aaf3-9cf806a0de37", "value": "225641dcfb4383e27eeb571ae9b05bc5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcbad512-7ac7-11ec-9275-42010a9c0029", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1642775936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775936, "uuid": "9f3e0c15-e0f8-496f-9910-84003bf4766c", "comment": "Malware payload (AveMariaRAT)", "value": "a678c81ba92219479e552dfa20c65e7e", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775936, "uuid": "f7a8b922-67e9-4dc6-a0bc-cd99e7aa1f12", "comment": "Malware payload (AveMariaRAT)", "value": "099fa3444025b497e2869f004b68218ea9ee63852d671d84fddeb4a1d2c6f6cf", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775936, "uuid": "9ddaafcf-b33a-4025-95b3-178c39231644", "comment": "Malware payload (AveMariaRAT)", "value": "ada315a92aad67296920ffc206ad90ee51e6eb26", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775936, "uuid": "fc067754-f4f6-4d1d-9e9e-4b919abebbe2", "comment": "Malware payload (AveMariaRAT)", "value": "de5fe49bc142a393d85150ac877e15b7ff6f2ae9c81de89a20cf34d72301f2a99da70316ace382d6ddc85e72809cddea", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775936, "uuid": "68fbdd72-4451-455e-a709-bdd339a14bde", "value": "T1D8D4CF4037F88B05D57E87FA4831009017BAB95AA875E35F6DD1B2DF0CB2B819B26763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775936, "uuid": "feb1cd71-380c-49d1-8919-18d41c6e1cb3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775936, "uuid": "64a58c53-5ee2-4502-915a-a829d47f6d40", "value": "12288:KmJIaOT2ifSPFGsT3Mwmdy6hpQcq6+ievYF:676HkpQH6+ievYF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642775936, "uuid": "32465812-3d57-4281-900d-be799e86d55e", "value": 598016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642775936, "uuid": "e68bd772-735c-4cdd-96bb-2790a7bf7e7c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775936, "uuid": "e091b26c-0dba-4598-9b48-8a390b664de9", "value": "a678c81ba92219479e552dfa20c65e7e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad5b2cea-7ad1-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1642780151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642780151, "uuid": "8fca64b5-d32b-4698-8a83-e5e1e774991a", "comment": "Malware payload (AgentTesla)", "value": "ae9d84ea2d858afa1adcafdbf477e194", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642780151, "uuid": "207b515d-3853-47e7-8301-ff98ca7ae4d1", "comment": "Malware payload (AgentTesla)", "value": "0c8be37321106941aa64fdf740537059ba94eb96c8a9a8cb4a9829f15b1c9b25", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642780151, "uuid": "1a6265ca-2fd7-4131-b8de-39e050a759b6", "comment": "Malware payload (AgentTesla)", "value": "a5bd0876612289b25f315446f483155687bf60d1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642780151, "uuid": "27f6b558-e18c-4d4a-97c9-9da6d8585e8a", "comment": "Malware payload (AgentTesla)", "value": "470a145daa765759c90d0b83b84bba9c2d2fd0ed512a194a6bf496e288724ca6069a2988a0d1ea3a78702842432ad235", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642780151, "uuid": "8166cb7b-878a-435e-b096-13fd6b92e1e0", "value": "T1C2F4D04132F88B45D8BE87F648714090177EBE0AA839E75E6DD1B1EF0DB2B819B16353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642780151, "uuid": "99dac8e2-5f69-4670-9cb2-b6ef2ec5335d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642780151, "uuid": "0a4ab701-9e21-4a75-8802-b3656c108ea6", "value": "12288:VP9AmpQRmVDON4+XciPfb3MUdZuvXWdwI3q6+ievYF:RpQR2acefb3MUoX8wIa6+ievYF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642780151, "uuid": "1427da31-611b-4875-b240-5a71bc93a1fb", "value": 724992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642780151, "uuid": "9daa7c3f-2a13-436d-b57e-a69681157dd9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642780151, "uuid": "fb000cee-d32a-48e8-9dda-c57a240a33e6", "value": "0oTAEvUBAWV89aO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cacb23fa-7a6b-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642736392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642736392, "uuid": "c094e5d0-c5ef-4c01-8c36-21c578b4bf0b", "comment": "Malware payload", "value": "5f57958037ac397a886eb68996a75985", "object_relation": "md5", "Tag": [ { "name": "mansengco778-ddns-net", "colour": "#8B7EA6", "exportable": true, "hide_tag": false }, { "name": "pw WT2lH6ZAAx8eKUZ", "colour": "#222F9C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642736392, "uuid": "2e44b1f2-797a-497c-84cc-4d8f10f5fddc", "comment": "Malware payload", "value": "0d81906667414a073ca423e2d59c19d2b91d4266d84876d5891ba2bbfcae9021", "object_relation": "sha256", "Tag": [ { "name": "mansengco778-ddns-net", "colour": "#8B7EA6", "exportable": true, "hide_tag": false }, { "name": "pw WT2lH6ZAAx8eKUZ", "colour": "#222F9C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642736392, "uuid": "51144f9d-b065-490a-9e3f-4f8c76b04be5", "comment": "Malware payload", "value": "b80293335e36710200796b2f33f91c385e8bf0c0", "object_relation": "sha1", "Tag": [ { "name": "mansengco778-ddns-net", "colour": "#8B7EA6", "exportable": true, "hide_tag": false }, { "name": "pw WT2lH6ZAAx8eKUZ", "colour": "#222F9C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642736392, "uuid": "5085de2a-4c8e-4d92-b2be-a324e80688e8", "comment": "Malware payload", "value": "0c323c4a55abd36b01bb07398512749ef2e4beb58733263f1e760a0487c204b9f1fd79ea96a8cf85833f984d01968886", "object_relation": "sha3-384", "Tag": [ { "name": "mansengco778-ddns-net", "colour": "#8B7EA6", "exportable": true, "hide_tag": false }, { "name": "pw WT2lH6ZAAx8eKUZ", "colour": "#222F9C", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642736392, "uuid": "faead7c9-0750-404c-bd01-b621b81b8bca", "value": "T18BD4236557F6CE17CB32DBB7FF9A3EA88925FD3B8162340008438B51950FBA64467C92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642736392, "uuid": "1aadc09e-1355-48a8-b582-61ffe4349ce4", "value": "12288:RWO+XjGgmr4sj530/na0QWLmPWLXLy8W94AWjLjalZl9wD0U4qzjx+oq6T:RWLjGtr4c5kfa0/CWL7y8W9MuZ7wDd4+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642736392, "uuid": "0f5887f6-4785-4d00-9a0a-95a3a81b66f2", "value": 601726, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642736392, "uuid": "9d7bbc82-2375-4bfd-a9a8-0845e6774013", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642736392, "uuid": "3ba04095-301e-4907-8662-e503fc3f9ac7", "value": "BL-98765.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c0b684f-7b00-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642800255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642800255, "uuid": "a95fc472-3602-4eaf-9020-faa4ad26cf10", "comment": "Malware payload", "value": "bf1d2419bda6068e37f85d3f8ed4eee0", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642800255, "uuid": "994a8e2b-49d1-4b2c-8cf0-4929853dbda8", "comment": "Malware payload", "value": "0d8fd18da3cd6590f94cd2d23948427748b6ff51a0807e1e09ba59b78ab57662", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642800255, "uuid": "282525e6-4db5-4604-9a8b-b325ee2d6d6d", "comment": "Malware payload", "value": "5ced3c65e1888499ab50c3eaef225255c1cc91c2", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642800255, "uuid": "56504702-8570-4b73-8207-6576633e1921", "comment": "Malware payload", "value": "17dfaa6b658914a6b08d1ac9847838e853e70ccb18cdc4a7c9973e94aed37c45e1170e6e2fe6bbf6f0160a844d0c7d02", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642800255, "uuid": "c6b77a3a-086e-4448-973c-bba3af99276a", "value": "T1D9A3B0527BC6CA59EA4547710DBB024AA723FC105B7A63473285F3783FB89E08D13A1B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642800255, "uuid": "1bec3c9b-01e2-4609-8f9b-6df41cd07d6a", "value": "3072:n/k3hbdlylKsgqopeJBWhZFGkE+cL2NdAFxe53lGvFTQ3IzxgdrvxpU0OKvMB:/k3hbdlylKsgqopeJBWhZFVE+W2NdAOK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642800255, "uuid": "51e32702-981e-4086-a71a-0ba8390b456d", "value": 103997, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642800255, "uuid": "34b76f9f-e2d0-488a-8638-890608aa79bf", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642800255, "uuid": "543fcdad-8a87-4a63-ac99-0250d2073208", "value": "check.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea299eaf-7ac5-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1642775099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775099, "uuid": "36c18ed1-0d09-4988-bf83-4a37ce74a706", "comment": "Malware payload (Formbook)", "value": "1ee4be1fe4a7474832003016c12b652a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775099, "uuid": "c3f3e9d1-121d-4827-b3c5-80724bed4b14", "comment": "Malware payload (Formbook)", "value": "0e3dc9a9c08c1dadb1cb920c7d32b7f9fee978460a15f8459a4cc12c98c6e7cd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775099, "uuid": "3ef0115c-15ca-4935-9dfc-d5dcf0488b3a", "comment": "Malware payload (Formbook)", "value": "9be592f9defa902230de641f0614371ba7cfab23", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775099, "uuid": "46da4afd-efd5-47d7-a9ee-1a06b5f9a2b4", "comment": "Malware payload (Formbook)", "value": "adab88a45ce9981b8c3d546534b0b93dc9b06ebdfd8fd73211028648f613de4f691767fb4bd03668eba8571dbd975b86", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775099, "uuid": "a2e291ff-01e2-4263-9fdb-8e2b851fdffd", "value": "T11554125F22C49CEFC084D8F619BA62AFCBFAF6105BA525977B371F1816522836436381", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775099, "uuid": "f398de0f-bcde-495b-a5b2-0e635f4bb720", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775099, "uuid": "17865aee-f69d-46bd-8ea9-b498bd4b878a", "value": "6144:ow04xiPc3GxR4XXjPPrgANAAgAQngUnh70n+MB:gciPc3GCrCA8nanVB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642775099, "uuid": "750cbc67-b26b-4abd-b66c-3ed3ada1b496", "value": 283771, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642775099, "uuid": "e83b49e7-b128-4502-845e-331ae3bc805e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775099, "uuid": "3a3bb390-9d4e-4151-a13a-22ed2df1caa0", "value": "Ziraat Bankasi Swift Mesaji.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e306e1d3-7aa7-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1642762202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642762202, "uuid": "19d092ea-ceec-4f73-be66-6bbe3ed7d514", "comment": "Malware payload (Formbook)", "value": "73bafd13dd3a637036a13fca6fb1b232", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642762202, "uuid": "d79dcf77-390c-4eae-b898-c7978b48debb", "comment": "Malware payload (Formbook)", "value": "0f5826444c6b1941a7bbf999ae4aa7488b96d57732be19d4f0ac87415cf26beb", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642762202, "uuid": "60b85da7-a7df-4d25-9910-4439962d61da", "comment": "Malware payload (Formbook)", "value": "e8a56b2195a47a5d57a9800847257e30a0d94ff6", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642762202, "uuid": "2ac41e2c-17c9-46a6-8b36-c39aaa85c86c", "comment": "Malware payload (Formbook)", "value": "9828377540b8a0551a17e6904ee61ded6ff7c65b458e1d740ede1936e9c59c69a13119c8d564f86e4c79d5553c8f2d9c", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642762202, "uuid": "fa1b02b8-a6d2-4542-8567-b210a331c406", "value": "T1980412C0FE0BEAAAD93367B1999B8E415A93AF443C4C8A4155F4768E2E3D30530C317D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642762202, "uuid": "5ec3b206-98ea-4519-9d7c-215856ac3181", "value": "3072:AOLek5bMFukwk89mAjqVrefyu2MRy6gj9/hXpvZ2ss4Axr++TDVj36ux:gnFUk1fVrex46g5JXpB2swxdTDVeux", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642762202, "uuid": "d5c129fc-6dac-4cdd-a3d8-f38320ce9a5a", "value": 187224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642762202, "uuid": "a8ae1102-3b90-439a-880f-888268bca5ea", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642762202, "uuid": "5548f121-5671-4828-8fc1-f792c261e570", "value": "list.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32dd0bbe-7ae2-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642787247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642787247, "uuid": "d75f11fe-963b-4c24-a5a5-1806e93ca9f3", "comment": "Malware payload (Mirai)", "value": "26fdcc9422875dfb96a797516e49609e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642787247, "uuid": "e681826f-55cb-412d-bd3c-b5c3ff4de882", "comment": "Malware payload (Mirai)", "value": "0f6d9337ca243b459d01d61c96a6b0b42b9bd55481396067b1eee81c743dd23f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642787247, "uuid": "b96e9bd0-bdd6-4923-8540-6d469613a2e4", "comment": "Malware payload (Mirai)", "value": "a8a0f1dd94c6d6afd2839c2206d16a73e389bae4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642787247, "uuid": "8645536a-a23b-484d-801d-733f1952cb30", "comment": "Malware payload (Mirai)", "value": "3ad1c7f03ba84de73ab60777e7c4c88301afd9b53fb2de06878b062ddc71cd38b32c22078d30523e3ae4aeff793396af", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642787247, "uuid": "e75ea218-fd80-4602-84b4-19f14c0df899", "value": "T157C2D18EAED917D7DE8D6DBD50E91BB32EF020A0218D6B0E93156DC0FDC609CB55D0A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642787247, "uuid": "ad4c56a8-b676-459d-88a2-e96fdbdf0e03", "value": "384:0eXe+DGcAX8egp8KC44atykdmVVaQlR3aDpBli8oicHRcG53lVeE/YDiH+RWGVCM:9GFKCnatY/aQlw3GHRcGFT/GiaWg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642787247, "uuid": "7e5d189f-f8da-4cec-9676-4d2932fc4bfe", "value": 27180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642787247, "uuid": "df094c21-f62a-4dc6-ac73-6a7d4ece8376", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642787247, "uuid": "f7b781d5-9352-42fd-b0d8-e5a827ed9b9d", "value": "26fdcc9422875dfb96a797516e49609e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1778ae7b-7a86-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642747687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642747687, "uuid": "f53fd625-d8e0-415c-8bc3-4d411436c916", "comment": "Malware payload", "value": "bf88b774aa442fdecc5e8f10d9476111", "object_relation": "md5", "Tag": [ { "name": "pw vodafone", "colour": "#096C78", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false }, { "name": "vodafone", "colour": "#8E01DC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642747687, "uuid": "b7d23517-879f-4e7c-84a7-40f11e0a7f73", "comment": "Malware payload", "value": "0fa841c1e599d2972006a04ccb61a1c2cd8139db2af6b59d396c2a8cb5d3cbae", "object_relation": "sha256", "Tag": [ { "name": "pw vodafone", "colour": "#096C78", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false }, { "name": "vodafone", "colour": "#8E01DC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642747687, "uuid": "4995bced-6be3-4bff-8db2-4cf3fa44ec6b", "comment": "Malware payload", "value": "8fb8363f1336479b508072e7f21a5995b9abc172", "object_relation": "sha1", "Tag": [ { "name": "pw vodafone", "colour": "#096C78", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false }, { "name": "vodafone", "colour": "#8E01DC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642747687, "uuid": "e5d5ffa1-c50b-43b2-befc-555303848c8f", "comment": "Malware payload", "value": "9456e38a29d7fe6837c9ca585ac6bc5c59afef956f252730c410577ba7408b5f33ada764344c778e4726dc4784489d00", "object_relation": "sha3-384", "Tag": [ { "name": "pw vodafone", "colour": "#096C78", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false }, { "name": "vodafone", "colour": "#8E01DC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642747687, "uuid": "402f7236-2480-47e1-be91-a9a5049879a5", "value": "T167D0235D75D540C53645374D6B13BC34AC0D35048414C11FF0496827510475FD10DB06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642747687, "uuid": "890d4a98-c3b1-4299-9430-402c36f2301a", "value": "6:GhPhDFgZrsxROM2iT9OnCxAV8qZ2aKTSMpmxItFn:GhPh+tsXxOnB7Z2BTSMpftFn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642747687, "uuid": "7fe57edd-6f9a-4b55-9e2e-323830947467", "value": 211, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642747687, "uuid": "5a426bd2-37e1-4397-b4b7-d1d6abf7c896", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642747687, "uuid": "c63298a9-6603-4bd2-94bc-4f90460e72aa", "value": "vodafone_21.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da7b1ff5-7a8a-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642749733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642749733, "uuid": "f1ffe1f6-ffe9-4742-bcb4-ebd647076359", "comment": "Malware payload", "value": "88997058bd427d402dbdb1f18f0bef66", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642749733, "uuid": "abb57886-58ed-4370-967f-4bcdcacc84cc", "comment": "Malware payload", "value": "104bd2d33c119d007df2adbc571a3e8cfac722cf1f0b6156ba211f413905e9f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642749733, "uuid": "aaa9561b-1a15-4111-a78e-fe8b0183cd9e", "comment": "Malware payload", "value": "1ce9b6dd5b0a1ca521d76d4ff2fa25ba5c5d471d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642749733, "uuid": "dc7dbbd0-d2e3-47c5-99c5-f3469098cb98", "comment": "Malware payload", "value": "548be041c6b3f5abd40c26066063cbe36ac52fe2565752d235a4b3289a3f96f8e1d500f070fc57e3b0e2451796c980a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642749733, "uuid": "ae13084a-59b1-4387-81b0-74d128d4dd12", "value": "T17271644B43588C23C1290B7306F341D4A6F8421627EF56AE7F6535167E4215B5CC3372", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642749733, "uuid": "7dbb48ea-a20d-4b31-b81e-cbe45b3153f0", "value": "a447f0d5610336b93476cb8fe8c7cd5b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642749733, "uuid": "347727d0-788c-47d6-bdf3-cde548161144", "value": "24:eFGSGQe4nRoCWEZgp96/7o9QDSDaddkl2sU2BCFzgprCMPgiE/j:iBRwEZgCgQWandqBCFz2CSC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642749733, "uuid": "4831ccde-11c2-46f3-a6e9-3922248a186a", "value": 3584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642749733, "uuid": "8ed15e48-3049-489e-845f-ed2c602a22ee", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642749733, "uuid": "254d682c-0f83-4dee-8c0b-3df3e4c2db11", "value": "104.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05f2893b-7ab4-11ec-9275-42010a9c0029", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1642767415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642767415, "uuid": "ccebb641-56bd-4feb-80c3-12c7dd52a659", "comment": "Malware payload (AveMariaRAT)", "value": "0c87b097f55d7a2367394a73e0433697", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642767415, "uuid": "858eb338-550a-4252-963d-900471632584", "comment": "Malware payload (AveMariaRAT)", "value": "112bdfee4547b7d7d8cb4fdc7a47021a17e164441ca10f4177bcf9980a46d89c", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642767415, "uuid": "e83c81aa-0f6a-4ff1-8582-2d67f6eaf31b", "comment": "Malware payload (AveMariaRAT)", "value": "4e05ce30ab5fe71ade14ebd41b6ede6e7703d337", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642767415, "uuid": "56a0542b-3137-48ce-83de-c389c8edf3a8", "comment": "Malware payload (AveMariaRAT)", "value": "5954b8d572e7599fb5a57c8e42a1b7981d565d3cf3a7c00a2c07e6df715d99eeeb7faabe38e8a173b7a0145ab645b8c5", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642767415, "uuid": "12cb0f8a-c87d-425e-95c2-70aa4f9a9cc2", "value": "T172359E23E2914E37D57F1A384C17A795A82BBE002E2CB6C63BE45D4C7F356417829E93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642767415, "uuid": "9d96590d-7e47-4679-849c-2da27dfb0d66", "value": "7d432c16623339e8ab5ce868f795be3f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642767415, "uuid": "73a231a1-6e3e-4a7b-a413-1afe18135480", "value": "12288:AJ2cF5mwV7W+AsAm/CrA1v+81yOgikqqyWEzzy7T8YQ0VJRX4tKa/B1HoGW7T3bq:gB97W+rAm/Ck2Y4y1GZxNXranXKT7vi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642767415, "uuid": "62e77bcc-e5dd-4fde-a777-32c57837a334", "value": 1093120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642767415, "uuid": "80992dd7-fac7-45d2-b034-e9f6c8e8a265", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642767415, "uuid": "66debb1e-f007-47ba-83e7-8ed99c2be6ad", "value": "SOA _ April-Oct 2021 Require Sign&Seal stamp.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c6c600e-7a9e-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642758138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642758138, "uuid": "0da6a8ab-49d9-4837-ba58-1ccb20bbaf60", "comment": "Malware payload (Mirai)", "value": "400b825dcfabe732f5cbde082bf098fc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642758138, "uuid": "5b67ed35-aa68-4a23-8ee3-3662811693b0", "comment": "Malware payload (Mirai)", "value": "1153b29ff7ecb1a74bd10241e4aa08c23b0397688f6bb4f16e9b0d4df3eaba1c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642758138, "uuid": "2475f3f1-4144-4131-8ca9-cf34eb3e2bcb", "comment": "Malware payload (Mirai)", "value": "286b58a4826f86ced34c1c5dddf5db83dc4b1ecc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642758138, "uuid": "dde9a8ff-4fc3-40bb-8fc5-c16ebd02e009", "comment": "Malware payload (Mirai)", "value": "e126b831f3c3350958aafe153f4f08b5bdea4933cab64eef0f20e1c3c16941728411d93d734c8d76863e3db42fee807c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642758138, "uuid": "8412adb4-afca-40f1-9952-93cce7624dca", "value": "T11C137D76C879BFC4D15883B4A9258E794B23E155C6533EFB1A49C5A68043EECFA083F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642758138, "uuid": "de1479bc-1f08-4eb8-ba16-1e7f6eeaa082", "value": "768:eaKZ7wtfjKjBDnGMepy1Kc/tLEFCPoRGo/TeC6:eaI7wtbQH/tLEF3RNSC6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642758138, "uuid": "03e2e143-042d-4e37-b271-e9388a95790d", "value": 42804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642758138, "uuid": "12acb235-ce4d-4cca-a4ee-046ee8462ab7", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642758138, "uuid": "153c8dd7-c206-4f13-9702-2589b0dc8de9", "value": "400b825dcfabe732f5cbde082bf098fc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aad5b3cd-7a7f-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642744928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642744928, "uuid": "95540f35-aba9-47e1-81f6-50c18eb5c698", "comment": "Malware payload", "value": "902da7afca05bfe5923f23465b2b61d6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642744928, "uuid": "e7e09f5f-f8e3-4970-853c-d22d9beab3d5", "comment": "Malware payload", "value": "11ca82326f28ef0ef508f6b693d67f3df5d9e538e58b3a130570c94901cd320c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642744928, "uuid": "61c78fbf-a5a3-43bd-b993-741e58fbfed7", "comment": "Malware payload", "value": "00092cc53530bab55b42d9bba6d93ace0ecfdf59", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642744928, "uuid": "2faf5d1e-8d1d-4155-b8c4-986143c7a61c", "comment": "Malware payload", "value": "60127398e8dc23d353b7dfced977bb0979a49e77b7f3ccd9e598ae3d692537ddc37671fd278689348b1d6933e8475d3d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642744928, "uuid": "ed921cc2-c878-42c0-8f92-802b18f97e70", "value": "T1D8050230BFD11364CB5E87F48DB97C708378F0862959CB6E9D8AADDA12247D18711B2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642744928, "uuid": "53bfa82f-4b23-4d97-8257-26aacfbcacc7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642744928, "uuid": "5d8bd012-a8f5-4528-b493-107f2246c5f9", "value": "12288:4bgbiiiE9WfXGd333dy8Dr4/aEBUyJneRBb3JA33E:6gSfXk333dk/9pJeNM0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642744928, "uuid": "855da021-abc4-4ca4-9c5c-587bccad6d04", "value": 829440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642744928, "uuid": "904d04ad-361e-4c25-a80e-46d2fb6a5f2e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642744928, "uuid": "0c61f6dc-f8f3-44b7-8b03-66c128ab8962", "value": "HBL DRAFT $ DOC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcef50c2-7aa7-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1642762192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642762192, "uuid": "135d12cd-9791-452a-a055-fdf2451dd132", "comment": "Malware payload (Formbook)", "value": "bb117984452ff911f0ad36c8a8ed0be1", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642762192, "uuid": "d12a7fce-be8f-473b-b6f8-b066d4fef537", "comment": "Malware payload (Formbook)", "value": "12023c73bc14e481dd41ca29678ba1ee9c8e1b06044b46c1f6f22eea2d025479", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642762192, "uuid": "083ab29a-a77a-4618-91f1-d5cfeddbcbcf", "comment": "Malware payload (Formbook)", "value": "f1d87db392726f2a611ed3ce50ee1927bc642ba3", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642762192, "uuid": "a1a14bb4-e497-4b12-8e14-6cbae82c5379", "comment": "Malware payload (Formbook)", "value": "1620e05148c1afdbf1f61be85071d326b0c33705eaf09c9b2c4536c56b9e9279ed207306d8f9a7658e2c6f2320ef200b", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642762192, "uuid": "a1d094c9-f9a5-45bb-a92e-5c253b6647d2", "value": "T1571402983DA6986EF5374B732002408E4E5EEC13A98F991B854F75CFE437E356A80B16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642762192, "uuid": "454f73f8-19a9-42de-8f2d-adc08015a251", "value": "3072:uR3yMo95hfPXW3Yhi4ws1q8hxeXsV/PBe7vFGm1A1s3lAAOvEvw0Jo/GHBlJxNmO:MyMoBfvW6i4tq8hx+sPSvFPy+CWvvoel", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642762192, "uuid": "734a8f48-af96-4ec6-8200-04fbee117e92", "value": 192376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642762192, "uuid": "aa2f81f1-e923-4e79-87d7-8b761f3b427e", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642762192, "uuid": "1de3799a-f79c-4e87-9fb2-73a34045d145", "value": "21-216 Visor assembly for Firemans Helmet.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f24c6f9d-7ab6-11ec-9275-42010a9c0029", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1642768670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642768670, "uuid": "59581181-b617-4b7e-9fd7-01a4faf82546", "comment": "Malware payload (AveMariaRAT)", "value": "c1f6d5914d19efb4a17f5b4aa17c7221", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642768670, "uuid": "3f7bea9a-985a-40a2-91be-e189305911b4", "comment": "Malware payload (AveMariaRAT)", "value": "126f45f3b66e9b35762f43076a1c534f7bfbf36ab3a342ad18fcdf4117fa0d99", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642768670, "uuid": "60534fde-0b2c-41b2-ba6d-a394af844fe2", "comment": "Malware payload (AveMariaRAT)", "value": "3ec7ec7f33540d102123974b920d8d2b79054ffa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642768670, "uuid": "f58942a5-9e73-467d-b9c3-1e8f6013631a", "comment": "Malware payload (AveMariaRAT)", "value": "64c57b26cf93b699424e029ddb606bef943615d02c463ce442bceb99b6de936008f424fe429d6975cb6ef21c35d4bfc9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642768670, "uuid": "50f533d0-b04b-440e-8a07-25c9926e503d", "value": "T1D0C4CF4032F88B45C87E87FA4875109017BEBE0AA835E76F5ED1B1DF0D71B819A26763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642768670, "uuid": "e0fc3c7a-f599-4202-8d91-02b981f4c864", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642768670, "uuid": "c04a86bb-acfd-43d7-8867-89e5995b463f", "value": "12288:1VhMFfpQvxKzGzyOO6gB2WZ1DCBFVWNpq6+ievYF:KppQpLeOcWaW6+ievYF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642768670, "uuid": "6c1c4328-0097-47f9-817e-e6e1077b8c18", "value": 593920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642768670, "uuid": "e37a1119-fff7-4b9b-9c86-2d113a15fad3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642768670, "uuid": "b34595a5-c46d-4ff5-a27f-340c1e03feb3", "value": "c1f6d5914d19efb4a17f5b4aa17c7221", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb518b6a-7a75-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642740661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642740661, "uuid": "dee3904a-faac-45af-9bf0-cbffbac71e00", "comment": "Malware payload (Heodo)", "value": "25f5a24fd633550f61c69b0ea4e02160", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642740661, "uuid": "71908c68-3c3f-4e93-9d33-7980fc6c7991", "comment": "Malware payload (Heodo)", "value": "13c3fec523cfe8ac14a7e78a8e2ca86dfd3b8bb8447eb7e733e7b1207de5bea6", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642740661, "uuid": "9cc718a2-1227-4df5-bd07-43728bd87dd0", "comment": "Malware payload (Heodo)", "value": "5a63289429f948584f5841ac35fedb1eebe0e7eb", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642740661, "uuid": "2494ccc5-63fe-42cf-8667-722fcd4ab748", "comment": "Malware payload (Heodo)", "value": "b57fe51daec3960d4bcaddfcca70b1b0b48db385b9e9fc1c55c03fe8b4d3858b5e8eb1edfe7821b9abbe558e499579ea", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642740661, "uuid": "b151beca-5260-4492-92d2-c30f8d340e02", "value": "T1E4636CA7B78299EADA0483394DB643C5B717EC104F9A43C73694F7346EB49F08D9324A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642740661, "uuid": "91570226-e262-45bc-9680-8d9e5ecb7e04", "value": "1536:bpEk3hbdlylKsgqopeJBWhZFGkE+cL2NdA8eXZiozeOgXVZKyaZpvyR1kZkJvU+:bCk3hbdlylKsgqopeJBWhZFGkE+cL2Nr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642740661, "uuid": "e8f9d346-69f7-49fd-99ca-d474075883c1", "value": 72560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642740661, "uuid": "46fb1667-5c6e-4e8a-8cfc-913e555e95b2", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642740661, "uuid": "e76e3e80-1dfa-40b4-a4c9-a30aa87cfd46", "value": "25f5a24fd633550f61c69b0ea4e02160", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98dfedc9-7a8b-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642750052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642750052, "uuid": "1c1dc54f-1cf7-45bf-a014-7010da1fb1e7", "comment": "Malware payload", "value": "cd6823c4f7377d0a2cc3042d47d7eef8", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642750052, "uuid": "6e323c5a-3c42-426b-b9d9-7dd5535210cd", "comment": "Malware payload", "value": "143d71fd862c034b95169280a6d4382922b3cbb8a105f184ab27f47e95ddc6c2", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642750052, "uuid": "fefef5a0-1afa-48de-a79e-3e59c2da296f", "comment": "Malware payload", "value": "eb7df31e3f802a5cb332c6377bd1bc78cffc101a", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642750052, "uuid": "13478879-4df6-4063-af19-184d990d4204", "comment": "Malware payload", "value": "f3cc99ef6199e819e1c48b6c58bf6fb77e5a2320199308a4fe6ba51ed329d24c11085e2e727f721386148907e44b7d36", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642750052, "uuid": "52ed0a7b-3545-49bb-be1a-171112efd036", "value": "T1D90512317FD21756C71E87F888B9BC5093B9B1863A68CB2DAD8F5CDA03247818751B27", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642750052, "uuid": "3d1fc65d-0775-4e53-acd4-486e246867cc", "value": "12288:VUUUa9WfXG5ZZZb4UY+5UriYp8AzkUzWAeuJHxDnrayJEYyg0nA:ofXQZZZbfYUUruAzkUaAe0HxHTPB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642750052, "uuid": "3d161c72-fc83-4f2c-b2af-7aeb90f03754", "value": 856064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642750052, "uuid": "14e7dd3e-5710-44c6-b5a7-b4bd70cc3c82", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642750052, "uuid": "a3bf25ef-68e3-4d63-9cf9-e3f3cfdabbde", "value": "FIle32222.322.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c564e285-7a77-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642741537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642741537, "uuid": "e2c196d0-d96c-4029-b260-3be6f0351e7f", "comment": "Malware payload", "value": "fbbb2ba95d16e8cee2fbcf17211f1d19", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642741537, "uuid": "d3d63e4e-1dd5-4971-b3f2-3f59200d56cf", "comment": "Malware payload", "value": "147f5ed4e02ac0fe77839c6ffd04f856d46199641bfd1fb9e3fd292065192d35", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642741537, "uuid": "1b6a6e0d-192c-47ae-b4d1-2064c762b822", "comment": "Malware payload", "value": "ef8af943ae520739bab302150767dd5318fba97b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642741537, "uuid": "e78e9416-4457-4393-a9c1-5c9084e4428c", "comment": "Malware payload", "value": "da97b1ef20a5572b349d7fd048cbc51945ae7418977472099d3e55a9af8156c193d58dc046b13af8e585ac3441bb1c8b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642741537, "uuid": "e9be8b78-b62a-43ac-84f3-7da4bcd9d2a7", "value": "T110831A46E7418B03C0A22779ABDF83113323DB51A7AB6706562CBFF43B477EA4E12516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642741537, "uuid": "5163c248-3058-4403-9344-c477b6f2d9b8", "value": "1536:4MnSx3Ta72lSIiuW2dGdjoE2o30TmkpUA0zw/936CdZYhadEzBBS:i320W2k8E2cogM/93jEeqrS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642741537, "uuid": "1743756d-12ae-4d41-ba96-b07c9e89f418", "value": 88365, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642741537, "uuid": "c9174af2-4757-41d7-8098-4dc70bd8edf3", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642741537, "uuid": "154650f9-d1fc-4f85-a1a6-0b0de6ef3551", "value": "beamer.arm7-20220121-0505", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a44a46ad-7ad7-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642782713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642782713, "uuid": "c0801d1a-6a87-48df-aa96-d6c3e6db8215", "comment": "Malware payload (Heodo)", "value": "b75758592e0b781721d544f1d317fea3", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642782713, "uuid": "4599a7a6-f77d-410f-aa8f-c823c118cf2d", "comment": "Malware payload (Heodo)", "value": "1585b2d7c841c644f6795ec908d8776095207aedc80fd08012e05f6f6c6de794", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642782713, "uuid": "8a33abca-46df-48e3-8eff-50ed62d7a2d9", "comment": "Malware payload (Heodo)", "value": "8d512682c27d10e3954307dfc0ecf7965e4fc6f4", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642782713, "uuid": "1c48c2f3-7973-4fa3-844c-47230c8540b8", "comment": "Malware payload (Heodo)", "value": "67e5f5d91d2adbb058d2868ccc985792821462d6f0d925a91132b54d0f2ee6de9e5d86e0edb13d824a89c04320808ffa", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642782713, "uuid": "cba02df6-8223-4de0-a9a8-9713cb8d62d3", "value": "T131636CA7B78299EADA0483394DB643C5B717EC104F9A43C73694F7346EB49F08D9324A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642782713, "uuid": "93c7c310-a650-493a-b214-b9508beffb8e", "value": "1536:bpEk3hbdlylKsgqopeJBWhZFGkE+cL2NdA8eXZiozeOgXVZKyaZpvyR1kZkJvU+:bCk3hbdlylKsgqopeJBWhZFGkE+cL2Nr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642782713, "uuid": "eee77bdd-33e9-4b0d-8e25-af9c295edec4", "value": 72629, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642782713, "uuid": "32daa4fa-0c74-4bb5-a368-08ddd874a291", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642782713, "uuid": "a6dec2d7-ca22-457f-8c71-bf2cf8be20fb", "value": "CW-3143 report.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9f6fc9f-7a8d-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642751020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642751020, "uuid": "b93b6af0-ed02-4b14-b239-c4734eeae86d", "comment": "Malware payload (Mirai)", "value": "fff338ea56aff40ac03b560b524a3f7e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642751020, "uuid": "f12dcd77-5149-42ec-8eab-c9c5dc2dc4b7", "comment": "Malware payload (Mirai)", "value": "1654a1d3f803e610030ebdbe3de1ec90672c00868d3a5ab00c0fb28eda049975", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642751020, "uuid": "225d06f4-288e-4a54-8e86-fa116dbf336c", "comment": "Malware payload (Mirai)", "value": "5f9226d7cbd291f029ab893b38f99b7cdb1d9f73", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642751020, "uuid": "d48e7290-1c30-4930-8dfe-4a1440de8db3", "comment": "Malware payload (Mirai)", "value": "5c0c648006007aff229ce2e3be611478daefef431fe0631d9e72bfa612cb0d55d1473a92bad8affd514a47b35d173316", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642751020, "uuid": "9ab063ba-696a-4ef0-89b3-441bafa06b81", "value": "T110830956F8409B22C5E456BBFD1E01CD33132FB8E2DE32129D286F253BEA95D0D6B541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642751020, "uuid": "b4894b0a-00cb-435c-9438-010c09b19fd7", "value": "1536:IunMREBFTNiGDwAdoOKkg4LvVB+N1VCx3MlRddIeNuRRztKrYvTf2Om3ZgdGBJf2:eREBFTNiGDwAdoOKkgKVMNTCx3m3iesn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642751020, "uuid": "3801af31-84d9-4fa3-857d-240954345c2b", "value": 88624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642751020, "uuid": "6578c3b1-f705-47b0-9279-caaf2896581d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642751020, "uuid": "3c93e420-f290-4fd6-83c7-9b3d7576eaf8", "value": "fff338ea56aff40ac03b560b524a3f7e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb4dc245-7b06-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642802938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642802938, "uuid": "6e17cb65-c2e2-4838-bbf2-788817319195", "comment": "Malware payload (Mirai)", "value": "a79ff7861349b391e234ab934d7a51ad", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642802938, "uuid": "4264dd9b-0baa-4428-be56-8363aff5b7f3", "comment": "Malware payload (Mirai)", "value": "1758fa6f9be1a1907856632ce964543fcd9e7f757baedf5b2d22b3a2e3c16f9b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642802938, "uuid": "85188856-be78-466b-9de4-1ce71b015aeb", "comment": "Malware payload (Mirai)", "value": "d241b7b29ed84a485e83d8e2f17dfdcdbd405df6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642802938, "uuid": "374e7deb-f8b3-4079-a35f-68c5ec3b8819", "comment": "Malware payload (Mirai)", "value": "67d488e57145676ea743d66f7b52732c21f2a038ac80d49c58e45081b2c3082edfbb6d4dbf6dbc6cd7f04ecc04a443df", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642802938, "uuid": "a0175d7d-31d7-4705-9e34-4a67ecfd9b9d", "value": "T1DFE2E14D64B82CE6EECE483D52DD0869ED9B69664319EFC6232104C0AA2FC1EE5DC47C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642802938, "uuid": "ff76a639-34ad-4e94-8065-f484cab54f00", "value": "384:e3fpCLrsjHIX69URc+hmnulY1qHprFKt6zNJpRwD9MH+Duvimo4K6a3lRWGVCz0i:SfpWcehzJFYKn7gMHR2v6a3TWl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642802938, "uuid": "58547581-bebc-4a49-97f3-e50cc5ef5462", "value": 31976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642802938, "uuid": "ccc31856-c567-4472-a8ad-fec9b77519f4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642802938, "uuid": "82cfc174-85f6-4c1e-8ea7-a64d1bd0aff7", "value": "a79ff7861349b391e234ab934d7a51ad", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1087598f-7a72-11ec-9275-42010a9c0029", "comment": "Malware payload (NanoCore)", "timestamp": 1642739086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642739086, "uuid": "14cdc8d7-0d56-4a13-99fa-eca7e5c7856d", "comment": "Malware payload (NanoCore)", "value": "e37defaa7000c520c5c559b5a7840517", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642739086, "uuid": "f7b3b896-5123-4e9d-9cb3-3ceb593ac64f", "comment": "Malware payload (NanoCore)", "value": "176f35bde47c4bec6c1b3df8f1b8a8ad5f47040be0889123e988e8fcd0022320", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642739086, "uuid": "3d3d2032-0aa6-4602-9b65-eed288af6854", "comment": "Malware payload (NanoCore)", "value": "46220af0945be3bb8a10990eaf6a10a25ac09fd4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642739086, "uuid": "4bfaaab9-886f-4edf-97f6-5e123a918607", "comment": "Malware payload (NanoCore)", "value": "209b0e66079dac628c3e2735cf7d829a7947b9da06277aa5b366e09bede3b7ff99b4651956570e67ea24967a13a61192", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642739086, "uuid": "83cc1943-5b94-4a3c-b226-84e15cc88dab", "value": "T18105F14033B89B01D57ECBFA8871408013BEBA1AA875E36F5ED5B1EF0DB1B819616753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642739086, "uuid": "44f8ea89-0ca3-450f-b9e9-9d5260e6f899", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642739086, "uuid": "6356d2b5-dd74-4e74-b115-fd0e2209120d", "value": "24576:OpQVBrDMKm0/yXEQ86q+ZCq5oYE6+ievYF:Op+xH7yXxNN57+itF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642739086, "uuid": "df1def9f-e40b-4842-9435-d4fb3ff92e02", "value": 819200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642739086, "uuid": "b0ae33d6-f532-4c2a-8b49-b71ea148c709", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642739086, "uuid": "9e460e3a-67d5-4d1a-8e01-078039d579de", "value": "DHL Documents For Delivery.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58538ca1-7a59-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642728469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642728469, "uuid": "4270a5c0-38b2-4c6d-93af-f0e13fc3d607", "comment": "Malware payload (Heodo)", "value": "f9d94e08643c3c0294d6af80405b5b51", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642728469, "uuid": "be5e964d-97d7-4067-a051-faa2c747ff66", "comment": "Malware payload (Heodo)", "value": "17c8e59bb1ddb5280a54987b4ccdf4c98cfb72071d795eb10b5c50b7d32b9d8b", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642728469, "uuid": "eaa71393-37ca-44f3-9ccd-3697f0fea36f", "comment": "Malware payload (Heodo)", "value": "2d167594d57ea333a5eb93a775759bfc2dde3658", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642728469, "uuid": "a365ed49-6b08-4f75-84f0-655f8c33cf10", "comment": "Malware payload (Heodo)", "value": "284e6982dbb75f90b5b6c488577483809c92cd3a519c9edf29bb5bc0aed182211f265ede1bd55288c6ebae3a3bc1c96d", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642728469, "uuid": "5186eb53-b75b-44df-82c7-1a3e2cc4e916", "value": "T14D636CA7B78299EADA0483394DB643C5B717EC104F9A43C73694F7346EB49F08D9324A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642728469, "uuid": "f7a40f45-e14e-44fd-8912-509225ff2ccf", "value": "1536:bpEk3hbdlylKsgqopeJBWhZFGkE+cL2NdA8eXZiozeOgXVZKyaZpvyR1kZkJvU+:bCk3hbdlylKsgqopeJBWhZFGkE+cL2Nr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642728469, "uuid": "ba32a7fd-b4f3-442c-a070-943b27993641", "value": 72041, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642728469, "uuid": "aae07b66-350b-46c5-8652-a0ffd9450136", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642728469, "uuid": "fd86f5dc-3295-4168-b091-9f2f5a943978", "value": "f9d94e08643c3c0294d6af80405b5b51", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5fbbc7f-7a6b-11ec-9275-42010a9c0029", "comment": "Malware payload (NanoCore)", "timestamp": 1642736438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642736438, "uuid": "8c7d8020-2852-42fd-a293-fcf56242a231", "comment": "Malware payload (NanoCore)", "value": "e53db947fce99439608c9a9553f69498", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mansengco778-ddns-net", "colour": "#8B7EA6", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "pw WT2lH6ZAAx8eKUZ", "colour": "#222F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642736438, "uuid": "f90daaf0-0de0-4bee-bebc-a14b5d98cf79", "comment": "Malware payload (NanoCore)", "value": "17cb794e094d6cf35a700c399316360eb20eb235be61377ffd6dd0022ac3bb5f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mansengco778-ddns-net", "colour": "#8B7EA6", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "pw WT2lH6ZAAx8eKUZ", "colour": "#222F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642736438, "uuid": "a5d4ce77-8e22-4641-85aa-95330fdb5331", "comment": "Malware payload (NanoCore)", "value": "95375e0e9ccf538d02b37ece3f6f9abc069d28b2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mansengco778-ddns-net", "colour": "#8B7EA6", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "pw WT2lH6ZAAx8eKUZ", "colour": "#222F9C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642736438, "uuid": "02f69f56-99ec-44db-b32f-7525ba50d74f", "comment": "Malware payload (NanoCore)", "value": "69db8fb657b0fea0fb6609275d5cef984d7e96fbf062cc3417cb20a84ff8e63dc050928cf2492917c43e84338d8bfa85", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mansengco778-ddns-net", "colour": "#8B7EA6", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "pw WT2lH6ZAAx8eKUZ", "colour": "#222F9C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642736438, "uuid": "dc2a2bd8-e933-4c23-848f-09101490c2af", "value": "T132352FA932507EDEC86BF4738A681CF4EA507C76830BB20790173599BA5D857FFD40A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642736438, "uuid": "4ca7f7b2-3762-4e17-a999-429d05f7073f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642736438, "uuid": "7dda089c-7f88-4358-a2e9-d8022d532aa1", "value": "12288:p2w0odFMaarGMfq/EENq0BvsSg0tsH7Bn+ofkc14c1UexMpqk1u6gakKcOrYsVF4:QfHrHmJ1sHQcnTfkcac4/jA9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642736438, "uuid": "8f585e49-cfe1-4376-a9f5-c10b8c48fb81", "value": 1136640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642736438, "uuid": "73a5dac7-b5b5-44d7-8b3f-1f448c48d521", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642736438, "uuid": "ccbcd016-7db8-47e3-92c0-a832a68f949b", "value": "WT2lH6ZAAx8eKUZ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97b23418-7a68-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1642735018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642735018, "uuid": "c1dbb8f1-fd71-463a-b3cc-3edda886cc52", "comment": "Malware payload (AgentTesla)", "value": "c3e90eff4c231fd6d9995d46a202d86b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642735018, "uuid": "4f597d45-e410-4011-a99c-5c39a5881594", "comment": "Malware payload (AgentTesla)", "value": "17d984aae36806be8dd97d160c9e108bb83024f9edbbeed29d6125247cecd161", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642735018, "uuid": "e8940f81-5cf4-4fbc-a310-1b7030478d1c", "comment": "Malware payload (AgentTesla)", "value": "0b80a5504de73ccb76892238474ba8dfffda1581", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642735018, "uuid": "d09d5ea2-c4d8-4808-998a-2cdd5e26362d", "comment": "Malware payload (AgentTesla)", "value": "1731787263924234e9e8eea38918836d2697fa0909a2defbcbdf6d77b4abe5f33124ff246304ec06bbbc8853013b31c0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642735018, "uuid": "0f128c4d-4c07-4d79-b321-fa0b0dbcb61d", "value": "T1B735CFBB21195F59F43F933E433194558BF8A52BE726D2CFBE84A4D74C81B02C726826", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642735018, "uuid": "dcc752c9-b27d-4933-8d02-823a665c5e72", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642735018, "uuid": "fa31b750-3773-47e7-95a6-b2d4347e25c3", "value": "12288:yhWOewmjApheoRQWPxjTYQKbCyNoCVub8Yb96XcsrzYDsZRLykgwWqVf:y4tjAzeuQYZKbBPVubFiekgwWqVf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642735018, "uuid": "9a6457e7-2502-41a5-b407-913476f94c86", "value": 1133568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642735018, "uuid": "86375f95-7780-43a3-aebf-1e9209702dee", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642735018, "uuid": "25a95f81-3e67-480a-9004-a51a10ee49e0", "value": "cCZjn3xkc3gZvlH.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "299310b0-7a89-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642749006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642749006, "uuid": "b03a8b77-bc7b-46dc-9f25-5447555d5e57", "comment": "Malware payload", "value": "343fcded2aaf874342c557d3d5e5870d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whispergate wiper", "colour": "#55FCE5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642749006, "uuid": "a503e542-3f33-4097-bc23-d838a0dae537", "comment": "Malware payload", "value": "191ca4833351e2e82cb080a42c4848cfbc4b1f3e97250f2700eff4e97cf72019", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whispergate wiper", "colour": "#55FCE5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642749006, "uuid": "e3e9755a-6e94-45bd-bdea-85c1b29f4eef", "comment": "Malware payload", "value": "8be3c66aecd425f1f123aadc95830de49d1851b5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whispergate wiper", "colour": "#55FCE5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642749006, "uuid": "8e1322fb-a5e3-4a56-9947-ca6a5b020f99", "comment": "Malware payload", "value": "8c777c567aa9a43a7f60c3272da4fe36affbc1e701d350807fd65bf5fc28ed905863c9d6d21c59cd768683e6cb4d8951", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "whispergate wiper", "colour": "#55FCE5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642749006, "uuid": "055e569a-27fa-423c-99ff-bc3428e225a4", "value": "T103B22B0AB18A97B1E573F2BA8ACBD77B4792E613C51B6BBFF724765862024507C14F00", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642749006, "uuid": "2272025d-9b9e-46b0-893a-dccefa7b5649", "value": "54cfabe19c96b84b5812f45d4663034f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642749006, "uuid": "7fb0b19e-3963-4930-9096-860ea4976f78", "value": "384:6ck4phERK+NUl/9j5SddlEt4OIqXFKJBeht2FrGxg:6ckuhERW2wndVKPe2FyS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642749006, "uuid": "38e0fe0a-8fe2-4a52-9ea8-7a047460d93b", "value": 25092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642749006, "uuid": "28cbe9b0-f0f5-4d67-917a-343913c07507", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642749006, "uuid": "0c66e04e-0e7b-4637-899f-7537d8ca6bbb", "value": "stage4.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf13b09e-7ac5-11ec-9275-42010a9c0029", "comment": "Malware payload (RemcosRAT)", "timestamp": 1642775027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775027, "uuid": "8dc8bffc-7a1f-49e4-bf7f-ed7db2bd9def", "comment": "Malware payload (RemcosRAT)", "value": "5d3ad82ef16521df753bc6baff37f72f", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775027, "uuid": "55906896-3d26-4faa-824b-13936ae3471c", "comment": "Malware payload (RemcosRAT)", "value": "19469f11cba8ab55b84cf26efa8835e906d07fdb73572c9ee3594e5c44c798bf", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775027, "uuid": "47b831d8-4837-48d6-ad78-122de66e1c62", "comment": "Malware payload (RemcosRAT)", "value": "ac4df3a47570b88a4768c2c461b15f78b99753dd", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775027, "uuid": "db3b6a49-34f6-4291-8f47-8378c013d9f2", "comment": "Malware payload (RemcosRAT)", "value": "a93c36105deb01e7697e65609af0a68f45f058d1288c4b0fedef23b2209e16d6f4ed6a02e5030b255a4ec176cf146be2", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775027, "uuid": "03ebf37c-6bea-4383-b850-7b70aa671d28", "value": "T1C97394A688374F70C9C97DADF4998ED209460AA1C27043AAFED318B7D459C5CC3E76B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775027, "uuid": "0e902e1e-e18a-4356-bb27-ea8828a4abf9", "value": "1536:LLw5NaanH4eVprnmnk91iv2SZTcWsyuFrTkOiPVz7p:LYVYrNv3sRO3p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642775027, "uuid": "2dc55992-40cb-4745-8419-22be01342039", "value": 77526, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642775027, "uuid": "f9984688-9915-4c05-8895-b24834ec1bef", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775027, "uuid": "1cd6b0ec-11cd-46cc-8b65-21a5afa99984", "value": "775578748333_FEDEX.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe36cff9-7a9a-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642756665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642756665, "uuid": "aef93755-b68e-499a-a2f3-cb46c89ced33", "comment": "Malware payload (Heodo)", "value": "2a3866e51fd86156b596bc4ea89ad1a4", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642756665, "uuid": "2566b211-efcc-4443-a073-55a0f961f449", "comment": "Malware payload (Heodo)", "value": "19b5d05f9484e4de6ee17525093f07e2da57287e05e5bcf9999f694bdab916f7", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642756665, "uuid": "7ffaf0c6-be5b-4d45-add8-ed891a93817d", "comment": "Malware payload (Heodo)", "value": "ba71e5c9364e5f0ec05d72a1233a91289eac21f1", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642756665, "uuid": "99974738-aadf-40dc-b821-1735b86af2fd", "comment": "Malware payload (Heodo)", "value": "e063de62f591133f8eacca47c82470c09d620be9b17b6879e7002be85ba75301c55c2db4df92e4f7b10c970e56d353b4", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642756665, "uuid": "a5a39dac-6569-4b28-879e-2c0eded93fab", "value": "T183636CA7B78299EADA0483394DB643C5B717EC104F9A43C73694F7346EB49F08D9324A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642756665, "uuid": "e67b2590-075f-4a10-b38a-2aabba5598d3", "value": "1536:bpEk3hbdlylKsgqopeJBWhZFGkE+cL2NdA8eXZiozeOgXVZKyaZpvyR1kZkJvU+:bCk3hbdlylKsgqopeJBWhZFGkE+cL2Nr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642756665, "uuid": "1b7d53c9-169e-4c1f-857a-ecf7814ff0d6", "value": 72742, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642756665, "uuid": "f7f5ddf5-4dee-4484-929e-9164bd1bd022", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642756665, "uuid": "250efc0e-0369-4eb2-ad2a-6842d62d98c1", "value": "XAV416069429HS.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b52bcf3-7ae3-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642787744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642787744, "uuid": "dbe585bb-45ea-4c8b-8b64-8cee8ecb4321", "comment": "Malware payload (Heodo)", "value": "87eb958514fbbc663e469c274d703cfb", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642787744, "uuid": "851412c8-0920-4ada-b72f-b6448907f850", "comment": "Malware payload (Heodo)", "value": "1a2cbdbb83d0d97cec743c991bb913e13ff0b5b00a00b46b0c485573cffcfd91", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642787744, "uuid": "c2fcf653-6438-4ccd-b9d7-4849f5459fa9", "comment": "Malware payload (Heodo)", "value": "7262efdd237b1c6d0ffd163f169f76958038a92d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642787744, "uuid": "254060b8-3d65-4a97-9c84-bcdb049612e8", "comment": "Malware payload (Heodo)", "value": "f1a6647ef1261171d426824f65facced67e86425d0dd5c8cf995976bfc34db58816a9c1496f337bd4e78f7e9801465f8", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642787744, "uuid": "0ecf63ab-3826-4a80-bdcf-2a5186468737", "value": "T16AD4BF11B2D2C07AC1AF1674556393A463F9BE90DAF9C257FFC06A4F1E315828B39712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642787744, "uuid": "f2fc675f-3e99-474c-abb8-bd8c923ffd4d", "value": "24b46ffcf60dc8d39e8124f411ebd08e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642787744, "uuid": "482fc5e2-e2f5-4a04-b599-5413cbd26573", "value": "12288:kqdJaxkOWFornPmGZqnTFWbD8UYVubhesslBvQqEPO7:kOOsornPTwFWbZYVohevBoi7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642787744, "uuid": "9eadf086-1111-4539-949c-4b3ecd6c7664", "value": 626688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642787744, "uuid": "faddac5b-f67b-4e2b-b0a1-a4b56f34bc4b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642787744, "uuid": "c0e27312-bc06-44e1-9e16-d4e1fa719fee", "value": "PIEEd8Na2M.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a578b43a-7ad1-11ec-9275-42010a9c0029", "comment": "Malware payload (GuLoader)", "timestamp": 1642780138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642780138, "uuid": "19d461bb-1d18-48b7-9ba7-1e3e2155c0b2", "comment": "Malware payload (GuLoader)", "value": "86dc0e2f28b5f64e1b1d4c80a98754de", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642780138, "uuid": "7b98e50b-ed60-40d2-bb35-4b8eb88e5422", "comment": "Malware payload (GuLoader)", "value": "1acab6f20decaacc4f7c414f2ed2ce40354dc4c7f953b67176cfa375b8411d5f", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642780138, "uuid": "4e104515-6369-4d11-867c-b3a017475fc8", "comment": "Malware payload (GuLoader)", "value": "4c29a907c5e875c843001f490f52bf3094866b79", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642780138, "uuid": "200fa439-8cf6-490a-9caa-7faf9082735e", "comment": "Malware payload (GuLoader)", "value": "337e3a513d2b1824830acb282888a6d73b199b0e24264bb28983043a8129a244973f4c9297015f3ce2afd17538e058ce", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642780138, "uuid": "ab97cfd6-93dc-49c6-9d2e-d570363f9e64", "value": "T11F7402123A41DA57C95613354DE6CAEA6633FC502F3F470B3466F32F6EB67908413A2A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642780138, "uuid": "c8fb398d-59de-4838-b202-4215ccd77aa6", "value": "6144:4xEtjPOtioVjDGUU1qfDlavx+W2QnA9hoGbwZbRkf8jX00KrZPhl9e9YA2XBXIOt:uobRkEjkFVo4fcRrea", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642780138, "uuid": "dd0e9687-7c12-4ace-8234-28c9ae694b96", "value": 338432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642780138, "uuid": "210fec1f-be70-4b8f-afc4-6b3e7620fbfa", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642780138, "uuid": "1926f3d1-1371-4bc0-acab-086c6cc7d8e9", "value": "Pendiente_Pago_Plan.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e999944-7a8a-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642749632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642749632, "uuid": "ec7e03a7-b517-45b9-b493-58c158b02d6a", "comment": "Malware payload", "value": "f11f61a9538a316e70b1b3748d29e5a5", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642749632, "uuid": "67c1b3df-2048-4fb4-8f0d-400c49321029", "comment": "Malware payload", "value": "1b2c793c0d789453ea84ee59ae73eebcd44bd82ed460995fa6fb88ffd8db841d", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642749632, "uuid": "6dba7ce1-72b7-43b9-8bb3-f029b3693b71", "comment": "Malware payload", "value": "a92aa6a9f180a6e10cdba181a96bbc452fd8092e", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642749632, "uuid": "0a1371fa-8c4d-4f8b-89f2-10f34b2bf7ad", "comment": "Malware payload", "value": "e148bc2ae42f55f3a0b21c25f3d59b9f8f300e3546fa4c97ac9bf8736b0980fd21bbc53de0f21f25e6c74254862448f7", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642749632, "uuid": "041833ab-9a6b-4b3b-a52c-9a038a7d55b7", "value": "T17EE43308E0776C82DD22DEAB37B0C20ED9962638B58559F98BBB31C4DD5378635D03DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642749632, "uuid": "3fc8d015-eabe-4e77-b6d5-3492979ead2e", "value": "12288:ozIa6BBIm7AbKDXBD3DGh4izWzEV5S62nD6Wa/VnHtgmcz5bG8xfSW3lWeF:yI/BBVAbKDhT8znpTtjcz5bG8xft1j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642749632, "uuid": "edd50bc9-1953-419b-aace-fad63182e524", "value": 692798, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642749632, "uuid": "2006d28c-7e5d-4936-b68e-fd0257feede1", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642749632, "uuid": "37cf381a-9869-4b80-bc21-3f300d68cf04", "value": "ASEAN HBL+MBL INVOICE.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76bd96d2-7a6d-11ec-9275-42010a9c0029", "comment": "Malware payload (NanoCore)", "timestamp": 1642737110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642737110, "uuid": "8037a738-2dde-475b-a607-5b8164cba5d8", "comment": "Malware payload (NanoCore)", "value": "dc3b250392e25cf227d0651eea6e7782", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mansengco778-ddns-net", "colour": "#8B7EA6", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642737110, "uuid": "9edda80d-9c6c-4f33-b042-cc8846894c40", "comment": "Malware payload (NanoCore)", "value": "1c048355497ad9461aa8c36b0a16783e459f2e11491bf4fdc6221545a9ae93e7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mansengco778-ddns-net", "colour": "#8B7EA6", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642737110, "uuid": "f8acf402-e2ce-4ca4-b79f-cbb93b51a5ae", "comment": "Malware payload (NanoCore)", "value": "31c5809a700c18d89253eef1ad47c9797bd08747", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mansengco778-ddns-net", "colour": "#8B7EA6", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642737110, "uuid": "21e6b0ec-5556-478b-972a-ca371f8ce710", "comment": "Malware payload (NanoCore)", "value": "4f2ec4d9f1e27a7ccea2a6c3eec81d87dfb88649cf6e23bdd89a1f3a86abeb3e5effa415a3322c966fb442383be43fe1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mansengco778-ddns-net", "colour": "#8B7EA6", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642737110, "uuid": "9beccb7d-074a-4b60-a0cc-a804d037d7d3", "value": "T17E351211B3C244F2E5B32E360935A760A9BC7D701E28CA5F67D41DBDDA360C1A226B77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642737110, "uuid": "10fde201-7976-412e-a1ce-92304b1c0b51", "value": "00be6e6c4f9e287672c8301b72bdabf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642737110, "uuid": "ce80336e-0831-4491-b780-cc48b44a53f3", "value": "24576:6NA3R5drXdtd3dFk8AhbhJVmD0ZRrCvs2675czwFQYc22I3Tl2ls:z5bldJaHmDcR+f2czw6W2Sms", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642737110, "uuid": "601cd2c3-f242-4f61-ad60-72527d47808f", "value": 1118036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642737110, "uuid": "23d39377-c9e3-49dc-8c22-4b41d764747a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642737110, "uuid": "382588b1-e95e-4f0b-8774-2b75219395e6", "value": "P98789-7890.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79d81086-7ac5-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642774911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642774911, "uuid": "37fa802d-dadd-4093-b110-3174ace5238a", "comment": "Malware payload", "value": "ffa2182a87d351d4dc36607527846c0d", "object_relation": "md5", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642774911, "uuid": "c16808da-6f6a-42e3-a3a2-561bf9ffc47f", "comment": "Malware payload", "value": "1cbc8581430d4a524a0805f30ce5368340fc943635c76de083527446508027b1", "object_relation": "sha256", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642774911, "uuid": "41dc5f50-d13c-4d5a-b6b8-6892163c34e7", "comment": "Malware payload", "value": "e23b5f6c8b5d1871f6b96f69a9eff4eb4ccbd607", "object_relation": "sha1", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642774911, "uuid": "e0a9d4ee-5dca-4031-9f06-c470fa92d778", "comment": "Malware payload", "value": "c4ef3793afa1d2c5fe80189f93db03e135dcc44a2cd036270a4cf4a9de14065e0c7a9515d19a357c9a7ab95af6f405de", "object_relation": "sha3-384", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642774911, "uuid": "23c31f14-b5c5-4ca7-92e4-cd7a82056cde", "value": "T1DCC48D57F7C7FAB0E6BE827A86B1891C527774520260A78F674072896D23392493DF0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642774911, "uuid": "8c0fbe52-183b-4fb7-8c88-05fc7af11e55", "value": "a31761b5a590c4c499d5f4a347d75c12", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642774911, "uuid": "1b7f679f-4004-4c12-9cf7-bbe0f34575d0", "value": "12288:1n/zDvGHAykHSzLW/4+8bzbBSreMdjQJVgFK/UqW:5zbGHAzHAjX1bcL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642774911, "uuid": "938dd4d2-c485-4747-929d-248be411c2c4", "value": 567808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642774911, "uuid": "67d34c0b-f8e1-4a6d-8671-472e07bb22fb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642774911, "uuid": "cde33e2c-9d74-4330-b73c-4f4cd3e15c75", "value": "Payment Review PTYS-QRDO-ORDE.xll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f886b38-7a91-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1642752425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642752425, "uuid": "9435a791-d1f6-45d0-a60a-ee3522bb48b3", "comment": "Malware payload (AgentTesla)", "value": "3fdceb60027191736dc4082b6ea72d85", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642752425, "uuid": "48eb5a3f-71cb-455d-bd34-f9963e252c6d", "comment": "Malware payload (AgentTesla)", "value": "1d26c95886033e5aec760fdceaafacf8d6e7d23088b695b9e04031d1061ad0ef", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642752425, "uuid": "5b0c43bd-54df-466e-923d-33df3dd85b68", "comment": "Malware payload (AgentTesla)", "value": "045e5e1b0c4457d64137ce858436b7e13c62a11f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642752425, "uuid": "2810a00e-7591-4975-9064-00591b6514b1", "comment": "Malware payload (AgentTesla)", "value": "1f71cd9ecb0560afcd2aabe93b48758a35bd704403899b395b73b1a0c38aa7c656c0a6859f9422476d743d6d3f687142", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642752425, "uuid": "52f4cf04-6f7b-46c3-9059-a567a905a63c", "value": "T16915F151FF815764CE0E87744579EC309326BCAB2478CA1D1ECE3DE7363A7929610A27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642752425, "uuid": "ef687fd2-f584-4632-b65b-0fc0b7947de5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642752425, "uuid": "9040ac3c-ba4d-4d62-acd5-064236e4d67b", "value": "12288:Kf3Ymy4iiiE9WfXGd333x5t9o0CxNoSZB/HcuhpAvvmYOp/6Iz84Q:KCfXk333x5t9oNxN/vrhpEmYOptVQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642752425, "uuid": "e52aa5e5-1f29-4acd-bb52-feebf05ed531", "value": 890368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642752425, "uuid": "6ece8162-42be-4a4e-9226-943e28d23bf5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642752425, "uuid": "51dc0c2b-191e-49db-b931-e137b3bd5c13", "value": "Swift TT copy USD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a7dd398-7ac0-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1642772711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642772711, "uuid": "dff74636-677f-43a0-a0a2-df64e50315d5", "comment": "Malware payload (RedLineStealer)", "value": "37fc34add834102f66966ed5779dfb84", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642772711, "uuid": "ee6b1901-9019-41d6-97be-15a9af7d1052", "comment": "Malware payload (RedLineStealer)", "value": "1e5ab160557152d712488a1fd2575231013f7c2fce3ac2dac52b9ea90f289729", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642772711, "uuid": "6136a25d-d9af-4f8c-89ae-04d9f374dec8", "comment": "Malware payload (RedLineStealer)", "value": "ccafd511a907f178e89c4a0f4e90d5b08e23cfb9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642772711, "uuid": "078ab75c-0704-410f-abae-370c1fd21911", "comment": "Malware payload (RedLineStealer)", "value": "9e662e11e4fe1254cec213ab6bf167205cfcd61c6a73294d73e887b0aa18f26506398100293bc5dbde3555d8e8f75701", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642772711, "uuid": "6509e642-b763-4028-96a0-e284ada7c2ef", "value": "T1F3F5339E4221D4D9D3E8B73139927EB6F6FDC3471140B8D630B91E8EA265F96DF25002", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642772711, "uuid": "40ade932-412e-4849-bcdd-0089e78a095c", "value": "c284fa365c4442728ac859c0f9ed4dc5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642772711, "uuid": "fcd686ca-19ee-4798-a8f5-2c40de1f2dcc", "value": "49152:eXgzILIL7eXGLW/ZmlQ0bLOmmxzL6jP5MwgSFPV3J4EI2j2pwtOb6fQHgnBcGw7o:eXW9i/Zme0HmwT13AmzYHgBk7MYPQZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642772711, "uuid": "d99e2714-826e-4931-86c7-566d67aecf1b", "value": 3581904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642772711, "uuid": "04603a9f-9ab5-412f-8f21-40a8aafc54da", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642772711, "uuid": "78743f60-f320-444c-88bb-986e3e4bd9de", "value": "37fc34add834102f66966ed5779dfb84", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fdc508b-7ac6-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642775350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775350, "uuid": "f4df1bb0-d782-484a-9a44-9b0fcaa7cf36", "comment": "Malware payload", "value": "3aefc19a0f1c1b36baf49ebc46746174", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775350, "uuid": "9bb43403-3679-469a-8a21-e590194d8267", "comment": "Malware payload", "value": "1ea73303f294c3f3c99b4651232952bfd97956bee1901b772298b58bde101018", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775350, "uuid": "f3c4ba4a-ebb2-47fb-a94c-296079f148de", "comment": "Malware payload", "value": "b721125d80f0d9fbb146d386f3dbb4db83c16bda", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775350, "uuid": "4f67a4d0-ee9d-44cc-8032-2ed3c2c56aea", "comment": "Malware payload", "value": "ae6476782dc9c10567f225c81f0c40575831c4aa1729ad6c8507fdc22e9c9022eeb3428c92c21008fae3aad3aec9f583", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775350, "uuid": "a66c8dae-781c-4fa6-af8b-ea7a91451821", "value": "T12705943C6A82C95FFF8DC571CCA49F34A72B0F6F1A029541B79B61CEAB5A9582C05CD0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775350, "uuid": "560f4220-1fe2-4de2-a6a1-489bcb695c25", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775350, "uuid": "b395cad5-0933-446b-bb13-a7354a53f8d6", "value": "12288:PmzXm3/f508QpWESuMCFQWfuP/U+F+yhG1pQW:PvESu7LfuP/U+FBG/h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642775350, "uuid": "ed6558bd-e6dd-4c3f-b4f5-ffaccb8353e7", "value": 843264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642775350, "uuid": "87b75b59-416e-42ee-82ba-f9736fe6c39a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775350, "uuid": "d8c8c67f-1978-43d2-95a2-746fdd640ac9", "value": "VENDOR FORM - MV BRAVERUS.xls.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f08bd878-7b15-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642809470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642809470, "uuid": "315c961f-ba0c-4362-87dd-a4b2d59c7d4e", "comment": "Malware payload", "value": "20a7f3c5d958fac3d57f9e9fc2b089bd", "object_relation": "md5", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lamberts", "colour": "#97DAA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642809470, "uuid": "745f9887-2abb-4d44-aa7d-407ecb281efe", "comment": "Malware payload", "value": "1eede29007619d207842ddcaadf41b17b47a456004df43189d1f6cf54a3b785b", "object_relation": "sha256", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lamberts", "colour": "#97DAA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642809470, "uuid": "b056e6c5-463d-4384-8415-91ddca95da46", "comment": "Malware payload", "value": "e41ff0d9efe7e7623ee7df593f2e04ce70a1c5d9", "object_relation": "sha1", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lamberts", "colour": "#97DAA0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642809470, "uuid": "eba74241-396c-496f-b7c7-f984bb2b11d2", "comment": "Malware payload", "value": "941d2f199c3e9a3c3116f1c2decaac80b5b3c201298e5685ecc42d8a285796b27321f7e5f6b871fe7a40135bcb8a75ed", "object_relation": "sha3-384", "Tag": [ { "name": "apt", "colour": "#BB716D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lamberts", "colour": "#97DAA0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642809470, "uuid": "086a9fe7-98b2-4c21-9547-4900905d4695", "value": "T15BB30265CBC10832E8764D35813B675092BB4C92B7A56ACB4F6118DC8F34BD23E6897B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642809470, "uuid": "33e2fbc7-2612-4c47-beb2-53439e9f6490", "value": "cca5e1a3ec1131350074741a5f112be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642809470, "uuid": "e6e6e8ea-fb1c-4e34-ae45-5d87d8dcc6c3", "value": "3072:R9hcVzUSWTOkqi2NdMLOUbXQxg7vM9YOi:VcVA5TOo2NdQx7QxSvM9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642809470, "uuid": "25e82a07-8563-4ce6-ad3b-6bf08f732322", "value": 110592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642809470, "uuid": "a71e14f4-328d-4ba6-ace0-7e11ec431b99", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642809470, "uuid": "f9182b7a-ecbb-4a1d-9043-7e015ff11c39", "value": "1eede29007619d207842ddcaadf41b17b47a456004df43189d1f6cf54a3b785b.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfc0a481-7a61-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642732078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642732078, "uuid": "87a1f78a-23f6-4164-87e9-98ba14c8d35e", "comment": "Malware payload", "value": "aa961fd65c9399f04926b35091ac8630", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642732078, "uuid": "f612f1e8-5272-402c-9c1b-6129fabce5d2", "comment": "Malware payload", "value": "1f8d30152204efe7a2f16d965cdd704e5747b278871a5ff1b0048c8c6fc13be2", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642732078, "uuid": "c9177cfe-b371-4e9c-8eae-80f70151ce5a", "comment": "Malware payload", "value": "af7da8802e31d5946a327875060d3f9e751b4088", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642732078, "uuid": "2652feca-0c61-487e-90cb-0e74858acaec", "comment": "Malware payload", "value": "0fe9f79e8dd30abba992ab9d805a124b300fa8598ad32528b3bafd4d8ddd10ab8b83a65a95bdcae498995bff13ac7aff", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642732078, "uuid": "962b93aa-4285-400a-8d1c-b631d48969f5", "value": "T116B32A56E7418B03C0D22B7ABADB42513323DB5497AB23065928BFF43F877EA4E23515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642732078, "uuid": "878a8f71-ee5f-4cf3-948e-2b25eb947cd3", "value": "1536:VUnTao7PGz2l2Eiu2jUsHYgAnZT8TEpXu4pPSzw/9fjlwVnkm+4wCckRbV:+ao7eg2jUsHmnZTwE0M/9frmHwCpRbV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642732078, "uuid": "026f529d-6065-402c-9288-16b89ffc1cab", "value": 112285, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642732078, "uuid": "22002ade-dc86-420b-9d64-48764526ab51", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642732078, "uuid": "4e2e20df-d754-4cc0-8b1d-f1aa8046d370", "value": "beamer.arm7-20220121-0227", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "791108a3-7a9e-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642758159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642758159, "uuid": "3e3b0664-b73c-4461-9956-027a478cb5de", "comment": "Malware payload (Mirai)", "value": "3589e536d48793638924927ccf3188ff", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642758159, "uuid": "a384f002-4854-4419-956e-bcca2c35cd46", "comment": "Malware payload (Mirai)", "value": "1fe6da5a13d03efa8a2cb71fd85f320e84bff991944825a738bad346306b1c28", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642758159, "uuid": "3e22be8c-fc14-4ddb-8cd1-eda4175aa17c", "comment": "Malware payload (Mirai)", "value": "75f1682cde5955919a5516ca2f635bc485afa4cc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642758159, "uuid": "a3794a34-f5b8-4d8e-a93b-801d5dd9a770", "comment": "Malware payload (Mirai)", "value": "1e00572b269d17685a2214b6a253c04a35470c7e68d5fa27d64c2f297a0eba6963afc9b8d968ce92d64937e73157256c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642758159, "uuid": "a8ead3f9-b891-4025-84cc-76574a113cd4", "value": "T17FC33C56FB418B13C4E51779BA9F42463322E75493DB33069918AFB43F86B9F0E63502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642758159, "uuid": "14b6ed85-cc11-4c3f-b80f-fb5a04be8dbe", "value": "3072:amrQK1bmVnILm7EcYxjOFJGar+/M/9tCmM:vrQK1bmOLm7EcwjSGarGM/9tCmM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642758159, "uuid": "f34b7dca-c4e3-4170-b844-7df57980da38", "value": 121508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642758159, "uuid": "94068a80-38cf-48b4-bd84-55d33b8bd545", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642758159, "uuid": "57507b82-b1c4-4b2b-9a44-20780195178b", "value": "3589e536d48793638924927ccf3188ff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "193ebfca-7b04-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642801807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642801807, "uuid": "2502dbe8-2df8-43da-903d-247daefcf22e", "comment": "Malware payload (Mirai)", "value": "18bad3092e30c156b830dec7d972a888", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642801807, "uuid": "4f45088b-c83a-47b7-bfca-1177e77a12d1", "comment": "Malware payload (Mirai)", "value": "2000703f1e64f3060e503df30b7a4a1eb79a56f4f00587db29f2a02b0f30fe22", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642801807, "uuid": "5c567a6b-0076-4b39-9ad7-160dcfd7ea98", "comment": "Malware payload (Mirai)", "value": "77d86180534fa35d3bacdf0c2615b0a855bda583", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642801807, "uuid": "54bdaf07-a511-43aa-a5e2-7886b70d94fe", "comment": "Malware payload (Mirai)", "value": "0c0a3372c950ed08224aaaa8285b8c4d74ed0cd3b5288d5b6056e8e76d384156ad69cc2f336fbf8fe4c3cfdc1376aafc", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642801807, "uuid": "c39d1428-c347-4867-9d47-194ebab9393a", "value": "T19BD2D054A7A0E8B0EF74473EEE384142224713ABF4E8F5DB16948909B24D607D73A785", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642801807, "uuid": "e14b85b8-ec3c-430e-9b87-754429671de8", "value": "768:6FoxdX+IoMKVUfzaP1urxIGyYUzpzAhDxZBLGs3Uozs:6F2+IoXVeNIlzpzATPzs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642801807, "uuid": "fd868eab-f026-482e-acc3-78c699f939f8", "value": 29960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642801807, "uuid": "97db0134-872c-4828-bf08-9358d2b5d9a4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642801807, "uuid": "4f63bec8-e550-4fb3-9ac9-56162f5cc557", "value": "z3hir.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc5c7b18-7aab-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642763882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642763882, "uuid": "9c7b7c3c-6d22-4a67-855e-23b255ec9348", "comment": "Malware payload (Heodo)", "value": "c0cacf7dc9104a2027670ddb932c89d0", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642763882, "uuid": "4a090e1f-35db-4729-8df8-6d8795d39423", "comment": "Malware payload (Heodo)", "value": "20021d65f126efcd0a1c970dd86887a45904ed31623f0ef0f36995d7a1840b1c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642763882, "uuid": "70c9ce42-4b2c-48eb-bbcf-f0a553475501", "comment": "Malware payload (Heodo)", "value": "696cde9f353d9b43cf48142fcd7338b03d3fcaf7", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642763882, "uuid": "fc3d4635-6ece-4e26-8f17-fc2845d88b49", "comment": "Malware payload (Heodo)", "value": "e434e45e99c0ca6a9a27ca5aaf04d318e490c97f2548171d9b50515304dbb79b29d2ec69e18f954affa41d9dd5ee741e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642763882, "uuid": "204bc4f7-d227-4646-9056-5d58ae64a2a7", "value": "T1BED4B011B2E2C07AC1AF0175595297A973F9BE90D9FDC247EFC06A4F5E315828B38722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642763882, "uuid": "9b361ca4-714e-49f4-85d3-5aedf937dbd9", "value": "24b46ffcf60dc8d39e8124f411ebd08e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642763882, "uuid": "f20aa427-6c9c-4110-9619-dd30e0dfb543", "value": "12288:vClISqMT89ornPmGZtn5yzrDa1ywIdO3D7AfojAxOBnVV0KOFD3EPO7:vmTWornPDryzr2ywIdOz7AfOAxsVZOFZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642763882, "uuid": "6ffa7b66-bb7e-4166-8f95-8b8c4ff788ba", "value": 634880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642763882, "uuid": "0ee137fb-e837-4b7e-bb26-c8560af10804", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642763882, "uuid": "8bedc0af-7096-46ae-8d7d-9cca4bf797fa", "value": "emotet_exe_e5_20021d65f126efcd0a1c970dd86887a45904ed31623f0ef0f36995d7a1840b1c_2022-01-21__111757.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bd5419f-7a65-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1642733736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642733736, "uuid": "f4ff80cb-8844-4d01-a6f1-32e8bd87d671", "comment": "Malware payload (AgentTesla)", "value": "2522ed2c083d61aa292a3ede40648fac", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642733736, "uuid": "ef763aa3-8efa-4164-a8cb-bb59b242faf8", "comment": "Malware payload (AgentTesla)", "value": "2061c6390287b5c9f898491888ccd89eab274749296a49591934bc129be8be48", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642733736, "uuid": "6e754ca1-e443-418b-bf01-9eccc5bd8395", "comment": "Malware payload (AgentTesla)", "value": "fd7c9e175df6220bdf3a5d9d7c19b3c93fedf856", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642733736, "uuid": "6e2a6e53-b9f8-417b-874c-9588c4d081d9", "comment": "Malware payload (AgentTesla)", "value": "fcbe9c6303aff715592f734c497e082460dd41c3613d7a2167b04f258f386e45925d3153f243af47198fd861a1392aca", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642733736, "uuid": "194fb0be-b665-49f3-905e-ec0f08d26122", "value": "T14335CE7B21185F99F43F933E573064558BF4A62BE326D2CFBE84A4D74881F02C726826", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642733736, "uuid": "17ffb3ef-9d22-49cd-af3a-0b6144be8522", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642733736, "uuid": "5d215003-8b6a-4533-b3d3-fbccd0995b15", "value": "24576:S44jAIe8ubwmmNMOhd3vhMsHRTlrXviekgwEqWf:RF8ubwPGO/vGsHRBLa+7qW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642733736, "uuid": "bfc7ba81-f255-4761-92bc-c2c35c5b3399", "value": 1152000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642733736, "uuid": "54ea00fb-dd8a-40d9-8ccc-9d644e8b11db", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642733736, "uuid": "e398f39f-aa75-446c-b801-9578b8ee4834", "value": "Import Documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d550b2e-7a85-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1642747348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642747348, "uuid": "f6df75be-6e4d-46f6-994b-e380a7b0be24", "comment": "Malware payload (Gafgyt)", "value": "f907ecef31f594187e9084cfdf347874", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642747348, "uuid": "f7635ddf-0951-4b26-ad21-f6f643879f28", "comment": "Malware payload (Gafgyt)", "value": "2070315e93c53bd4462e58165712c3821da59aa1a780100dc25486e2af6140e8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642747348, "uuid": "088af337-8c71-436f-a66b-98398e93fb62", "comment": "Malware payload (Gafgyt)", "value": "5d201f87bd168171fb1f5ed0025e76bd945eb4af", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642747348, "uuid": "8302958c-9edf-4417-ba23-c0f0dc589f95", "comment": "Malware payload (Gafgyt)", "value": "0ed27152b40a6bc8f006d95f5495ada17c6623849d52bdedb7733d8384cc21867892e3910242b777287f93b41e818509", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642747348, "uuid": "a6af79a4-3a79-43ae-940f-3b40fe72db85", "value": "T138934A17B653C6BAC0874BF41BDB9A314923B8BD0B227206B3D4BCE67F165A61D19F40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642747348, "uuid": "58c47684-f2ce-4a19-a40a-4be5f9d3e4a1", "value": "1536:p7rHXokXsWFVSzkfLEkZAT5ipG5v31phauH/VPNlDDUg6I9um2Xj5YZb0e:pcCPOkfQfNipGd1phaE/XVog99um2XFY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642747348, "uuid": "48d528a0-4485-40cd-8795-f0927776e352", "value": 94012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642747348, "uuid": "3c2034c2-4043-4207-8d89-52b600d42e85", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642747348, "uuid": "6a691dbe-20a5-4d92-8140-675fbf8e89d2", "value": "fuckjewishpeople.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a385e261-7ad5-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642781853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642781853, "uuid": "5339a147-a5f2-4c67-be0e-395952cf0e6f", "comment": "Malware payload (Mirai)", "value": "4bc3ced88a8db560f3c7360f0b899cc4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642781853, "uuid": "7279daba-a5e7-48d3-a27b-6758d4e66567", "comment": "Malware payload (Mirai)", "value": "2079f6a507ec086596c405b77e74394a6a91c99f823443aee9583034ebed578b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642781853, "uuid": "60698507-898d-4f65-9e45-f7efd2f96e01", "comment": "Malware payload (Mirai)", "value": "358633ec6d25d179b93930f48aa092d47fcdd340", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642781853, "uuid": "94deda91-bae7-4b2b-8350-e4950c8f2399", "comment": "Malware payload (Mirai)", "value": "d9c215e346ff02f541e8d303fd1bdf11e9c387bba07c3d347e1b292cc24293d48ce5c916431472b3f063a66e12549373", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642781853, "uuid": "c836db70-7acd-4eaa-97f1-8b51f5ab47de", "value": "T1E673A80E6E618FBCFB5A823487B78E20A65833D627E1D541E15DEA111EB034E741FF98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642781853, "uuid": "993b65ba-1698-4682-bb7e-a3ef77665502", "value": "1536:YZIJO4rSB6xGqzEINCRIxuF9IJajZvGIyv:LPOBjqzEsxxuF9IgNvde", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642781853, "uuid": "f9d8c93b-767b-4723-b218-d6f589bb9b7f", "value": 76612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642781853, "uuid": "5888ecae-1f3d-480c-8d40-e5da3c2130c5", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642781853, "uuid": "b57f70f7-e6de-42a8-b067-0c023de2c213", "value": "4bc3ced88a8db560f3c7360f0b899cc4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfb0ffe1-7b06-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642802945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642802945, "uuid": "c2cd8318-43b2-4ec6-bad4-a5acafc01804", "comment": "Malware payload (Mirai)", "value": "4865503e59d92de1c0755471eb0d9124", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642802945, "uuid": "adc6500a-0201-4053-8abb-51530ed91da8", "comment": "Malware payload (Mirai)", "value": "20d6c17dec5916c2472a812cf3a234fa1f19c116b99df2b7ad4bdf554735e4f0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642802945, "uuid": "fdedb0dc-d851-4240-a165-8815bbf6ce98", "comment": "Malware payload (Mirai)", "value": "0355ce0e76370e087865bb2e9e00f5d9485153ac", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642802945, "uuid": "27ef679b-3923-42a7-a7ed-5e7d79b977e1", "comment": "Malware payload (Mirai)", "value": "ef435e4099ca8b3fdc49a78f5127af9bf32fd5dd62c2c362d84caaa1db07607a9b2b63ab82ad9d3674d25ade62b257c8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642802945, "uuid": "1c0740ea-4b91-4ce5-967f-86125eb34253", "value": "T15CC2E1B1D10E8DB3FFBEFEB04BC5D8E23F86469D2852D8E260556B2606B243A54109F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642802945, "uuid": "178e32b4-101c-42bd-810a-d9d8d572843a", "value": "768:z9xqNa7PqLefxslATOTIAA6Q7dHGKKdPBKp0+Owxw4uVcqgw090:iNLaxsl8X6+dDePQwt4u+qgw090", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642802945, "uuid": "86015ba4-94d5-480a-a72f-ef0dc6f40705", "value": 28280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642802945, "uuid": "34f868b0-fa2d-45ae-92f8-ed911503c189", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642802945, "uuid": "f48671b7-80c4-4271-80ab-7cbc54fccd28", "value": "4865503e59d92de1c0755471eb0d9124", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0453d0f-7aad-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1642764694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642764694, "uuid": "b9acaa0d-0f56-4b0e-9428-1f447d97ba87", "comment": "Malware payload (Loki)", "value": "011e7c900822891fd03b10eda400171f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642764694, "uuid": "e5019e3c-f647-4652-9a0a-adcf16590e83", "comment": "Malware payload (Loki)", "value": "21a1ab9591985a3a8494a76890362732411219d054d580ad195597fb8add76d3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642764694, "uuid": "e709bae7-f2b7-4ea3-b171-150483bcb146", "comment": "Malware payload (Loki)", "value": "1640034e1fbdfe5eba1d18feb1392d15e92a51bc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642764694, "uuid": "b5620f4f-befb-4140-ac3d-99d89ccede45", "comment": "Malware payload (Loki)", "value": "9fff32dce0e8379d23094550ab148f3455256272d0944a893b90dac1a25f1a97e55ea685e58ce308fc50532e6f927523", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642764694, "uuid": "e2b180e4-af2b-4dcb-bd34-3778d30f3b22", "value": "T1D85422A971C55CEBE56C0878257F877AF3B8B0A41160264B772C8D7CFD12192DE293A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642764694, "uuid": "e44cd63e-4afa-49b9-a4cd-dfd505ebf863", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642764694, "uuid": "42f50ee6-b813-42a4-b042-2ad9d7264105", "value": "6144:owtxS1iezM3LacQI+rNE51A8MIZsaWiGx+d5svcx8wph09xxL:pxSXY3ZQIoa51HMIZsaWim+LsvlUq9x1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642764694, "uuid": "5047631c-7869-4d21-8419-6360e97de922", "value": 302054, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642764694, "uuid": "b343a607-9402-4af0-9ccc-90d13a59c409", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642764694, "uuid": "f1133c6d-cf81-462f-b1d7-5e8e9301def3", "value": "011e7c900822891fd03b10eda400171f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a86a14c1-7a8f-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642751796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642751796, "uuid": "0fb1dee9-ab0d-4c92-b91a-d4b839f59ec4", "comment": "Malware payload (Mirai)", "value": "ae85a3a588dd18f9a589ad4054bc3291", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642751796, "uuid": "0db5e60c-3015-4047-89ca-fc2c67fa0077", "comment": "Malware payload (Mirai)", "value": "22d10353032c76d229ce1bdfe6e0eb822b644c5686697bbe67b36f5dcc892bf2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642751796, "uuid": "dc81ae3d-51ac-4da1-bb80-e03437bb66d8", "comment": "Malware payload (Mirai)", "value": "d21028b80520d4401e51a6f6ff491921d3783b90", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642751796, "uuid": "e0b0d371-eebb-4fd9-adcf-0c97c6960459", "comment": "Malware payload (Mirai)", "value": "9c39ffacc0111c60f62d3b1c580fd99c038b4955744a44261ecb9c4450ee20a982de4f020becdbd761074a5ec96816f5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642751796, "uuid": "a58a72fa-48e8-443b-b4df-b25e01838b55", "value": "T12B832982F881A612C5D9167BFE0E018D332653E8D2EE7213DE259F6237DB56A0F7B051", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642751796, "uuid": "af6c19ec-e64c-4e6f-ba06-66f9c8af2851", "value": "1536:Rpe+oU6IQK0TiF738sf4OGCQCndFZv1EQZcIwqFBFAjTWXAaO77J3vUr:RrV0zs/GLMdFZv+i77FBCjTwAaO7VUr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642751796, "uuid": "bffc4799-8145-4dbb-aedd-abcd394ef89d", "value": 87328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642751796, "uuid": "f55ef203-6abf-4cd8-8e6b-30f3644a121f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642751796, "uuid": "08f1851d-b3d8-4bd5-9739-dae9157f80a7", "value": "ae85a3a588dd18f9a589ad4054bc3291", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8878464-7a8d-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642750991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642750991, "uuid": "699bc92a-f7b7-4716-b1f1-0ed477101628", "comment": "Malware payload (Mirai)", "value": "73393a2672832b8b9655f7a11155c492", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642750991, "uuid": "0134adc7-268c-4809-adb3-07b5fb4df572", "comment": "Malware payload (Mirai)", "value": "232ac956532a4880b2c8d0470ca8e8820643659dec690083d718e636007bbc90", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642750991, "uuid": "49c7ec53-3ca6-4ec1-b3ad-264bf7cad4f6", "comment": "Malware payload (Mirai)", "value": "299bd5abcff2909f6e252a4a0843b9e011401cee", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642750991, "uuid": "6c942cc8-f063-42c3-b261-3cad16bb19b7", "comment": "Malware payload (Mirai)", "value": "8ee441b4c6264a7a4447bfa0a60b6ec0d2aa7e5e785169841be7e67779fa355a7f40ae7858f2f2c35a7fcdc4d836e4bf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642750991, "uuid": "0b86cece-3094-40d5-8133-5fbf3194ece9", "value": "T1D0F36F8ABF903FFFD81ECD3341A4DA06129C590952A9AF762F74E408F65B10A59D3C9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642750991, "uuid": "deba7b73-52aa-490e-8714-267f428338cd", "value": "3072:xPO3CAkdEgpM6Nh1Y5OUh981gKswJxwuek37i:x8CAkdnpMEhrUh981gKswJxwuB3W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642750991, "uuid": "3b39f9db-491f-487c-9146-9dcc19f666fd", "value": 157504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642750991, "uuid": "bf29600f-b25e-4d5d-b4ed-50dbc63f1fb3", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642750991, "uuid": "6c3731b4-2921-413e-a4c7-2a2bf9bf3711", "value": "73393a2672832b8b9655f7a11155c492", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98171a63-7ac5-11ec-9275-42010a9c0029", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1642774962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642774962, "uuid": "3c749fa1-ea2c-40c4-a00f-9160141e0017", "comment": "Malware payload (AveMariaRAT)", "value": "e9dde8402a94c071c4a16a0fa262977f", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642774962, "uuid": "95cfa8c0-745c-4d03-ba01-f62fc5a00966", "comment": "Malware payload (AveMariaRAT)", "value": "23c7d333c004df5da90ea922cd5bcd878cbfa68921426d3e543b7f3790c45881", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642774962, "uuid": "9567d421-3fac-482b-880b-4704609404ce", "comment": "Malware payload (AveMariaRAT)", "value": "1af601e0fde95973c5f23e6417e37044914802f3", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642774962, "uuid": "2067a82b-8d7a-4f8e-a641-a9aa83938dc7", "comment": "Malware payload (AveMariaRAT)", "value": "3b7d7a5ed9e5aa9912812ad66e39bb2dd4fc778e7235a4b7573cbadac82c3970b52b676876e70285bd32e9b7973dafbe", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642774962, "uuid": "e372c11e-54ad-4d0a-8411-76a74d3c2ea1", "value": "T11313E02CCFD94E6ADA4B9074591EB9918586AA81D381DFCB0F1CD20F5984CC1136BFAF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642774962, "uuid": "b9400029-1054-4a85-b692-8bba7e706f34", "value": "768:hvRX9vnssnr4BIJYfTH+niSpXvDH7Cv+nWYFFiKk/fUqtMGimRQ+nwLdeA:hvXvnTr4G1BhT7Cv+vFFi3/MqiRmVwL3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642774962, "uuid": "f90d0bd4-f57f-4947-a2f7-9591b1f786bd", "value": 43425, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642774962, "uuid": "c54c1f8b-d117-45bb-af21-b19e18d2b883", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642774962, "uuid": "7d3418f0-cf04-4671-bd47-67426d3d53a7", "value": "INVOICE-20220120.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6a2e5b6-7ace-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642778986, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642778986, "uuid": "d2921e04-a41b-4ce7-8630-a71f569915a1", "comment": "Malware payload (Mirai)", "value": "c4a60c5144c16c8133514b7928a93d13", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642778986, "uuid": "a82e96e7-1d7d-44b7-9a5b-b8a3ca363f12", "comment": "Malware payload (Mirai)", "value": "23e3ec5590654c9274256fd84401534eb7fb4daba00a4d4984f47c0350dd585b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642778986, "uuid": "8ecee3ac-b224-40bf-ab68-01972cf21fec", "comment": "Malware payload (Mirai)", "value": "2d584375eb049db21130fb597d9dfb4ba43fbec1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642778986, "uuid": "3db86cab-62dc-49de-bc3d-42985ccffea9", "comment": "Malware payload (Mirai)", "value": "45755e1486dac8a740e73132d4f4cf60766ea8753a72939cb54a48bd1a73e63c54144ebc50fa09fc4986d90e27ee397b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642778986, "uuid": "65f4bbcf-5c1e-4c81-824e-6fd273188fab", "value": "T11334E09ADC419F74FAD416BEFE2F074977B35BF8E2C271208521C21027D965A8F3A948", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642778986, "uuid": "c047d14e-cf3b-48c3-b582-ee7b7920209f", "value": "6144:7O/QJHZweEL/NOjCHm7FZZncaoNsKqqfPqy:78QpZsKCaiaHKqoPqy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642778986, "uuid": "a3e1b33d-0d1d-4bac-b09f-1b6949b3f1d9", "value": 234762, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642778986, "uuid": "06e423d5-78a3-46a3-9631-0d4140cf74c5", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642778986, "uuid": "ee30670b-49c8-4bec-80b0-59e3adc039e4", "value": "c4a60c5144c16c8133514b7928a93d13", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48243348-7ac8-11ec-9275-42010a9c0029", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1642776116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642776116, "uuid": "9f3f8667-29be-4c30-becc-8e86ecaaf859", "comment": "Malware payload (ArkeiStealer)", "value": "7e15d262ccd214ffe30b5d2a68bf56e4", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642776116, "uuid": "af9caf14-61e4-4a7a-abce-01b01915f4e3", "comment": "Malware payload (ArkeiStealer)", "value": "2533988e9f91942374496eff84c8de129d542f8f998fd16807cc0ba34dea62d5", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642776116, "uuid": "10b12ad2-2b7e-4629-91d1-1adba5814e63", "comment": "Malware payload (ArkeiStealer)", "value": "eb89d690cb604b8c828550ed1e216ae02532077a", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642776116, "uuid": "b6ff3731-260e-4e74-9ad9-44d995bca86d", "comment": "Malware payload (ArkeiStealer)", "value": "bc14ab8e45ce23964d46ba007b25a7f643a85c4737675c7b3568dbaa35a12b9a7b43d9fe420787c6cc050169b86bf7d9", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642776116, "uuid": "e5c30d3c-35c5-4f50-939e-e4f703e780a6", "value": "T1DB747C00BBA0D435F6B311F449B99378B63E7AA15B2490CF52D16AEE9B356E0DC3131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642776116, "uuid": "106fb6e7-9030-42b8-a812-218e0ac03ab0", "value": "0152c21ced523378d45e83b1b3a1fdf0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642776116, "uuid": "556b5de7-145c-4d0e-be80-a09ed7457680", "value": "6144:0Grnr14p/NC6K1N7hPgFzPOvW/BD3iZipltLcWbB+mFC:0GP10RsZhPEPOv6D9ZcWb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642776116, "uuid": "4ead9100-576e-4b67-a282-f998b2cbf0bf", "value": 339968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642776116, "uuid": "caea8470-80d1-4e4a-8c36-558a0f82ee21", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642776116, "uuid": "2a25e517-125c-40e4-9485-f3666d31cdc7", "value": "7e15d262ccd214ffe30b5d2a68bf56e4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e16d68de-7a68-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642735141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642735141, "uuid": "9d90609c-fa55-4888-a899-a8a40ca94814", "comment": "Malware payload", "value": "709fedc6247f6c7a93dd570e15010dbe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "surtr", "colour": "#AAE414", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642735141, "uuid": "86dc2212-454d-4521-b96c-8e5b0aa80ac4", "comment": "Malware payload", "value": "267fa786176679a2d99bf4d47cbcd8591640452ff393af7d61cfd5c0d8e67f33", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "surtr", "colour": "#AAE414", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642735141, "uuid": "87a57ee8-ba77-43ac-a64f-3830071515f9", "comment": "Malware payload", "value": "a3b061339364f053f521c894b0d5f08516fee493", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "surtr", "colour": "#AAE414", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642735141, "uuid": "7434e9e2-e9a9-43e1-a7f1-a8bc266b9a56", "comment": "Malware payload", "value": "7859dc49e21028b31e71a48b0e5a27686bf19623c7e1f7f952f0d24ce5e31de2c2dca988c6ec9b6649a176462f091c5d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "surtr", "colour": "#AAE414", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642735141, "uuid": "0980752e-7384-4e4a-b723-741e71bc1e28", "value": "T18784F15B73A570F8D47656348D714A0AF7B6B83203358BAF136413A62F232919E7EF21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642735141, "uuid": "2803706e-ebf2-4d05-a045-c055c4cfb3dd", "value": "dc2674579d8467837a92f4344084fc20", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642735141, "uuid": "9c31c8b0-a6d7-4a0c-8f10-d6c80a18ed5f", "value": "6144:Q4K8rYBWqjbqL7dCc0RmXmgyJkmq6GO74l85SNVCQj7difvD9m0iUAyexMwJuP:Q46QKbQw/PgyJLGi4lfNkQj4uJuP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642735141, "uuid": "19ce2c38-2f30-4d2a-89a2-a2dd7f21b334", "value": 392764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642735141, "uuid": "670d17ed-587a-4eec-91c9-32277500c4a0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642735141, "uuid": "c1e6a8d6-9676-4e54-81ae-d61f8f38b50c", "value": "Surtr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74977950-7a9e-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642758152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642758152, "uuid": "3e859d98-ef38-4c66-9b5b-292cfbf32df0", "comment": "Malware payload (Mirai)", "value": "d37f53ba0f43b9e893b01049ff706c70", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642758152, "uuid": "d79883b4-9fde-4aa3-9bff-705eeb7ffab8", "comment": "Malware payload (Mirai)", "value": "27140d28682e82e5f5e5347b59ea5e1630e5a889de636697c62f671c2cc516ce", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642758152, "uuid": "26180e73-d9ca-4d92-a0fc-5bc2fe8ea9eb", "comment": "Malware payload (Mirai)", "value": "fe3d4db2e9428a5a5a03d27b284e08dbe25f7cd6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642758152, "uuid": "c15ea401-6e23-44c4-9a5e-4b7744cd99ee", "comment": "Malware payload (Mirai)", "value": "1d5d45e560688986dc50c104ef39321bbb5a9457a507685976f6aa9412e85abd61755c073051b9981e7d354802027dd0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642758152, "uuid": "3e80194c-6dfa-4e52-8dc8-a8bab06848dc", "value": "T13353A70E6E61DFFCFB99863587B38E21964833D626E1C684E15CDA001E7434E645FBAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642758152, "uuid": "e443e78f-8129-4810-b0e8-4c3f31035013", "value": "1536:WCZFLheUX4CpN9XqykzezC7oUvFe1R0EvR:WC3Lo+5V+s6Fe1mEp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642758152, "uuid": "2ffb828e-cce7-4230-9388-102a1ef7c944", "value": 64588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642758152, "uuid": "35c0d414-dd9e-4b48-b919-c090eb75ed20", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642758152, "uuid": "4eab6193-c12b-4c11-b415-fc4211042af6", "value": "d37f53ba0f43b9e893b01049ff706c70", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8677b9e7-7adc-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642784810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642784810, "uuid": "4f196bdc-fbe9-46eb-9e5b-8b8ae06e1132", "comment": "Malware payload (Mirai)", "value": "81a864396ed563b294bbc5e5c8940afc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642784810, "uuid": "f00d37d6-ffc0-434a-8519-018b4616ba73", "comment": "Malware payload (Mirai)", "value": "273428400933d54ef2fbb5dac8a714e001214f8e84bb9e134c77b773ba14f2f6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642784810, "uuid": "0ff78519-1726-4a2c-bdcf-652ab1bcf843", "comment": "Malware payload (Mirai)", "value": "0a3dad03f3a8787589c48594491360d619697b8a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642784810, "uuid": "bf0e2296-3696-4895-9d9e-ce345bf40763", "comment": "Malware payload (Mirai)", "value": "0f232f42c6b6599d511432b405a994b306cefe65f7a7ee01a66385832eb602a4a07232695fe643fc668200c7ee5de5e5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642784810, "uuid": "e4d9a2f9-124f-440f-9181-b240a5a118c0", "value": "T1BDD2F130093166B1D1A00475B6F9ECC23FBDBEB690AD7613671C4D30CE92492EEE8187", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642784810, "uuid": "3edd88ff-7331-401f-88ef-032612a78f7e", "value": "768:PHMR4CdldBqGTtNVn4LngeYXR6Ct9q3UELCrq:Pc4C/dBqGTtNVn2gNXR6CALgq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642784810, "uuid": "858b331f-391f-4433-be92-df3b8eaab760", "value": 29588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642784810, "uuid": "d556fbdb-ba7f-4ca6-a638-343854097792", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642784810, "uuid": "0747a317-9435-4d19-9f1e-e1137313fdc4", "value": "81a864396ed563b294bbc5e5c8940afc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a127934-7b0c-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642805405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642805405, "uuid": "13652550-ff60-4fb8-955e-033628e45b1a", "comment": "Malware payload", "value": "ccc8a273e4b372148167d42fea91b46b", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642805405, "uuid": "ed084de3-dc45-4195-9492-c32578dd9a4c", "comment": "Malware payload", "value": "275a33d4aa3ac337b6971d6e23314cc93b630480e8062076b6e12617efe3d647", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642805405, "uuid": "3d8e1809-ad66-4141-a985-6dc350f6971d", "comment": "Malware payload", "value": "bd39099020a5fcfb779c05ca48eb8caf402cd104", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642805405, "uuid": "cac847f2-2ecd-41a1-b4e1-236415f39d2d", "comment": "Malware payload", "value": "38421b2fe95df2748bceb7797e691de886c634d4b2d23a353aae403e873c4ee0a891425ea223b6a528a2d196989d0483", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642805405, "uuid": "d9bdd756-a255-4600-8c9e-46b6b05d6d14", "value": "T14243F1D4A642E5328DB9EE39EA3201C32D1D6EF4D075B07DAFB11A6B4C82783311ED59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642805405, "uuid": "3290daa8-5a32-44d1-a48e-7da69c9b2249", "value": "1536:nBC5f8sIMLUzAWUowcb0Y+3KmxDppQjv2v1LPFc3:nkEsRLd9owi0AUDHQjYLa3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642805405, "uuid": "974b8e3e-9a41-4836-a539-a2f2be2d30a3", "value": 58400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642805405, "uuid": "5668d351-8035-40b0-ad2b-911314da27a5", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642805405, "uuid": "90384312-e5b3-47f4-95ff-71c497f7b70e", "value": "KKveTTgaAAsecNNaaaa.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "620c3db2-7a9b-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1642756832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642756832, "uuid": "f57ef034-c179-4184-93d6-12b548c35a10", "comment": "Malware payload (AgentTesla)", "value": "72bf4b9af9f78cd262ccbd6ef5c56e29", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642756832, "uuid": "d4585bcb-d85e-413d-804a-7c83c40c1448", "comment": "Malware payload (AgentTesla)", "value": "27c4bf113643ed861e1b39dd765a3db1bd9ae429ba5251da5a6699cdaa55fc19", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642756832, "uuid": "a7ac7e66-4aa5-4476-b251-ac49524a6777", "comment": "Malware payload (AgentTesla)", "value": "c715eab579d08eb10d25216c496d2950fd86b3f2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642756832, "uuid": "98713720-cf1c-4245-8f25-c2b775dde5fb", "comment": "Malware payload (AgentTesla)", "value": "7937496d7534b45b1a5c1f4a05dc13865fcdd3246e49417e8a2cc7635a6136aaa0a2ef7ec3e7419d16991801b940e3d4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642756832, "uuid": "54734c4c-8608-4227-a354-64c8229893f2", "value": "T181E4E04033F88B45D97E8BFA5875109017BEBE0EA865E34F9E91B1CF0DB1B809626753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642756832, "uuid": "52408180-35d0-4bf2-8c01-3d4c8aca53f9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642756832, "uuid": "c69db09f-59bf-4b63-804f-3e22d4bfb49a", "value": "12288:paWEMTpQHmL7X3D833sioWaemRP1Hsjy/z0i2du66q6+ievYF:FpQHe34SWmn9/zcdu6h6+ievYF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642756832, "uuid": "1b98f8ff-87ff-4af6-a216-6c8567746c8a", "value": 720896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642756832, "uuid": "a436aed3-e61d-4d1d-904d-a7e831e3fd20", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642756832, "uuid": "ac1a2139-d82b-4d01-9e24-af1cb98179e0", "value": "QUOTE THE PRICE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cf751fa-7acb-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1642777466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642777466, "uuid": "d86bf877-c11d-4db8-9e58-b5ade19d245d", "comment": "Malware payload (SilentBuilder)", "value": "80a610c1b3fe990e8b27c3fdb0cf89ab", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642777466, "uuid": "48f49c39-d63b-4b28-9d63-16a7b7ae1aa8", "comment": "Malware payload (SilentBuilder)", "value": "27ef3a20b4ae92e0c1475f0a9537371020e7a592fce6913bf24a21ba0ad9ffb1", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642777466, "uuid": "2cd6d6b1-b157-43e6-bd35-ee40c2025f37", "comment": "Malware payload (SilentBuilder)", "value": "88c620ad5b548700b124e8e47022035cf007b176", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642777466, "uuid": "eebdd9a4-4178-40bd-9aee-13101268999d", "comment": "Malware payload (SilentBuilder)", "value": "b12b9f4f992e25c31d555e63cd68ed677173c2bfcf4a15ad4f85551fcdb031e2d8141f1d7bb016ead107145efaae0f17", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642777466, "uuid": "4022ab8a-a3bc-4cc0-ae86-3e2782de2c8a", "value": "T19E636CA7B78299EADA0483394DB643C5B717EC104F9A43C73694F7346EB49F08D9324A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642777466, "uuid": "705e67c7-fc22-48a0-bd7a-5bdb2b229e49", "value": "1536:bpEk3hbdlylKsgqopeJBWhZFGkE+cL2NdA8eXZiozeOgXVZKyaZpvyR1kZkJvU+:bCk3hbdlylKsgqopeJBWhZFGkE+cL2Nr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642777466, "uuid": "9924e9c2-3d83-47a2-89c7-282d98d795ba", "value": 72390, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642777466, "uuid": "d0d37a82-b268-4c7a-bc40-effb2a4c66c0", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642777466, "uuid": "7ae91214-202b-41ce-a71f-66af93feb8a0", "value": "Invoice.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b7b9443-7b16-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1642809515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642809515, "uuid": "e71d7bc5-c8c8-4b07-8090-c3ea5711ce72", "comment": "Malware payload (Formbook)", "value": "71899e3fb25c4c006de92ee2d13471c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642809515, "uuid": "00a97155-b831-4779-8a09-be300a8f0c54", "comment": "Malware payload (Formbook)", "value": "2838dffa365f3f4d1b7b4c766cea66dc2be629fe7991c112894a40acae72e601", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642809515, "uuid": "d8d81d9e-8dea-4239-9b7e-b3295ddf6e77", "comment": "Malware payload (Formbook)", "value": "181e3f00b56afdf6a51a90011fee175dc80e94d5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642809515, "uuid": "6d400f22-9117-4921-8e50-6e257df3d41a", "comment": "Malware payload (Formbook)", "value": "55bdb5ab95545485f52b4d2e27faeea9353fdc37f7e40f50dcd3af98197c0de4d85ccc1ad6fc059f31921837622d2e18", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "pif", "colour": "#A6A680", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642809515, "uuid": "2dc79cc5-d6cc-4f5d-892b-4bf441bcfdf6", "value": "T17B641308A1C3D5A3D45A24326BB3633EF3FFD34A969221B72F926E7660601D1161EDD3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642809515, "uuid": "7b12fbd0-293b-4a92-bafa-d21ed41f512f", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642809515, "uuid": "7d561ee3-9404-4dcf-a219-aaff98b2e83f", "value": "6144:owEFV99w68v4Yu9346uEB7GV2TBdczmQ417vrpZ1vZ:gF8o93VuEBiEczmBl7Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642809515, "uuid": "88562442-6d4b-415d-b9c7-a02166bf19d8", "value": 310297, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642809515, "uuid": "049773b4-7ce5-4bbc-8253-6ab38a0c1640", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642809515, "uuid": "47af5670-5d13-4455-bc08-e2fc15177bb6", "value": "SKM-0614483-pdf.pif", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb90cac7-7a67-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1642734729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642734729, "uuid": "c8db1190-36e3-47c9-8b65-44927e045424", "comment": "Malware payload (SilentBuilder)", "value": "aa1f2dce468dd013ea7afbc1d3f205bf", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642734729, "uuid": "4c84907d-45d2-4528-9872-247e0279521f", "comment": "Malware payload (SilentBuilder)", "value": "2847438e4b48ee5f630b8d0a3d5361bf4071aa308d8999a69cba995fa548add5", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642734729, "uuid": "2ecf308a-bccb-4760-9012-da30c96782db", "comment": "Malware payload (SilentBuilder)", "value": "50ecd71146b46cf2afb66fba3c957896c2f79d38", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642734729, "uuid": "4cfc7a28-bd62-4f98-b068-50b05d397482", "comment": "Malware payload (SilentBuilder)", "value": "75ca44e649b3e677783591e39da4fa826206ae908addf1e8d6a38465bfd84422561b217da2b054746bde699dea07d889", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642734729, "uuid": "541ad370-246f-43d0-93da-4d69dad0439c", "value": "T10C636CA7B78299EADA0483394DB643C5B717EC104F9A43C73694F7346EB49F08D9324A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642734729, "uuid": "c81ca15e-198c-4e7f-be3a-81dbbbf339e9", "value": "1536:bpEk3hbdlylKsgqopeJBWhZFGkE+cL2NdA8eXZiozeOgXVZKyaZpvyR1kZkJvU+:bCk3hbdlylKsgqopeJBWhZFGkE+cL2Nr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642734729, "uuid": "9133bcec-96a1-4c48-a64f-ae767c522b49", "value": 72046, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642734729, "uuid": "8b0215a7-1889-4d1e-94ac-92b49ff1a654", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642734729, "uuid": "f680930c-bccd-4534-8254-547324d968cb", "value": "aa1f2dce468dd013ea7afbc1d3f205bf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "742bb8d8-7a7e-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642744407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642744407, "uuid": "5ba33eda-cfae-406b-ab3b-89d0b29f1861", "comment": "Malware payload (Heodo)", "value": "3e1848e9589561d5605a85ecba0bbeea", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642744407, "uuid": "a8ba6dfe-f64a-4e9d-9ec8-26c02a4b0edd", "comment": "Malware payload (Heodo)", "value": "29111d8e5e8306e76660db292e7232ab39e901955014eede21e912c931a09b5f", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642744407, "uuid": "aa821015-aef2-4c65-84e8-ef49cd113255", "comment": "Malware payload (Heodo)", "value": "5b7e2ca5ccb64cc6acd1671e10c050b5bc74d67d", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642744407, "uuid": "e405bdd5-6967-4b56-8a8e-163550a1f9dd", "comment": "Malware payload (Heodo)", "value": "ffdbda3784ab90d562d8a4e4b749125e7c27716b8c6d1289aee18c650ec2fe3e8eae408329cc1d10c00905bbecef07af", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642744407, "uuid": "5ecd4ab6-2e26-45b8-8066-efa8583392e9", "value": "T1A1636CA7B78299EADA0483394DB643C5B717EC104F9A43C73694F7346EB49F08D9324A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642744407, "uuid": "64d6a891-be4c-44eb-b1a4-66296297ae4f", "value": "1536:bpEk3hbdlylKsgqopeJBWhZFGkE+cL2NdA8eXZiozeOgXVZKyaZpvyR1kZkJvU+:bCk3hbdlylKsgqopeJBWhZFGkE+cL2Nr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642744407, "uuid": "24bab3a5-f145-43b7-8576-1e994614d5cd", "value": 73035, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642744407, "uuid": "ed9a3a9a-339e-4de3-bd66-7c0f0b1b56ac", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642744407, "uuid": "91233d5e-8f65-44f9-8286-cffb385b7871", "value": "3e1848e9589561d5605a85ecba0bbeea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d369ee7e-7ae5-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642788805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642788805, "uuid": "90d5921c-9f26-4258-b70e-8fc48a00c98f", "comment": "Malware payload (Heodo)", "value": "8b3d88fba8ae4db5abd7a1dffe455bbb", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642788805, "uuid": "8ecc6997-d28e-4f87-86b0-6611f5b6874e", "comment": "Malware payload (Heodo)", "value": "2995862500f39cd0ae48820013993fa63a352f614d7caa0286543b2c765b9527", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642788805, "uuid": "b6716c3c-45f9-4de3-b3b1-1fded2be8843", "comment": "Malware payload (Heodo)", "value": "d94940ab67d598d3d33a6d8a6d86e28af17f2faf", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642788805, "uuid": "13c968c9-545a-41e2-850d-af18e31d73e2", "comment": "Malware payload (Heodo)", "value": "0ae0a30e8486641ddd66bd86e0d724ced253ef98e7b8df11879581855b5d91b0ada871756bfa1b16ba12e9a6097a1e74", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642788805, "uuid": "60d2fa5b-a00f-4460-af9c-ff2494883332", "value": "T1F4D4BF11B2D2C07AC1AF1674596393A463F9BE90DAF9C257FFC06A4F1E315828B39712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642788805, "uuid": "88eb5f36-1737-40f0-a858-4e44ff27d854", "value": "24b46ffcf60dc8d39e8124f411ebd08e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642788805, "uuid": "75cfdfbe-cf94-41d2-abfe-c8cfe82efb4a", "value": "12288:kqdJaxkOWFornPmGZqnTFWbDbUYVubhesslBvQqEPO7:kOOsornPTwFWbkYVohevBoi7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642788805, "uuid": "2e34a5d2-0865-442a-a0bb-a5101ed82586", "value": 626688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642788805, "uuid": "6abc8a71-6c1c-4902-aae9-6f65464cc4b4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642788805, "uuid": "f409039c-7998-475e-924e-51aa71543ca4", "value": "ssd.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98e6464d-7a75-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642740603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642740603, "uuid": "e2696c58-947d-4b80-8cfb-e849e68cd543", "comment": "Malware payload (Mirai)", "value": "a76e2e6437b384772b6ee03037a6d632", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642740603, "uuid": "c1340635-1915-4cf2-b852-e5d64b3f10b5", "comment": "Malware payload (Mirai)", "value": "2bd730dc891f395d5bd663c9113ca86d23d046ecfb92f4b7ab28ad72cb40296a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642740603, "uuid": "9388139c-8e0a-4a39-81da-13094e7d2c24", "comment": "Malware payload (Mirai)", "value": "0640e30d9ad0a973536e9805b762748ddc267277", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642740603, "uuid": "7513e650-51ed-46e6-8963-53492827022a", "comment": "Malware payload (Mirai)", "value": "28ee074e8858bdeabc75cc62a81c7101f39e88f049aae00b314b7448ffbdac8f455dd2e941c713337ece10c35a2fb6a8", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642740603, "uuid": "75a27bcd-ccf3-4537-a51b-eb0fa976488d", "value": "T11EB3084ABD816F11D4C612BBFE0E1289335367ACE3EEB112DD105B21B7CAA6B0B77451", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642740603, "uuid": "1aae8fc6-0a91-4bac-9910-7dcadffe388e", "value": "3072:JrIuUGKQm4F4VzfdKuaam+edAE5bft3KVFvwwbZnz:JrIuUGKV4iVLNaam+edAEJft8IwRz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642740603, "uuid": "a9edfc2b-54ca-467c-9c37-64e12cef737c", "value": 107924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642740603, "uuid": "f1f8ea85-cf73-475e-b780-0688f67215d1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642740603, "uuid": "73d83598-fd41-4780-9346-25674887fe26", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d42a628b-7a4e-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1642723952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642723952, "uuid": "fed56c88-003c-4432-a48b-0dd8ce799157", "comment": "Malware payload (SilentBuilder)", "value": "23d88a35fc9035c4e8aa19fed91fe39b", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642723952, "uuid": "be563378-ac0a-4ee1-8e6d-61c49e8b94be", "comment": "Malware payload (SilentBuilder)", "value": "2d259bd946fb388d1a7d75d28ba591aca3377e0ca8b49e0add414fe82b76f483", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642723952, "uuid": "751b65b5-7fdb-4250-8356-e5e42158fdfb", "comment": "Malware payload (SilentBuilder)", "value": "0e4eae573d1f362ce7467e18c5db113e67fbc8cc", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642723952, "uuid": "fba67947-b5ab-4255-b25b-f9eda012bf11", "comment": "Malware payload (SilentBuilder)", "value": "d4e9029d9fb41626776920ff6e534e6f823f550c48b852932ec2cd46edbd9e4ac920a9992f3f18ffd92d80ef6108b5bf", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642723952, "uuid": "9ed6fd36-2640-4501-b970-adc164a70836", "value": "T10B636CA7B78299EADA0483394DB643C5B717EC104F9A43C73694F7346EB49F08D9324A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642723952, "uuid": "77cc4858-b471-41fe-943f-2c5772076add", "value": "1536:bpEk3hbdlylKsgqopeJBWhZFGkE+cL2NdA8eXZiozeOgXVZKyaZpvyR1kZkJvU+:bCk3hbdlylKsgqopeJBWhZFGkE+cL2Nr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642723952, "uuid": "ad41a355-28a4-4821-bebb-969d0bed721e", "value": 71719, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642723952, "uuid": "f521a85f-c91c-4b06-a643-ee5e526d0bc3", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642723952, "uuid": "1569e23d-8962-43f7-8810-0ad8cac9ed5a", "value": "23d88a35fc9035c4e8aa19fed91fe39b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f792c6d-7aeb-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1642791268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642791268, "uuid": "6a595d10-e64b-4b55-90a9-ef526c41994e", "comment": "Malware payload (Formbook)", "value": "dce983778e604b799e0470fd69e833f2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642791268, "uuid": "56097cab-2eee-47fd-ae97-4e25a02b6ce4", "comment": "Malware payload (Formbook)", "value": "2d40f472fa610ec9068b1bb4d057ca2293e2389fe7915acd2237b6df85e9b6b3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642791268, "uuid": "4b23a9ce-2485-4e6f-89cb-1f9aea668128", "comment": "Malware payload (Formbook)", "value": "b97b22599b0b87bab09f24a7531c89d4cf35f5c2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642791268, "uuid": "ef579b01-03f7-47e7-95b1-37c788f5dbda", "comment": "Malware payload (Formbook)", "value": "5261f66a782ff9d79a307347b8ce15141746936275c315ed69f5fa1f08a9b2d4c4a1a250a68f445e23ea8a81efd30f1c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642791268, "uuid": "caf02d2d-33ec-43a9-a064-4c30e58d2475", "value": "T1D604D435EAF7DE70CA52093BA52CFA2D0D1D2D791D67F8092458FD23AEB6ACC9840171", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642791268, "uuid": "553d551a-01a5-41c8-8d89-8d6980530568", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642791268, "uuid": "1ba47f9c-72cc-46a2-8eca-9380338a8b76", "value": "768:xTa3zG/zbQAaYPtSHPWcmhVm13jPJXtO5k4ZaDBo+CO8nYjj0/:xTsC/zbX5k4ZaDBo+CO8nWj0/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642791268, "uuid": "d71ba2ab-e4d1-4dc4-a79b-f1341d3353fd", "value": 178176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642791268, "uuid": "6a4cd743-9589-474d-b75f-a2175009a77c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642791268, "uuid": "9d2c2483-5c1f-45a7-8375-7a72f09cb9d3", "value": "dce983778e604b799e0470fd69e833f2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbe076aa-7aab-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642763882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642763882, "uuid": "8182d0db-c4c7-4802-b838-4a8dbd22ee65", "comment": "Malware payload (Heodo)", "value": "cf82cb5c746633618f48e0d11e8e8b7b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642763882, "uuid": "823d9793-4f7b-4933-9ce8-7dd1f05ff05c", "comment": "Malware payload (Heodo)", "value": "2d42bc647765636c6403c27276a7a2dc27d0102d0f885c7a26fd7e53428b6b6a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642763882, "uuid": "0bd2adeb-fb7d-4c7d-88b1-c020bc129bef", "comment": "Malware payload (Heodo)", "value": "7c0429fcbb3380b29b799948f0e20ee87938b1ed", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642763882, "uuid": "70ce33ba-673f-4a83-9ad1-c47755f27ea7", "comment": "Malware payload (Heodo)", "value": "d786fe2eebe1fda82b5dbdff02445ff5d0bf67f4ab909fbbca7e77f57042ab7630f286d3a0b0904db4785fe5194701c5", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642763882, "uuid": "cca83ef3-8427-4a3a-8a7c-3a58d060fc7f", "value": "T1A9D4B011B2E2C07AC1AF0175595297A973F9BE90D9FDC247EFC06A4F5E315828B38722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642763882, "uuid": "138ce372-22c3-4e7b-8a0f-6794fc493f69", "value": "24b46ffcf60dc8d39e8124f411ebd08e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642763882, "uuid": "26f3db50-ec29-4188-b1cd-97fe29dcd080", "value": "12288:vClISqMT89ornPmGZtn5yzrDN1ywIdO3D7AfojAxOBnVV0KOFD3EPO7:vmTWornPDryzrXywIdOz7AfOAxsVZOFZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642763882, "uuid": "e4e79da5-1baf-4a1f-9ee3-2bc92cef2f1c", "value": 634880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642763882, "uuid": "b01e600e-5a87-4822-a264-95933349a864", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642763882, "uuid": "0884bb72-1e21-4eb6-b2a0-767610671325", "value": "emotet_exe_e5_2d42bc647765636c6403c27276a7a2dc27d0102d0f885c7a26fd7e53428b6b6a_2022-01-21__111755.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a68618f6-7ab8-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642769402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642769402, "uuid": "0a553067-a688-468e-a5a4-103179b2ff96", "comment": "Malware payload (Mirai)", "value": "7c78824fe57e3089ec2b17c9d5df8814", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642769402, "uuid": "a01e87be-93f4-403c-afa2-20474714e173", "comment": "Malware payload (Mirai)", "value": "2d96a61514f5bff920bb09731761f15688caf933e209ac03f480b1ad72f0f672", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642769402, "uuid": "e740c51a-e90a-488a-a47a-7d42999edf80", "comment": "Malware payload (Mirai)", "value": "a4a72e1150051d408138c9169135cc4b8fbe8f62", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642769402, "uuid": "da0f1971-72eb-4a50-83d8-bb1e9142d49f", "comment": "Malware payload (Mirai)", "value": "508a51ebfe77fa77d5602f47819df27832f194995d0396365a76b66525cee273822dc66c1af35779290ef3425d0eb93e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642769402, "uuid": "814d11b2-4e50-425b-a281-05e0704daad3", "value": "T19AD2D0C4902BD451F188033B7DF846EC4DA70C19E6BA8660B754CD67EB2786B6A35BD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642769402, "uuid": "b393f99b-e67d-4027-a8b0-726500a329dc", "value": "384:MVMBQR6uojSpHk6GyTa0z7ZidWmRtZ8Rwqx+/t0RLWnPzHQKtuHynb8u0ZVUir7e:UM4lFxmmZidb7Zg1WpsI0PUg7Cl0dje", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642769402, "uuid": "6c20ac66-8ea0-4e7b-9572-7ac5b4bc2fd8", "value": 28904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642769402, "uuid": "d0ecef12-c81b-44e2-8b37-7fba0c9a89cb", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642769402, "uuid": "e654c486-bb48-42c2-8b30-72f349d221c2", "value": "Tsunami.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98121a86-7a66-11ec-9275-42010a9c0029", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1642734159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642734159, "uuid": "cc6db2d3-e7a8-42bf-a4f2-56f98c37ca19", "comment": "Malware payload (AveMariaRAT)", "value": "40c3dde32335244e5664f13bfe4a9f92", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642734159, "uuid": "40e8ba69-e930-44d4-80a1-7cce0df123f4", "comment": "Malware payload (AveMariaRAT)", "value": "2e38dbab77effab3cbfb5ab6df78a76e157aa1f5906157fd1bb73252c30251b6", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642734159, "uuid": "c23b8e7c-cb7d-4904-a045-facaad178828", "comment": "Malware payload (AveMariaRAT)", "value": "ff9ba2a3546abc8e338d6836d1382c9960cc6a64", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642734159, "uuid": "5b929202-fce8-4c95-b228-29d9c77cc2f6", "comment": "Malware payload (AveMariaRAT)", "value": "52b17c1d82388688da5c22d738cff75d1297d559bba10ce56fb9781fbd0b3bf142ad2ee2e96ab50759bbf321ad18540e", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642734159, "uuid": "bc78edf1-db88-4364-b55c-d3b72ede46a4", "value": "T1EAC48D85FE80A5E0CC199374293ACC399B27BDAE65B4540D25CA3B773FB79A30036587", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642734159, "uuid": "981d5bc4-1536-474b-a426-a632fb22c579", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642734159, "uuid": "0d73d2a4-d3e1-4e60-80e4-59ec0a5d0b62", "value": "12288:QnppvppMkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkOGnvz3nuyh:QMnh3e9FRI5xr8bH0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642734159, "uuid": "21951a36-cf73-4533-b0f4-bf9cf7d60b58", "value": 580343, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642734159, "uuid": "f0154b45-8d67-412e-b405-8fa7d101703f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642734159, "uuid": "21847b88-0350-4510-8c41-c1fb0c90d1a3", "value": "Thanh Phat International - Products list & specifications.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efd63d1f-7ac7-11ec-9275-42010a9c0029", "comment": "Malware payload (Smoke Loader)", "timestamp": 1642775968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775968, "uuid": "8b012cff-8178-4f18-a53e-93eec5285336", "comment": "Malware payload (Smoke Loader)", "value": "74f69f2f154c6a2db9759223d38c8758", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775968, "uuid": "f4754197-45c9-459a-ae50-74c1a8c34796", "comment": "Malware payload (Smoke Loader)", "value": "2e7447c239a5c4718568d6f728a8f6f71178bf299e699c945325564da2e6e8df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775968, "uuid": "8e2af3a0-fa19-45ef-a72a-9df4fc9cc8b8", "comment": "Malware payload (Smoke Loader)", "value": "7835da06b3497fd35794db83c7090e47407ff4cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775968, "uuid": "35bae1de-6e20-4009-8107-2bbe1d7581b7", "comment": "Malware payload (Smoke Loader)", "value": "201188a1f2469f2ca24bb517ee6229404c082f8cc286a5378412e314bd9a99f8f41b6afd183281b76bccc06940e88d46", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775968, "uuid": "6fa8c868-2698-46ab-8220-93bc2f95f421", "value": "T141648C00BBA0C435F5B361F44ABAA77CA53E7AA15B6450CB53D56AED5B386E0DC3030B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775968, "uuid": "2429bd3c-5cb8-4cc0-b46c-c640e18339a5", "value": "74049dfb008e04dc801074b384a97733", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775968, "uuid": "c7da5de3-b567-4713-b7ef-dda769abfa87", "value": "6144:ZPCertOw7HCWKZhOXZv/lG1U3kGlvzbXSIFEzUutDsS:ZPBHB2sZvdG1Ull7bUr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642775968, "uuid": "1750f309-c71a-4240-bea1-43883dd60242", "value": 335360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642775968, "uuid": "8e4d0f8b-0314-43e5-9476-9935228aa0c3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775968, "uuid": "1cf77bd0-cc59-4a42-9a75-e930e01c48ed", "value": "74f69f2f154c6a2db9759223d38c8758.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9eb7c9fc-7a8c-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1642750491, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642750491, "uuid": "f975c2fd-7891-4c18-a06d-8a786b4eb5d5", "comment": "Malware payload (AgentTesla)", "value": "d2613bf65e64a01abcf3e4ccaf292010", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642750491, "uuid": "4a7c166d-b275-4741-9697-2f90c41a5c49", "comment": "Malware payload (AgentTesla)", "value": "2ec9f2af4efb0dda81362a082cd9efac26c535d7052e34505d040fd9e6dc2f3f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642750491, "uuid": "f36c8e4d-d040-4e2a-8468-bfebf24816de", "comment": "Malware payload (AgentTesla)", "value": "992f24b48800bc6bb67fda1973f9c867049d8b31", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642750491, "uuid": "8ff4ff79-5ad4-4b8f-86b3-6dc94acdd09b", "comment": "Malware payload (AgentTesla)", "value": "1163e9c7339cc6dbfe619fb5fe3a22a6ea4aa7d54b80693aea18021aa6b8d576fd701bf72413a608b756f7ec9cdbbeb4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642750491, "uuid": "b60d5e20-54a3-42e1-8e51-34bd14917d3c", "value": "T1D405338D43F1F78364C3AE6F4089DBE72E5427A5035D38B559ADC81E6C0E2D687BE084", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642750491, "uuid": "3bcd3881-90ea-4d85-bcdd-00c99329150d", "value": "24576:lgu3VPrvmqSF6VsMA/Z/3mSO9j/nhGxEkjIn1DATcbXT:1+q7VsMA/FCh/Qx7MDATeXT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642750491, "uuid": "8ada9466-d6f8-48c8-9122-05d2d99c9d66", "value": 867269, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642750491, "uuid": "4ed6b4b9-11cc-4632-bf03-336db60f8980", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642750491, "uuid": "3e4c656d-8ce5-48c6-9c70-5fadac74a530", "value": "soa.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05157eab-7abb-11ec-9275-42010a9c0029", "comment": "Malware payload (STRRAT)", "timestamp": 1642770420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642770420, "uuid": "8773429d-5fbb-4fea-8e97-79dd3ccfb40f", "comment": "Malware payload (STRRAT)", "value": "4d0c222fc711df5287903997326017b3", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642770420, "uuid": "4eaa8886-e708-4df2-9a52-11d37993745d", "comment": "Malware payload (STRRAT)", "value": "2eccadabbc22b45eda0581964ea8f540f7068f331c6a8f02df3ff84a5c625334", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642770420, "uuid": "34681854-b738-4397-bcac-e626800af9f6", "comment": "Malware payload (STRRAT)", "value": "8da0d12aefac5d5186ef207386a8ea55dbca65c2", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642770420, "uuid": "33c9501f-0322-4a05-9692-9518f94bbd15", "comment": "Malware payload (STRRAT)", "value": "5b16fa2127ce62a2f2c416bfe407cfe9ec99d750143251329a3b0f8c9446221aa80d56fc4a0e536c0583b5566a1a5d7e", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642770420, "uuid": "e3fa4deb-d6ab-483d-aaba-38b55c3fe7d4", "value": "T17D04F20B3CD755B8E20BC23289544363660C02D7D64A41AF22FC95B6987CD9D6B26FEF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642770420, "uuid": "d20d9a22-058d-47b4-a435-0177f8cb5abb", "value": "3072:+QsiAI67nSKJujWRQJ4tO+HERNTm5KWlOIuZPHKDDVJT35vRJK:Mik7nvHRBtSSEDHqH/T38", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642770420, "uuid": "f3899bde-46e4-4b45-8a62-16b25c25d04a", "value": 181993, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642770420, "uuid": "b230d3b2-6184-4d50-950d-503efbc3af9d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642770420, "uuid": "b1a9654a-cff1-4316-86c6-f68948d403dd", "value": "Details.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb4ba3f1-7aa8-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642762673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642762673, "uuid": "97a9a3ea-50c5-492d-8394-5966f81e1880", "comment": "Malware payload", "value": "a43b17ac461d2eee6153710850346200", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642762673, "uuid": "82e58965-3ae3-4db5-9a4a-6109a2a727be", "comment": "Malware payload", "value": "2f45197ef087c00da456fa9dc97b038e387eb2508c6197ed3f438c87f9d07063", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642762673, "uuid": "0c7ba428-2647-439d-a1a4-2d53132da36f", "comment": "Malware payload", "value": "724917b805b4b609f3beaa7b713004b6d42d14f2", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642762673, "uuid": "8f1d189e-b636-4af7-afc6-66c18bb37d3e", "comment": "Malware payload", "value": "057a46cb00df3b47db8ca53b43d07bf7fc21c286d6db4c4c531f0df3b24a81c3bfa3e954dc79e03aef53cd8a2f447bc9", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642762673, "uuid": "df61360d-d484-46e2-b5b6-1d5653b8df6c", "value": "T160F57D12B2C4A63FC07F0635553BA628993F7B617A168C7F57F45C8C8E351C12A3AA4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642762673, "uuid": "add05fae-fa99-43cf-8588-e1df4eb64a88", "value": "49152:rPYaqSuvNX4SXF76mjoeahMrru/cTCYZlrXVVdWNA:kaHuPitYZlqA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642762673, "uuid": "e053ecc7-f118-42f5-8d17-a66fa3228961", "value": 3578368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642762673, "uuid": "4f30900c-3e5d-4b5b-bba4-de97c969b97b", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642762673, "uuid": "833c627e-bc27-4542-9b3d-875ad458db13", "value": "PDF.VIVO.DIGITAL.URN5SP.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0332766-7a72-11ec-9275-42010a9c0029", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1642739327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642739327, "uuid": "20324000-e153-4563-8d6f-5b04e249ae74", "comment": "Malware payload (AveMariaRAT)", "value": "750f463d10cf8877e4f23c33badd04d8", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642739327, "uuid": "e8f74cdc-5456-4c99-b0e9-61d110d8c41f", "comment": "Malware payload (AveMariaRAT)", "value": "3021778659d8e54d87fea62c535c7196ba1892a98ae82ad6aa4780ee2e101d63", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642739327, "uuid": "afb3a398-8f5f-4993-a909-4f838176f750", "comment": "Malware payload (AveMariaRAT)", "value": "35112da3479a13dc166a2cc49bc98af8845e0f8e", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642739327, "uuid": "1d3859da-e5bc-441d-a733-5ca8913e32a9", "comment": "Malware payload (AveMariaRAT)", "value": "bbafbbe73e0ef75f67cb051fc2949cc1c01738d8c719559957b352a7c2a4189482f93ad2faa86a3eba674b7d6b6bad9e", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642739327, "uuid": "783115d2-1dff-4d3f-8db1-e75b9a8d02c5", "value": "T196742383FC0A22C1F716E46AD571A12B4961BB12372EF6E843A6C410A37CB7F33916C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642739327, "uuid": "a3015a7f-14a1-4fca-b601-6055bf5a22ed", "value": "6144:il188WeCo6PVK8zbRt+lfToFvhEaKcG9+BR35/NmfGcleiu53:ilmhY6PVKX8JhEaKPuRp/Ng7leiut", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642739327, "uuid": "9a4f174c-0557-4a6a-b3b9-2dbb7a9d6911", "value": 345162, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642739327, "uuid": "0afe19a8-b275-4338-9595-0491d409ab96", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642739327, "uuid": "538c6ce5-e04c-4022-8333-72bd55b81144", "value": "Updated New Order PO #000167249-1-2022.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00ffbf31-7ac7-11ec-9275-42010a9c0029", "comment": "Malware payload (CoinMiner)", "timestamp": 1642775567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775567, "uuid": "71a67e8c-d4b3-4896-a4b4-f9fbae194cae", "comment": "Malware payload (CoinMiner)", "value": "0b814e6fecf2ffad3d7da84a23c8e3cc", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775567, "uuid": "8ec834dd-a10f-40b7-9e45-3c1f28ac86f3", "comment": "Malware payload (CoinMiner)", "value": "31868f961c44c39835b30bb9f1c830badc2ca50e583a7936f06ce3a32dd11d28", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775567, "uuid": "993cda52-559d-464d-8f43-ca89cbdef45a", "comment": "Malware payload (CoinMiner)", "value": "11418507a05f5fbee0453037a2084ba57eb7b90a", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775567, "uuid": "2746a842-bc91-402d-aef2-af9c748e41a5", "comment": "Malware payload (CoinMiner)", "value": "dd42cf33514fa6c7b73861382d7bcbeeea592af8dbb80be83522a4250bb8ce613c5541c347b12fd40f3e279ab635d80e", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775567, "uuid": "f18e1756-4677-481c-b508-41d202da2bf5", "value": "T1BB3633253A5E91E3FF40F8FB28BF941BD5534353F2FA2903A32267A647146E409AF161", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775567, "uuid": "598962ef-8133-4559-b8cf-3ca7dce347f4", "value": "b8ba55866bfe7b49b97c43084c1885db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775567, "uuid": "6229ca2d-73a7-4104-b2e0-81ecd200a426", "value": "98304:t+tgobXGIWgVFv1dsXanazp4u9i38614lW/XQg6J2LO7l07wCqUVCPJfJy52vJ0:tKgl6ds/9n6PQL2i+7wCN+FcUJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642775567, "uuid": "69e6a7eb-274f-4d58-a372-cb01979e9bc8", "value": 5172224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642775567, "uuid": "cf54e3d2-bb06-43d7-93ba-6a0825152bb3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775567, "uuid": "6eb9124d-5081-4528-b5cf-5c36093322c6", "value": "0b814e6fecf2ffad3d7da84a23c8e3cc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74a5527d-7a4e-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642723792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642723792, "uuid": "a99f688c-b506-4dab-afb4-db10c950fc3b", "comment": "Malware payload (Heodo)", "value": "60755e943c4921c5b802a00ccc97bad7", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642723792, "uuid": "32b76693-0fd3-4d43-8c9d-b361d599fd22", "comment": "Malware payload (Heodo)", "value": "32d71385e940bb47de0bb12ef1280ec8266854127ec9fffbe344cdac70705fbc", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642723792, "uuid": "050a6899-07aa-4569-b90e-ed2e698af7a0", "comment": "Malware payload (Heodo)", "value": "a941f09783eb2df290f626e6ea313b514f45c9c9", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642723792, "uuid": "339fe6d8-8b5d-417b-92d7-02ccecab3ebc", "comment": "Malware payload (Heodo)", "value": "e5a91c6a9f6b8f51818e0c01c35823bec81623d6ffac82bec36064d76534450a72179c859ba75d358f2b24063623140a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642723792, "uuid": "29ceb9e1-30ad-4c03-b819-036cc02629b0", "value": "T16CD4BF02B2D1C036C5AF11B08E76AB08A2EDFE905B7985DBD7847D5F1E31BC26635B06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642723792, "uuid": "80df65e6-df12-454b-88b8-48dea30835a7", "value": "42bfc936e90bcc6f5b01541917ef37a4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642723792, "uuid": "066c9c7c-a548-4ce6-b3f2-ca5439a51f6d", "value": "12288:Td0saabmsb61ZuV3ZGuyfEgXkvPLEbsWrxD8iP29pi9NGG1DjsgqXXvhhcwEPwqh:68mi61ZuRZGuyfEgXkvPLEbsODYDMVnm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642723792, "uuid": "f47fd066-734a-4fc1-814c-26b376aecabf", "value": 638976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642723792, "uuid": "0fc16955-bf40-4378-9746-3b4c4f2ec952", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642723792, "uuid": "7305cd1b-e5b6-4e09-ad0c-4fd327751ce5", "value": "emotet_exe_e4_32d71385e940bb47de0bb12ef1280ec8266854127ec9fffbe344cdac70705fbc_2022-01-21__000943.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7177098-7a75-11ec-9275-42010a9c0029", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1642740654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642740654, "uuid": "79afeaef-043f-42ea-af11-ccef3e5b2b8c", "comment": "Malware payload (AveMariaRAT)", "value": "83194f4cec3ca91c50818702e33251d5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642740654, "uuid": "1ac8a5ae-b391-4022-ae07-37350a5d7fea", "comment": "Malware payload (AveMariaRAT)", "value": "331576755451134a074599263c0289b5092b1c489a91afaf911c8414fda98713", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642740654, "uuid": "2ae07941-a059-4e77-a8c5-0cbdff189c86", "comment": "Malware payload (AveMariaRAT)", "value": "57d6a1cfaba2f0b14f4d2e47c50351a46f28745f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642740654, "uuid": "2ace527a-752a-45bc-8ed8-eb3fbbac15ab", "comment": "Malware payload (AveMariaRAT)", "value": "10785ca4994a6eb5e284ece78037ae111607726e783317ea8123b3b64f26a73d32e1451fc814ab7341402d83f65ef842", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642740654, "uuid": "e63b1fb7-d377-41e6-b1be-91532e274180", "value": "T18EB39E13F7E54835F3B201B01ABD7E7ACBEDF9700628C49FA394858A2D31946E925397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642740654, "uuid": "faa5cb51-482b-4d8f-a29f-909fbf1294a7", "value": "51a1d638436da72d7fa5fb524e02d427", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642740654, "uuid": "0864a207-7adb-45bd-940b-cebd37653814", "value": "1536:h0jP7/L1B5rVmN8sxHv2M28ix8EUaJxWZoB4u0OVE01:K1VmhaH8EFvW+0OVE0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642740654, "uuid": "16e88a94-4453-484b-9c17-8684e13d3fdd", "value": 115712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642740654, "uuid": "a9b68f6b-4a64-43ba-b744-df58283abae8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642740654, "uuid": "620ddc8c-8a82-4391-84b5-6a5a206476bf", "value": "83194f4cec3ca91c50818702e33251d5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb48caab-7ace-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642778993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642778993, "uuid": "c1e68b51-f87a-4ab1-84bc-30bd821ee8dd", "comment": "Malware payload (Heodo)", "value": "f5a11894f8ddec1dc04f1a24506e0f17", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642778993, "uuid": "4c4c0af5-82d9-4331-b47c-af0cd786c10a", "comment": "Malware payload (Heodo)", "value": "333b74853c86e7a79097e2abbdc78eb05ed99af13e0742ad2e6fb9d72169ca88", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642778993, "uuid": "2eb0b8e1-1514-44b3-b7a3-954f050ac0c9", "comment": "Malware payload (Heodo)", "value": "35b7d9856e3815d1c80abb4f06281c4e717b06b3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642778993, "uuid": "5c63c381-5a79-46eb-acbc-4171faeb84c2", "comment": "Malware payload (Heodo)", "value": "d29fba667908c3c96253a644abcd286789aea47d9529440268b4de2135b329dc806ea87ba26d3b54690fb39c774bf3c6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642778993, "uuid": "828a3b63-a0c1-42bf-bcb3-e4aaebb3318e", "value": "T1DFD4BF11B2D2C07AC1AF1674596393A463F9BE90DAF9C257FFC06A4F1E315828B39712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642778993, "uuid": "2ef888a3-89fa-4929-8f22-a28db192940c", "value": "24b46ffcf60dc8d39e8124f411ebd08e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642778993, "uuid": "56f1d794-6ec8-4616-8e46-5d8d806c7979", "value": "12288:kqdJaxkOWFornPmGZqnTFWbDfUYVubhesslBvQqEPO7:kOOsornPTwFWbAYVohevBoi7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642778993, "uuid": "ae8acebd-2f67-42e2-8d25-0330be512702", "value": 626688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642778993, "uuid": "7b721fb6-d2e0-4b52-8733-ac9fc1e52805", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642778993, "uuid": "530ef379-8e50-4d7b-9ff8-75fc385a511b", "value": "f5a11894f8ddec1dc04f1a24506e0f17", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48cdc238-7aa7-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1642761944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642761944, "uuid": "e8a7ab6d-d0f1-4a4a-8e58-69688272f565", "comment": "Malware payload (RedLineStealer)", "value": "911aa2d0d66d5be221cdbbc490606a1b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642761944, "uuid": "8902b8d6-1976-45a8-bcbb-85e1126ecd42", "comment": "Malware payload (RedLineStealer)", "value": "344f84347ee7f6adff698bbc186554689f671c382f76e6ac95827cd1b1fef544", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642761944, "uuid": "ff96fc00-e76a-40e8-a73c-a1561e8f731c", "comment": "Malware payload (RedLineStealer)", "value": "9359c7457b3a6e950b9bd87b570378358d7b5dc8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642761944, "uuid": "dc66e8c1-132d-482b-981e-8dc2f9d4a58a", "comment": "Malware payload (RedLineStealer)", "value": "fd74e3a514eb2bf35d5a651e691aac460acbe8cb7e59f0ca231d93c3b8e27b3e51150214c726c526f1235d14a269db9e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642761944, "uuid": "46daaa89-f545-4aa7-a53f-e6b1580b0191", "value": "T1A484F171BE90C473C046D5301869CFA1FB7EBC212955D60737A62A7AAE323D05A2E35F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642761944, "uuid": "21d9ad03-82e3-4bcb-8333-2e5da5caf99f", "value": "29340e6ca7cc3b9eb89af4981d5214eb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642761944, "uuid": "72efbe52-6be5-4523-9bfa-e42b5e8bec24", "value": "6144:LHmDL2SXvw3yFFIQpy02SfjPtBWjWHHK/jUo9LBcFURFWBiJ:LHQKSXvwCnIIRbfWisjfsSRIBw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642761944, "uuid": "f6ec2840-2cab-4edb-a81f-5b1bf1089892", "value": 378368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642761944, "uuid": "41a74cfe-4087-40bc-80fc-051473eceebb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642761944, "uuid": "380d9a4d-5711-4d9f-9e19-7a1235d806a0", "value": "911aa2d0d66d5be221cdbbc490606a1b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "602d0647-7a4d-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1642723328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642723328, "uuid": "052c6424-a092-4efd-b176-d9540543e2c5", "comment": "Malware payload (Gafgyt)", "value": "df847b6d12f10b60ba682f67fa3547bf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642723328, "uuid": "e82234f8-2363-4d49-b441-7a34f2f21b7e", "comment": "Malware payload (Gafgyt)", "value": "350add8c73e850ab0090b1b7553afea27ead3d7faf462d847a032fa7ded70e70", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642723328, "uuid": "c1cc7492-f67d-4a4e-a280-3f9bae1ca008", "comment": "Malware payload (Gafgyt)", "value": "ca3c1ec1e34d4432b86146380f0de63597e842d8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642723328, "uuid": "ef0a5224-bc01-48a8-bc6e-cfdc9dff9c30", "comment": "Malware payload (Gafgyt)", "value": "869b3f6a15d7c212918ad83e40dd7d9bca82d3437fc81d2956bcac9ae45ff005483b8e4987d8332f32c13341fb61b122", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642723328, "uuid": "5580437b-8b5f-4bab-b3e0-68bb5b1948d2", "value": "T19AE3195BAA1C0783C49B56F13E6B27F08B5CFAF111D252C5A90AFEC01733AB52126F91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642723328, "uuid": "ea1be7bd-7ae5-43cf-b219-54554aede857", "value": "3072:wIiNt4Z6zklwlfKT5hUzpeD7IqsaLohmnrVybfdZrriq:wIiNt46zdlfg5hUAfH8hmnrVybfdZrrp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642723328, "uuid": "6b8a3fb4-3119-48fc-adbb-9f4644d7652d", "value": 148596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642723328, "uuid": "ab6a1856-a4d4-4d95-b5f7-6aec7c7e62ee", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642723328, "uuid": "e04ba41b-be5a-419f-a77d-2c71acced835", "value": "df847b6d12f10b60ba682f67fa3547bf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6e9b836-7ac5-11ec-9275-42010a9c0029", "comment": "Malware payload (GuLoader)", "timestamp": 1642775013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775013, "uuid": "760d8227-6ad6-40f4-8b90-0b69b6b25642", "comment": "Malware payload (GuLoader)", "value": "2eb1625e8d4e3f9b19ab947d188d0be8", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775013, "uuid": "5de685ca-31fb-4668-94b8-39aaee8a7270", "comment": "Malware payload (GuLoader)", "value": "354529cf4cd5498c64a0c69c6dd9eb8962250542eea7f89a76faf64f5086da35", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775013, "uuid": "d9b8bec7-7bef-4258-ae9d-0f38a57347bc", "comment": "Malware payload (GuLoader)", "value": "7aad4e8d8f521d1c36a7468418047c8a5751b7e9", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775013, "uuid": "49baebe9-78d5-4a3c-a6c1-c16d6678e22d", "comment": "Malware payload (GuLoader)", "value": "61e9ea90da09026cc61ba5fa90d86b90e07c3a3214ca5703cb47daf54d19e6de360c0a00ea9bf852856ebd86d637fa9d", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775013, "uuid": "401fd037-e5d3-4de3-95db-2fdb509a6f35", "value": "T1A27384A86C1714CD1A94E74FECC146CD53CF0399CFEE4A02A5E9948D1B751E88EEDC8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775013, "uuid": "6384542d-481f-4141-98d5-679fdb6d0795", "value": "1536:8oJdxFRnX6gFcc31kSoIV+XAyZprwkGtz93tVTUzlvdl1UngqcFqg5TMs1rWO/Ih:5znFvXyjta0nvK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642775013, "uuid": "3e93a20c-c1e8-4d8e-9ad2-9ddfdb7ad06f", "value": 77283, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642775013, "uuid": "97817247-8417-4a54-8f36-c1f389a33ab2", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775013, "uuid": "5e1c8b14-e7f3-40e4-8dfb-fe9444d97888", "value": "Wire-84844663637346665.PDF.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93a6fff6-7ac2-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642773666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642773666, "uuid": "5f9c4147-aac6-43ef-bb5c-a8b7cb5facbd", "comment": "Malware payload (Heodo)", "value": "04a5bd3e1ccc8e7e3eeb479ec8a2e467", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642773666, "uuid": "a3678ac1-309d-4cf6-8b7f-33a47084e3c1", "comment": "Malware payload (Heodo)", "value": "356d6ff7aad2a7d0f987eb4c0d3b5157d50e70369df2a5055b3fa842e642b8d5", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642773666, "uuid": "c52e3350-cce9-4221-85c4-71fe914e1f2d", "comment": "Malware payload (Heodo)", "value": "9b7e654582bf5e7955952dae7ec8ce35546be9f8", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642773666, "uuid": "c00b164e-afd4-4577-a7e4-4926ce6abb01", "comment": "Malware payload (Heodo)", "value": "f619a80b7631567c0bd07eaa4e7a7098ff784d634fe375669df5eeec97056a7418dfe98f28f348ab475bb98f48a94a54", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642773666, "uuid": "bca5ffa7-ec4a-4057-b07c-0df8cbde1060", "value": "T17DD4BF02B2D1C036C5AF11B08E76AB08A2EDFE905B7985DBD7847D5F1E31BC26635B06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642773666, "uuid": "951378cd-2031-43b4-b69a-fefde003c2ef", "value": "42bfc936e90bcc6f5b01541917ef37a4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642773666, "uuid": "57639b10-d4e1-46e4-8891-14780c666b30", "value": "12288:Td0saabmsb61ZuV3ZGuyfEgXkvPLEbsWrxD8iP29pi9NrG1DjsgqXXvhhcwEPwqh:68mi61ZuRZGuyfEgXkvPLEbsODYDRVnm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642773666, "uuid": "e65b4fc9-8b25-4650-93e1-78bedff97598", "value": 638976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642773666, "uuid": "900b16dd-dbdf-47e6-b0c5-1fe7e8e07fc4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642773666, "uuid": "64261619-1558-41e1-b67e-d8f07c0d610e", "value": "triage_dropped_file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5356026-7ac7-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642775843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775843, "uuid": "9d494841-e9a9-4d5c-897e-d3207ab50f84", "comment": "Malware payload", "value": "91ef386242e8d85242a633c53cd98f5e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775843, "uuid": "fd52e49a-997d-446a-8b32-53ff5095e7d7", "comment": "Malware payload", "value": "356dedf7fd97754e1a28666b381c3f4498f096515ea897aa11107b0d04b11d19", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775843, "uuid": "48b0f931-d06f-4a83-ace9-206efe2411bc", "comment": "Malware payload", "value": "272502c5f9ef6de7cd487eea5de59062388ded20", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775843, "uuid": "9f62f460-dcba-43c9-a442-3c2ae24df848", "comment": "Malware payload", "value": "0724efbd532157742f097bfdf06398a600990a4211d08b466ff299026ac1ffb856612d5e7b4301e7daa474a240ef7a13", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775843, "uuid": "ffc1a7ac-948b-4ab4-8181-6e8949742813", "value": "T198A4CFA4B364DA47C16D34F484104581E3749C423589EBEA6DFA32FD29F2B93EE1264F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775843, "uuid": "662e2ac8-ea5c-4681-a434-ef392d662d89", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775843, "uuid": "59f1498d-7c3f-4dc0-b33e-935e44a5cbcc", "value": "12288://gTbXiF3qEE1mF9+spWO2YO2ZULAGWZ://lpfGCzFO22LAfZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642775843, "uuid": "f0598c9e-b677-4a23-8c61-00885faf4d91", "value": 450048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642775843, "uuid": "fa8ad294-a254-41a7-b91b-b691607072c9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775843, "uuid": "f5bfdc5c-c2e3-4449-a0eb-3f6a05879ba1", "value": "doc_656455348756-098788785763354.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6912e741-7aad-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642764575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642764575, "uuid": "14133f4f-71ab-417a-bf93-f13880a1ff67", "comment": "Malware payload (Heodo)", "value": "f12b1514f3a265841d27754ec41afee0", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642764575, "uuid": "6492e483-628e-4620-b7ae-32631c00a4e7", "comment": "Malware payload (Heodo)", "value": "3605c17721de4b4e5ccad62817451c680e72b3955aeb53f9070587ba2f413383", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642764575, "uuid": "f0f571a5-6413-40da-9195-a8bdad91c38a", "comment": "Malware payload (Heodo)", "value": "f1c72716c37b06b180f99f1a9dde956c454125b2", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642764575, "uuid": "94f0aed0-27fc-4fe5-a407-7cc9a352a0b9", "comment": "Malware payload (Heodo)", "value": "3738f169b463e37154e044ab38212601815cd70a4c8405f3cd52dbdd64875ecf38281400b090060257e57fcb54a1a07a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642764575, "uuid": "719ba922-7ac3-4cca-a39b-e62d3bd8485d", "value": "T1F6D4BF11B2D2C07AC1AF1674596393A463F9BE90DAF9C257FFC06A4F1E315828B39712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642764575, "uuid": "d5cbe4ae-65bb-4910-9280-7a2357f18a5f", "value": "24b46ffcf60dc8d39e8124f411ebd08e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642764575, "uuid": "c324ee67-4048-4fb9-a43a-9c05a630e897", "value": "12288:kqdJaxkOWFornPmGZqnTFWbDwUYVubhesslBvQqEPO7:kOOsornPTwFWbFYVohevBoi7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642764575, "uuid": "9b7dade7-f62f-4144-9701-65d91b2a3f48", "value": 626688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642764575, "uuid": "6d4880a2-ec6d-42cb-8ca1-623dd8fdf62f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642764575, "uuid": "21da0ddf-7c4b-4f9c-b09c-02dee4492b58", "value": "emotet_exe_e4_3605c17721de4b4e5ccad62817451c680e72b3955aeb53f9070587ba2f413383_2022-01-21__112930.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb36a047-7aab-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642763934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642763934, "uuid": "84bfd481-f964-438c-86c3-29e273f4353a", "comment": "Malware payload (Heodo)", "value": "f872a9d57c57493f2e78d71f8c0e4176", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642763934, "uuid": "e65dff28-f669-402e-98e0-b76893d2af6e", "comment": "Malware payload (Heodo)", "value": "3641b243f2ab602a4e201cd64238b3690d26750d7d5dec2046bb8fdc43d69cc0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642763934, "uuid": "2fa04626-b3a0-484e-b5b5-ff7f3c04f444", "comment": "Malware payload (Heodo)", "value": "5a0af17f4180913ab2a22bb6521c0d4cba331de3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642763934, "uuid": "9289a292-6784-4160-aed7-b477476fb2d3", "comment": "Malware payload (Heodo)", "value": "c0e51fab6377a8fad61b2c848970ad1e53777c72c17da1f45e8e0bd1f0612f94d34210a018a9e8a0f8aaf42a9575da65", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642763934, "uuid": "6ccb9e29-f172-469f-a91c-ce06b6bcbab7", "value": "T133D4C002B291C035D5BF11B44E666B18A2EDFE905B3985C7D3C87A5F2F31BC2A635B06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642763934, "uuid": "3fa2375a-bf8e-4546-a6e2-b8bc829542b7", "value": "42bfc936e90bcc6f5b01541917ef37a4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642763934, "uuid": "e92d0637-0f1e-4983-86c5-dd081f8456e8", "value": "12288:hF8kySLmsbWV5WlvAuyfEgXkvPLEbs2gu1D0iv+9Ne1HGBkkQxCej+6IvUDEPwqh:wMmiWV5W5AuyfEgXkvPLEbsGDIflLQxQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642763934, "uuid": "9091e217-70f4-41d5-9b20-82417ee5bbab", "value": 651264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642763934, "uuid": "dbbe0334-58ec-4044-8f9f-223aba15c86f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642763934, "uuid": "592df3ca-5dc4-4aec-974f-9854e62ba76d", "value": "f872a9d57c57493f2e78d71f8c0e4176", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8ce8cb9-7a9a-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1642756655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642756655, "uuid": "0641affb-2488-4e3e-8d87-8d9bf85d9fa2", "comment": "Malware payload (Loki)", "value": "bbf6b9a225334681476f53d081afd3fd", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642756655, "uuid": "4f91e92e-5c40-4092-ad7b-cea279b39f50", "comment": "Malware payload (Loki)", "value": "3656d419f68061bbf95e7f7e695d79a6e89f242d2b246aa1856e2c258374e74c", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642756655, "uuid": "5c21bda2-ac64-4b80-870b-ed04e24a1e0e", "comment": "Malware payload (Loki)", "value": "ed4c09976f5d3007e86f9e7adf85458c871e9460", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642756655, "uuid": "08669e91-a4e1-415d-9f8c-d05b7cca1b0f", "comment": "Malware payload (Loki)", "value": "bc53b847972453bf3983868e0b791e1bf18fb28d6d65459c62269ecf7c7a2f6271265c5994098839d0577b8d0fd525b6", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642756655, "uuid": "97ce6d2a-cc63-49c0-95fa-9c92bdfa6e43", "value": "T171040176B3DAF24EC86F3BF172B0EF3A85D69D10282960D62607B11D50BF55A0974C93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642756655, "uuid": "3ca1ab61-0211-4c00-8515-a147a41a1ebf", "value": "3072:65ieNwVEBTA4AjDfgM3FoaQ0FAGO+aEQURxhucFhkpxeUbRwGRpjXEdJjSs:AuEBMFjDfgMVi0HPj2eUbRwGrIdks", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642756655, "uuid": "a1db2bd8-87d7-45af-954c-3c7662607a10", "value": 187336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642756655, "uuid": "65f185a7-da10-4126-948d-7e3346d6c5a0", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642756655, "uuid": "f95ec617-ea9c-4b23-9031-3c676792a258", "value": "KLP_1516_XC54.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7e77c3c-7b06-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642802959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642802959, "uuid": "8280fcb0-3cdf-4d4c-86d5-951858617047", "comment": "Malware payload (Mirai)", "value": "3430a59b8646bef791eb9c3951e59682", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642802959, "uuid": "23b1aea3-49cf-4701-9634-6692c21dce47", "comment": "Malware payload (Mirai)", "value": "373fbfe497c8efc72eb692927e92f9c77086d458665eff9092c226fb0e89a9f6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642802959, "uuid": "215bed51-5d63-41fe-abb4-785bd249e620", "comment": "Malware payload (Mirai)", "value": "c96eb09a175f98d565f44afb82a23345d6b8e2fa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642802959, "uuid": "22a2ec40-563c-4bdc-a9ef-43a3e4c31f4c", "comment": "Malware payload (Mirai)", "value": "f1c76f5a40046999ce4b13b72ead17d56e4d8bfbeff422606f7b438c05a477f4ec16c8cf9a710b840b9c776ee50e21da", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642802959, "uuid": "09b08264-4855-4098-bbf2-ea2f98c13ad1", "value": "T1ECC2D020670BA435D2E04079C5D4C29661AB57ACE1DFF22678540E3CB96681E75F8E8F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642802959, "uuid": "ffafff42-e64b-4776-a9bf-f5b5482a7e8a", "value": "384:qdoc751FK5G+8qsM9poBAYYKN3gB6OzKRHMAyEZjvX4qw2HAZu/EhymdGUop5h5y:qn75KMu5z6sOj4q0Ds3Uozny", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642802959, "uuid": "82a4986c-8d16-42c3-ae28-cf0a0a266af8", "value": 26296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642802959, "uuid": "fd25db2a-ad47-4137-9d5e-15294200bced", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642802959, "uuid": "36e4ce15-9866-45e0-8041-11892cbb4159", "value": "3430a59b8646bef791eb9c3951e59682", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27feb7a0-7a9a-11ec-9275-42010a9c0029", "comment": "Malware payload (AsyncRAT)", "timestamp": 1642756305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642756305, "uuid": "bf4377c2-fdc9-408c-a2bb-0c279e82fc32", "comment": "Malware payload (AsyncRAT)", "value": "8b2d718618a864063147efe3c578517b", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642756305, "uuid": "e1f799d8-a1af-49ff-bd33-9e8bfe469bb1", "comment": "Malware payload (AsyncRAT)", "value": "37a22f44c4ea8be54b701bd5db1c18d13138730bd65508407ab58126a83a19c7", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642756305, "uuid": "b3f6c78a-bd50-4097-b54f-7e6682211ab7", "comment": "Malware payload (AsyncRAT)", "value": "3ad0f32a8c0f4783da57a9dc7a26f1aa008bcf6c", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642756305, "uuid": "b5504174-baf2-4277-962f-9adbac5391ea", "comment": "Malware payload (AsyncRAT)", "value": "cc3846479f9edfaf21b755190bdd014aa6d018609f2371deb1027ebc36fdee24531faa6b7612af9eb29420c37389d6f8", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642756305, "uuid": "cc2c9f80-bf0d-4af6-bf40-0361ad5f8f53", "value": "T1E664236D273C0C1BD62C98E5EB44BE0189ADED7519830FD7ABD861368824425FF7AE4C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642756305, "uuid": "478a5a39-1e6c-41b8-8a60-522950c08a1d", "value": "6144:l+yUEb8h8ZR+n7pkGsBt2hXCnf9jrAcWgenu/TlMVjmxKR:Uy1b8h2geJ+hXCfxrAcdW1m0R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642756305, "uuid": "ebad111a-305c-40c7-b94f-8f84add9b4a9", "value": 318369, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642756305, "uuid": "d2af8e0b-d172-4257-aaef-b5005620f826", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642756305, "uuid": "823c90f4-cbaa-4279-9330-e816176ffcfa", "value": "draft HBL.r15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a799d7d-7a68-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642735022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642735022, "uuid": "94b4fbe6-901d-4745-875e-a5eab63b3c47", "comment": "Malware payload (Mirai)", "value": "13e8ba90e042ab6bbc3821fad3cf1837", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642735022, "uuid": "1fa39048-7095-4211-9ff5-25e44bd05c6a", "comment": "Malware payload (Mirai)", "value": "37b5a5d9d5ab50a8dff649678a9f10f26a5923186c97d1a623902b68e795abdc", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642735022, "uuid": "c2009ec4-3e06-4069-ac53-3d57782f9753", "comment": "Malware payload (Mirai)", "value": "c7dbaf4b95ad104e35570b287b74f8375f1e5d01", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642735022, "uuid": "158eaeda-6ec4-4d81-811f-f8487adf4b60", "comment": "Malware payload (Mirai)", "value": "9fb1036ff9dd3d4811954da0b5e6938bd35d6b519c7420df270fedd5770116a92cc970d4ef88e7a54db10e78e3746720", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642735022, "uuid": "db2523a2-4e29-4bb2-bafc-b0e00b2e4a54", "value": "T1B423F05D0B0384D9D6C1D4BC83D103841B72F7A6B081D6892664F96BAF97A19A311FCB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642735022, "uuid": "6beb5d74-d29f-458e-a520-7581f0f30932", "value": "768:r5FMs2rPZhkq92ZVHGWVLQttQwuHcIB085oYk6N50IwumgJgGlzDpbuR1JAnAtlZ:p2rd9CmKLstQwuYvYj7hw8VJuLaihT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642735022, "uuid": "8b41bdfb-4ace-4009-9272-bac59bb2d66e", "value": 46204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642735022, "uuid": "fba2189d-55a2-4a77-9a00-0e361963095e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642735022, "uuid": "6868b0bf-7c44-4bf3-8c59-2e65c99c9128", "value": "apL.mips-20220121-0317", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24ccaf08-7a92-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642752864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642752864, "uuid": "a461c85e-d319-44ae-98ec-1c5a156756a3", "comment": "Malware payload", "value": "f9b1564b5419cab0fb0626923545bbf4", "object_relation": "md5", "Tag": [ { "name": "pw vodafone", "colour": "#096C78", "exportable": true, "hide_tag": false }, { "name": "vodafone", "colour": "#8E01DC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642752864, "uuid": "ba5b46e2-d80d-41c3-89af-da059ed5ff32", "comment": "Malware payload", "value": "37b66ddcc8ae81736e0981a72609bb51ed052f3a93b9874283e993863beda4a2", "object_relation": "sha256", "Tag": [ { "name": "pw vodafone", "colour": "#096C78", "exportable": true, "hide_tag": false }, { "name": "vodafone", "colour": "#8E01DC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642752864, "uuid": "1fb79f74-b9f9-4c7d-9162-dac99071a724", "comment": "Malware payload", "value": "3bae8f99c0b093f9802dec7f16f284c6fef0151b", "object_relation": "sha1", "Tag": [ { "name": "pw vodafone", "colour": "#096C78", "exportable": true, "hide_tag": false }, { "name": "vodafone", "colour": "#8E01DC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642752864, "uuid": "d19747d4-6f0d-4d1f-b3e8-814ca2fa04a9", "comment": "Malware payload", "value": "5026e6ed85d078fc74a341e18bbd042c6949452f03855ba28ff0be514904555925e9cbbb67016b823aeb977c6cd752ed", "object_relation": "sha3-384", "Tag": [ { "name": "pw vodafone", "colour": "#096C78", "exportable": true, "hide_tag": false }, { "name": "vodafone", "colour": "#8E01DC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642752864, "uuid": "8a928686-461e-4dab-a9da-3fb2d09db391", "value": "T1F6E061D353862542EA121D3F664847B13100CC97C478D5C3DC7161526AC28E0AA95ABD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642752864, "uuid": "50b474c6-2a5d-4f7c-975b-285356bd196f", "value": "6:5j1xsx2442bOPv4F3NCZJFuOMRYQa9pc345ueQQNKL8wprSgxsx6abtKNt+l8/l:5j4xX84F3NAJFW9a93H3wpSx5JKNtaU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642752864, "uuid": "27cb316f-c538-4252-8be9-692497f0a779", "value": 377, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642752864, "uuid": "09bd4510-bf54-4cff-aeef-fcad54b886fd", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642752864, "uuid": "3121316f-381f-4eab-865a-351a02db7b35", "value": "vodafone_17.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be9325a0-7a61-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642732076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642732076, "uuid": "8a27f2b8-7b01-4630-80bd-e1b03e4a2086", "comment": "Malware payload", "value": "e11744179eb4977f98e4452535042018", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642732076, "uuid": "71f298d2-bdc5-4579-98ab-579b8b376a57", "comment": "Malware payload", "value": "37cd7362f156c71b0b35fcf21d329f92717a2a79a51b810599d61c821523c3db", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642732076, "uuid": "07ca69e1-02b0-4012-ad9b-2af0c71f4c25", "comment": "Malware payload", "value": "6a3a73eca8162f506abcdfe9fc266de19971545a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642732076, "uuid": "608367bd-48a2-4c1c-8fd9-5896a8951bce", "comment": "Malware payload", "value": "ab2e370891628424d28f651477bbc191195d0a9bc0562d508faa22983e20a544f3d9b1cd682155a7783fdae50d366861", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642732076, "uuid": "2aee53a7-27dd-42d8-9603-d6448f6460b8", "value": "T1EDD21A81F9815B03C5C65677FB0E438D772A5358E2FA3303AE296F6137879A70F2A512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642732076, "uuid": "408a29dc-c2d7-4c08-8226-d558df76360f", "value": "768:PTPkAHj5OVdMSKOuzGlL0lTp06m1FGIi:LxRSsmglTpjmDG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642732076, "uuid": "d11d3948-fa1c-4e63-80f6-18a2b453668b", "value": 30712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642732076, "uuid": "fb7df305-86e9-426a-971a-9b5d48e0dcd3", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642732076, "uuid": "7f90f147-ab67-4e1b-8644-c9a5c97cf1df", "value": "beamer.arm5-20220121-0227", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "690cb2ad-7aad-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642764575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642764575, "uuid": "e29dfdae-f676-484e-a789-d416a8884d7d", "comment": "Malware payload (Heodo)", "value": "17aa7cc85d78048c78049bc2a5adee4e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642764575, "uuid": "f00f6098-ad4d-4387-8487-db122f9c6051", "comment": "Malware payload (Heodo)", "value": "37f16445d666fab46514014e70479168e572c96316ffa30f61dccde19684aa52", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642764575, "uuid": "375f6763-8c24-4595-a59b-fbb892bacdcf", "comment": "Malware payload (Heodo)", "value": "1ac56754f52a5f9733602775d6783c6e4e0d4ee4", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642764575, "uuid": "2d88ff98-7e23-405c-b3d8-ab9c13c800eb", "comment": "Malware payload (Heodo)", "value": "4c535bcaec6183262c957ef214a543d883a6838eecd187191681cc3540e33b16f5c2edfcb38fb8f62ed502036b943900", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642764575, "uuid": "d3c10550-c659-49c9-82b3-cb5548a1b92a", "value": "T1F8D4BF11B2D2C07AC1AF1674596393A463F9BE90DAF9C257FFC06A4F1E315828B39712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642764575, "uuid": "4126980e-85fa-4512-8de6-61fe780506e7", "value": "24b46ffcf60dc8d39e8124f411ebd08e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642764575, "uuid": "00c9c7b7-a601-478a-8273-7b41a9aac08c", "value": "12288:kqdJaxkOWFornPmGZqnTFWbDbUYVubhesslBvQqEPO7:kOOsornPTwFWbcYVohevBoi7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642764575, "uuid": "f63abaec-6747-440f-b4f7-83c949e71c1f", "value": 626688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642764575, "uuid": "861ee45c-2203-4121-aa6a-1274dac2ff6e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642764575, "uuid": "bda4cb0f-e197-408c-ab70-d7b9dbe1cc77", "value": "emotet_exe_e4_37f16445d666fab46514014e70479168e572c96316ffa30f61dccde19684aa52_2022-01-21__112930.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9ba609f-7a54-11ec-9275-42010a9c0029", "comment": "Malware payload (njrat)", "timestamp": 1642726565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642726565, "uuid": "80708527-994a-49d9-9126-7544ee93e3f2", "comment": "Malware payload (njrat)", "value": "a1142dd58b658687a9dfc83bfb327dfb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642726565, "uuid": "20785f19-3d33-4bc9-9986-21157eb343ff", "comment": "Malware payload (njrat)", "value": "37fa414b1beac72d5693525b934478c64655b122948b0f5ce9a647b4b08a8554", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642726565, "uuid": "513716ba-02d3-4f93-9d69-f8f4cf8679be", "comment": "Malware payload (njrat)", "value": "cfc125408dd419fb9a9308e80d3c7091780a417e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642726565, "uuid": "b86093d7-0d28-4ad0-8833-a511966af945", "comment": "Malware payload (njrat)", "value": "bfdb21009faace53c6e5251587dae535a97a9f549c148fe72e28749f0079b0e4115557490c845fc65536d26da25026e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642726565, "uuid": "8494a644-3b16-4fc2-bb17-c902a79e543a", "value": "T19B83DF02F5608291DDD94F34DD738EA58A393C20D830867F42A57EEF2A32753DA06A7D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642726565, "uuid": "d52aada4-e015-4267-8380-f1709a91f850", "value": "d5d9d937853db8b666bd4b525813d7bd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642726565, "uuid": "aceca881-de53-467a-8e66-d004bf54defa", "value": "1536:w3kmlgfLWWOHxKwUtwqd9Eg6pFSYjjv/xF8QQ5vIl1NsBX57uozqb1jlc4:w0mlgTLeKNCqSv/Toil1NW5BzqJy4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642726565, "uuid": "5a761c77-cb3d-4751-a81f-2ecd99888a13", "value": 87040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642726565, "uuid": "650be2e3-7082-49dd-8e7f-45e6812a55b5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642726565, "uuid": "0933a310-e3cb-41a0-9de6-2d2cc6d7fb9a", "value": "a1142dd58b658687a9dfc83bfb327dfb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f14f31f5-7aea-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1642791003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642791003, "uuid": "1d78ff45-e741-408f-ae67-794668bacfd3", "comment": "Malware payload (Gafgyt)", "value": "42ca45c34b8f86fa386b3eed4c1c70ab", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642791003, "uuid": "13c1aa3f-bac6-4eba-b1db-9320370e0a26", "comment": "Malware payload (Gafgyt)", "value": "389cbe225a5abb75d39f16eea984be1b1afbcb537c11e5df66ee8684f13c347c", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642791003, "uuid": "9380d74d-a659-4581-9758-b4885c059d71", "comment": "Malware payload (Gafgyt)", "value": "db4f6366cf00e295144afdb5b6b11a3a7970a951", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642791003, "uuid": "e5f98546-c904-4945-83cf-02e6fda7ed73", "comment": "Malware payload (Gafgyt)", "value": "4c57b2a1ff1b110f1ab74c8d4f60d84851627648364e1ea641f5da0046c8750b57d1a734fdff9acd1ecc90f08aaed178", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642791003, "uuid": "ff7a85c2-7620-4c0e-88c8-b943e1a61b1c", "value": "T1BF33E28C963BEE38C8755477D2990288FAB051C2B902C7532DC5E6BACCDD58B89B6CC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642791003, "uuid": "a69174e9-41ff-4511-b862-3342b967db0b", "value": "1536:2R6gmnNRLYRTjGmr+gyWNuAGPcFuefClcpfT:K6gWNuTj4AVuDcBT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642791003, "uuid": "7cb0274c-126c-4aad-93ee-74b0b11b8296", "value": 51584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642791003, "uuid": "2117d446-6aa9-4991-9f3c-c362ddf2d966", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642791003, "uuid": "04c8bbb2-22cd-49c4-8cea-07d1a77d13bc", "value": "daddyl33t.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acdfce6d-7af3-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642794753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642794753, "uuid": "287a2b15-dd2e-4552-92a2-7dd69176690c", "comment": "Malware payload", "value": "6b846d45f4aabb9a4d19c17fbf5b3f28", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642794753, "uuid": "65802202-0eff-40ba-8270-4bd2164802d7", "comment": "Malware payload", "value": "38cf92de5c97f9f79ddfb5632ac92f2670f3aa25414943735ddbe24507ad49f3", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642794753, "uuid": "6c91fb04-0044-4436-b995-400c0f50186d", "comment": "Malware payload", "value": "b151b9bbe811e62d691b9f963727b0ed47b76131", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642794753, "uuid": "e7a60689-5ab6-4924-80af-d3547b8aee3d", "comment": "Malware payload", "value": "39e1f073c82dfe6c3cf027a0c996ef7e55f827f5ae4a1d9ad4bf18ec95f79725b285896028ee58383022687311bb1bdf", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642794753, "uuid": "9a3f26d1-91e5-4e96-817d-fd5255b30d4e", "value": "T1BCF44A0666A840D4E567B138B51FC616D771BC2F0BB1834B03A8FE7E6F336614E2AB15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642794753, "uuid": "7931f1e9-45d7-4725-88fc-b5d6cf80f1a1", "value": "12288:gsX751Gmi1hcU6g7zCJnTBUxJmODHLU8sE/ATmThxpB9PHP5tT1:Xr58blp7zCWXLUMlTL9PRt1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642794753, "uuid": "2986c141-6cb8-455f-81e5-cdb6e3c45f6d", "value": 743424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642794753, "uuid": "877aa5f1-d86a-4b20-96d1-dd2864ff00ca", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642794753, "uuid": "b73483ef-c8f9-45d6-aa5c-06dc252b55c2", "value": "Documents-17.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a8810e5-7abb-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1642770429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642770429, "uuid": "f077aea8-5fc9-40a1-8fd5-50adb25df708", "comment": "Malware payload (Loki)", "value": "24288083f44d7919bb85eb80f477161b", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642770429, "uuid": "e34727f4-58ec-4693-801d-a0c6fd6a865a", "comment": "Malware payload (Loki)", "value": "39b183293cf97134d5e408ddf4f50a479e5c1252377148b6cb7c8aef6926661e", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642770429, "uuid": "04753766-1f85-4950-8310-9cc0538365e3", "comment": "Malware payload (Loki)", "value": "7e6f6bcbc8af4a9894a0137947575929ce9e3550", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642770429, "uuid": "4e0c1958-f106-40f5-a997-68f6c1a67e7f", "comment": "Malware payload (Loki)", "value": "395ec5e8f731bed5334bbbb2e7e0376c3687d66885d2a222eb57462719bc5796b75ba255dfbc94bb946f0dcc67fe7631", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642770429, "uuid": "f15ed7b1-1b50-408c-9b9d-e6fb2e08aa16", "value": "T13004124FE860AC96CB30E1BFCC3EA2E10548628C9494D50D6175E5B6B78D3DF972BE18", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642770429, "uuid": "a6fff760-de2a-479e-b918-86a40029733b", "value": "3072:xTFYRDyEsfItH28n03N6v/Gqy4uqXHhyvfKIFz6Mq112NQvq+xLhPEaQGxKKGzLK:xTeRmX8n03c/Gqy4u+HwvfKCGMe1vU9k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642770429, "uuid": "e03e84a3-dc32-46e1-8024-28df95c44f90", "value": 184989, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642770429, "uuid": "a5334780-2818-4228-8e48-4955d128ca37", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642770429, "uuid": "12e78cba-5004-4988-8f4d-020b1a784a82", "value": "USD53511.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "136705ce-7ac7-11ec-9275-42010a9c0029", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1642775598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775598, "uuid": "9efb47e3-a282-449e-8b3e-0cf88f00ae86", "comment": "Malware payload (RaccoonStealer)", "value": "0dc19a0debe1c28e2a87eca0914ace2e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775598, "uuid": "d18e817e-1903-407e-8742-0402c035afed", "comment": "Malware payload (RaccoonStealer)", "value": "3b5e990293dcfca8b51f8d5f6c958a9f116411d865a6fcc263203f08d42d5575", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775598, "uuid": "e5aa8d0c-fad5-40c9-aa4d-a43088009b18", "comment": "Malware payload (RaccoonStealer)", "value": "9d161b01a929c0f9f365976543ebafff43bf8ac4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775598, "uuid": "08914762-acf3-49e8-99bc-3a9896b3d9e6", "comment": "Malware payload (RaccoonStealer)", "value": "b27070d40130de95cbc24a64a83fcc49f71a45641824d35388ea1fe8595ab30dfc81384e4075c4eecaf421699eeb3136", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775598, "uuid": "5387f1cd-fcc9-4578-ab55-f56939b33a1f", "value": "T1173512945259D82BC5AE0AB4D506F1F487B85F87E982F30B8EE1BCB73DB33805905297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775598, "uuid": "dcb80b50-6f79-4378-a0d2-2e102460c676", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775598, "uuid": "7768cf89-ce60-4f2e-bc49-1da26db71f6e", "value": "24576:AtDTmitq1QYvpkLlKLsrOqe8PZagKcCV445qhBBFEkUNfHXAEI:AtOitq1QMkb5IgKcP45C/F4w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642775598, "uuid": "acf735be-975e-4ad2-99bb-2f0adea87ffb", "value": 1141760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642775598, "uuid": "0b08ebe7-a495-40bf-9e15-2e94877aafa2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775598, "uuid": "d8dfcce4-788b-4651-870c-4abff7ad79ab", "value": "HBL# TPEA118114, ETA 19-02-22, SEA.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ae4905f-7acb-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642777463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642777463, "uuid": "fc3c2397-f1cf-4ff9-8765-b5e0aa00edfa", "comment": "Malware payload (Heodo)", "value": "2eafedc8284a578087ce65f5c70ea799", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642777463, "uuid": "204a76d1-1e24-4e75-b3ef-667f4b008c5e", "comment": "Malware payload (Heodo)", "value": "3b88082b98ac63d24a19d2c48be5a67d0a1dc032772df4ae97c58d321c1131f7", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642777463, "uuid": "227bdc02-6de3-47d3-985a-9de6b2f40c8f", "comment": "Malware payload (Heodo)", "value": "128f2b1529a6400d9f5b01683f8f8699b64fcc1a", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642777463, "uuid": "c2e842f6-bf2e-44b2-ae11-b0e7aff7846b", "comment": "Malware payload (Heodo)", "value": "0793e831cd7928ca7726271d2701aa64347e5a059b61db32a9c52b107768ef579c837444304352ae75d2c762da3b9190", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642777463, "uuid": "8ffb08f8-ad5f-4eca-89c2-0f6000352a2f", "value": "T1BC636CA7B78299EADA0483394DB643C5B717EC104F9A43C73694F7346EB49F08D9324A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642777463, "uuid": "9a2662a1-6506-4fcc-a8fe-7698c5011d82", "value": "1536:bpEk3hbdlylKsgqopeJBWhZFGkE+cL2NdA8eXZiozeOgXVZKyaZpvyR1kZkJvU+:bCk3hbdlylKsgqopeJBWhZFGkE+cL2Nr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642777463, "uuid": "db67e6d7-ea90-4f82-8dfb-9c4b4a4837d6", "value": 72588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642777463, "uuid": "c041915e-3ff7-4b18-9eaf-482dd79075c2", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642777463, "uuid": "7e5dfa64-1179-46c6-a92c-1c111367bcfc", "value": "IG4169895198414_1.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "332227c9-7a85-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1642747304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642747304, "uuid": "9bb3f0c4-6e6a-4cb3-9e66-f966eb63b396", "comment": "Malware payload (Gafgyt)", "value": "7ab259b369da09431d745231ead1a43e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642747304, "uuid": "7f4a6920-bb03-453d-85a8-df500318c0fd", "comment": "Malware payload (Gafgyt)", "value": "3cb0651a202caee2532b185b4df0761bfe7aa688c6cb14c3424d1c0c125b444d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642747304, "uuid": "4ee7bdd5-f2d2-4792-8892-b434496562d8", "comment": "Malware payload (Gafgyt)", "value": "7c6ec2939f1c41b01017c6dbbdda42b9f5366da6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642747304, "uuid": "73c04c45-7630-44d1-b3fe-1cb549d28836", "comment": "Malware payload (Gafgyt)", "value": "f7fed92782c492aba02dc2a03cff1c6703454df6c2682256bb50f464935fc35fa832a8722a8a793ae6918f839d8d450a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642747304, "uuid": "b7e54ad9-61db-49e8-9711-85d82a3043eb", "value": "T1CF934C06F8419753C1C327B6B7CF47093B3667B957EB330266386FB02BC67991A25A60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642747304, "uuid": "6b74a267-79b2-41c4-9d9c-f10281694cd7", "value": "1536:ZvgGLI1gX3JGQxPuwjxtOZy95hXNKV6T/Fo2kjvVqQEqn/lJXCPe:tIHQjjB5hXNKV6T/cjvVqQEqn9JXCPe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642747304, "uuid": "6433673c-f86f-40c7-ba53-4ff534ecf5bc", "value": 96620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642747304, "uuid": "05789cd7-f97f-4e5e-ba39-5e9fd6d179a4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642747304, "uuid": "dc700211-9cc7-49b9-a89e-052eea891281", "value": "fuckjewishpeople.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a568f262-7a8c-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1642750503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642750503, "uuid": "9874c3bb-4bb4-455f-8923-1d77050ff271", "comment": "Malware payload (AgentTesla)", "value": "8513b1012c5df22866e3fb5640425204", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642750503, "uuid": "ffb2b324-15c6-4c1e-a2b5-1e84fb71f385", "comment": "Malware payload (AgentTesla)", "value": "3ebd890a91aecc363eee5d72c410ce016a7eadc2c5226f7ee6f6d8df6bb07ee6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642750503, "uuid": "e7211b92-1c3f-4aa5-b5af-b664a65db6f2", "comment": "Malware payload (AgentTesla)", "value": "29438d918ef7d1bcc8f43b7e46840fdcbb2d6c84", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642750503, "uuid": "8ec817b8-53fe-4076-a9b6-4ab18bdc2cd6", "comment": "Malware payload (AgentTesla)", "value": "bcf3e4bc8bc0246812ce42e727473087f8a34bfb79079022150cdb2a2a0e862051f4d87a2cce5925d871c6b78a6ce03b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642750503, "uuid": "9b6c832c-800a-4d1e-8e7a-3ff3295f12c1", "value": "T1E835CF7B31196F59F03FA33E532094558BF4952BE32AE6DFBD84A4D74C82B02C716826", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642750503, "uuid": "e479aaa0-e539-481e-84b0-83cca16d84c6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642750503, "uuid": "cc55244e-5ccf-461f-b97a-a669f939774e", "value": "24576:24RjAqebvtmQiFkVcMA/n/fm0O1jEubFiekgwEqQv:2HD4QfVcMA/nQZEub4+7qQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642750503, "uuid": "2dfb062d-274d-40ca-8f16-40dd8bc753e5", "value": 1121792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642750503, "uuid": "76cbf917-6db7-47ff-9490-170b79635593", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642750503, "uuid": "00aee284-aa0a-4e14-923c-6d257319f929", "value": "soa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea428720-7abb-11ec-9275-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1642770804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642770804, "uuid": "6441fce8-d0ed-4f64-a309-ef794de64bc3", "comment": "Malware payload (Quakbot)", "value": "e59bf97850b2ed7e5c92b409d328d030", "object_relation": "md5", "Tag": [ { "name": "cullinan", "colour": "#E97EC8", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642770804, "uuid": "a2ff60c2-f7c0-4809-b68c-a660a3f4f77e", "comment": "Malware payload (Quakbot)", "value": "3eeb2414cf302196ea30fb6b8128fae3487519b99447d13be300b3df92971868", "object_relation": "sha256", "Tag": [ { "name": "cullinan", "colour": "#E97EC8", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642770804, "uuid": "7b261c4d-fcd4-4e77-ae57-bbb77ce63f69", "comment": "Malware payload (Quakbot)", "value": "d9c51be1559b3f14afef91f52155634f52fa116e", "object_relation": "sha1", "Tag": [ { "name": "cullinan", "colour": "#E97EC8", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642770804, "uuid": "fc2f84bf-7660-446a-a78c-d8512e860cc1", "comment": "Malware payload (Quakbot)", "value": "92e2c7eb41db7aea9c799f0ce843a846293210b945f7e4bd0d638009afac2e86dba2db19a787c9a6e621059e1b94d32b", "object_relation": "sha3-384", "Tag": [ { "name": "cullinan", "colour": "#E97EC8", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642770804, "uuid": "272505e3-fbf9-4063-9973-a1ac65688e8f", "value": "T1B8D49F22F6D04437C2732A389C5F57689839BE002D396C4E6BE91E4D4F797817B6839B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642770804, "uuid": "2bf7d144-0a4f-4e2a-9df2-e2238ced507e", "value": "103cdde97f8f89c1d8e5839a60e3d584", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642770804, "uuid": "b6e4661c-f8f0-469d-8eb7-3a9c54d362df", "value": "12288:L0yyJw7jxx1nVnhHXmfdoS+rEflFnUtGA3:I3GRxvJIdoSLfl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642770804, "uuid": "06d62461-1784-45cf-b3c7-02bb54aa7799", "value": 643599, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642770804, "uuid": "277b9bf4-654b-4d41-9d97-b2b35b143dd2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642770804, "uuid": "f5491fa5-62b0-4ee0-96f8-4cd22111977a", "value": "3eeb2414cf302196ea30fb6b8128fae3487519b99447d13be300b3df92971868", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0a0f463-7a95-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642754467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642754467, "uuid": "9e4d1b36-0110-4324-b568-39c3b0a9941d", "comment": "Malware payload", "value": "ad7d919716476bd380322c0c05cb85b6", "object_relation": "md5", "Tag": [ { "name": "pw vodafone", "colour": "#096C78", "exportable": true, "hide_tag": false }, { "name": "vodafone", "colour": "#8E01DC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642754467, "uuid": "3ebfaa18-2006-49fc-8bbf-0fddc9142b16", "comment": "Malware payload", "value": "406d6a9c74b5cb76c4ac874dcc0507ee29a9e68528fd9179d128b55230b0a8e1", "object_relation": "sha256", "Tag": [ { "name": "pw vodafone", "colour": "#096C78", "exportable": true, "hide_tag": false }, { "name": "vodafone", "colour": "#8E01DC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642754467, "uuid": "6bfc6ffb-26bd-4a57-a804-a496a03dfa22", "comment": "Malware payload", "value": "cb2a5cf50d7e9929fb9adb47315e0b544c75531c", "object_relation": "sha1", "Tag": [ { "name": "pw vodafone", "colour": "#096C78", "exportable": true, "hide_tag": false }, { "name": "vodafone", "colour": "#8E01DC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642754467, "uuid": "5a1cba85-06fd-474b-a8aa-2af639369a1c", "comment": "Malware payload", "value": "61ac8bccc999d3d4499248483b0841a4d09159d81bedca6c4dd098f534649db91e455757311d61ebf056b64b3cfc6f87", "object_relation": "sha3-384", "Tag": [ { "name": "pw vodafone", "colour": "#096C78", "exportable": true, "hide_tag": false }, { "name": "vodafone", "colour": "#8E01DC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642754467, "uuid": "f3b55a1d-8952-4f13-a87d-1ebed29298fe", "value": "T1BAE0C0FB86C70183E45D0C325199F2D0B314EA02E5F412675382DD941C66141DF33241", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642754467, "uuid": "03aa1e0a-cdb5-4be8-b500-ff7c93b5d928", "value": "6:5j5lyekIgpUtMHHKKN+M/CO8NLFrQT86DNopV/Fjb5J04HT+SwEe0zUjt+lMs/l:5j7HqpUtMh/Cx2T86DNo7dv5+4+WUjtu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642754467, "uuid": "e03e9029-b660-4dff-a771-293fdaec3c21", "value": 376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642754467, "uuid": "5ee28bae-cf1d-46fb-8a7a-ec4e21dddfe8", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642754467, "uuid": "c89fd545-e255-4bee-9689-b1fed6d5f77f", "value": "vodafone_6.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "349b71d1-7a7e-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1642744300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642744300, "uuid": "c0f935f7-eb87-4753-adc6-948d616c6f81", "comment": "Malware payload (AgentTesla)", "value": "7a83f713bc70fcc25075f83c46398fa6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642744300, "uuid": "e81a547f-5f4c-421f-9ccb-acce63097db0", "comment": "Malware payload (AgentTesla)", "value": "40c324542b9ade8ca19512fc97c0c68582f1626803ef5cedb833b6533d48279a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642744300, "uuid": "3b788097-4c3b-49f6-a692-ff600b91cb94", "comment": "Malware payload (AgentTesla)", "value": "bbf2afaac1a59dbe37e37962eec48cf1797df2ea", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642744300, "uuid": "510cf9af-5e40-45a9-b58a-3ea99697b61d", "comment": "Malware payload (AgentTesla)", "value": "e3cf3353b5bd4508302dec9f9ddacee12e8fee284f3b9ace006b72b7f067b3157f5dbe42d001f4ae5d2ca26928e18816", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642744300, "uuid": "b1900d97-79f3-4556-ac30-9d30b4ef7816", "value": "T19DE4E00133F88B45C4BE87FA48761090077EB90AA875E75F9DA5B1DF0DB2B818B26713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642744300, "uuid": "a102c40e-680b-43e9-abb1-8d40d48f42a7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642744300, "uuid": "b40ac303-f547-4eb0-ae47-c54b5de926c9", "value": "12288:4zgldpQNFFQquWq3bGuRUTDUZdd/xHbMp4yvOfbX/dq6+ievYF:npQNXQquWwO/8ddlMpPvcbPc6+ievYF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642744300, "uuid": "954f6751-5829-4c35-bec5-6eb417a755ed", "value": 720896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642744300, "uuid": "468565e9-3164-412c-93f0-1dba4d0a7b4f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642744300, "uuid": "22bc0c1b-3535-455f-84aa-97d12be97b37", "value": "Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e341ed10-7a95-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642754472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642754472, "uuid": "ac59a7ed-8fff-4292-acec-076f61f9de99", "comment": "Malware payload", "value": "109bae24a0e15c105e700cc5cd6a822f", "object_relation": "md5", "Tag": [ { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false }, { "name": "vodafone", "colour": "#8E01DC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642754472, "uuid": "8531ece2-d92a-4e79-be80-37291f978300", "comment": "Malware payload", "value": "40dd0996491a7154387d64d47d6140af5936a4d3e115bf942b89c4c265039b48", "object_relation": "sha256", "Tag": [ { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false }, { "name": "vodafone", "colour": "#8E01DC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642754472, "uuid": "0fe0d0b0-100a-4a90-94cb-c53d6d19436a", "comment": "Malware payload", "value": "6e65a0a941afb2740d77537068cc1202dc3e0fd5", "object_relation": "sha1", "Tag": [ { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false }, { "name": "vodafone", "colour": "#8E01DC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642754472, "uuid": "468905a4-b6a2-4f14-9343-4cd48e34192e", "comment": "Malware payload", "value": "1b84c7d9346863bf63f7f26260bd58e8097455c0b398adb2e9bb8c786a7a6bc8fd73f977f0cd09511904c368e44089f7", "object_relation": "sha3-384", "Tag": [ { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false }, { "name": "vodafone", "colour": "#8E01DC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642754472, "uuid": "2114b1fa-e641-43af-b58a-71ea45b2cdf8", "value": "T1C4D022EE6483D0D8A99B30496B10F66D840DEB30E85E1A0CB45490A400502BFC409B37", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642754472, "uuid": "0a1ed19c-8940-4e18-893a-346362f94a4d", "value": "6:GqSB1+trsxROM2a567ScKnOXELq8Iwn/12XKDPXbFTy:GqSfKsXilTYqLwn/1UKDvxTy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642754472, "uuid": "cef6d22e-f2dc-4295-827f-2e71092b3a55", "value": 214, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642754472, "uuid": "cbe2299c-aa1f-4bea-8edd-e90be82db380", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642754472, "uuid": "4d9b2a35-206b-4eb3-b0bc-38e51d201556", "value": "vodafone_6.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d42030bc-7a8d-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642751010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642751010, "uuid": "3a4c8092-e129-495a-adf9-46b1def88b6a", "comment": "Malware payload (Mirai)", "value": "c3487dd33e62c875edd5b31e8d0def14", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642751010, "uuid": "74e2fb26-8fb7-457b-9c1f-df49d3ea2866", "comment": "Malware payload (Mirai)", "value": "41745ba197d50482d28431f9e8a4b5ec140bdbbcac6cb9880b077a846ba1571f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642751010, "uuid": "e5f158a9-c113-42dc-94ac-f53cd5240b24", "comment": "Malware payload (Mirai)", "value": "95fcab86d2a727f26ffb61c28664828fa5136dbf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642751010, "uuid": "0d9516de-ea27-49d5-a359-b4986a359cc1", "comment": "Malware payload (Mirai)", "value": "480f03f2f14aa0f54f92d0ad5ba339afce7d4fd6becaa2609b283f8b40eec62f86a938bad84d20d06a46d9e5044deda9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642751010, "uuid": "f0f32e64-29e7-4179-883a-144da88b614c", "value": "T154F3626B7E209F29F75857310AFB6D38835A23A726E5DA4AC19FD6001E3131D5C0FAB1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642751010, "uuid": "f9e93d33-cf8f-45af-b1e5-781fe41abb65", "value": "3072:HW9q4OhvM/9MspbKfT0iLgrUEClNwiYgqV39YHYGFb1lLd33jW54M:28jspbI0iLgrUCapFb1lLd33jWmM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642751010, "uuid": "e19a8881-00a1-41af-81fa-2ba1c657e9c2", "value": 165696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642751010, "uuid": "1009c227-43e2-4f60-a362-9368f681ef1f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642751010, "uuid": "7b860031-2554-4425-bb6d-72b97f4429c2", "value": "c3487dd33e62c875edd5b31e8d0def14", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "baec6bab-7a9b-11ec-9275-42010a9c0029", "comment": "Malware payload (GuLoader)", "timestamp": 1642756981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642756981, "uuid": "5cbc0d42-edd3-45a0-8996-5944b76aeaf7", "comment": "Malware payload (GuLoader)", "value": "fcdf169b996d6665693fd09de8c85aa9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642756981, "uuid": "2459b973-a02c-49bb-8b60-b244474b33fc", "comment": "Malware payload (GuLoader)", "value": "43bef6cb68e3b49bbc9e40c3b1642d6e7b0c465bc04d3082662bb2e8a66bd9e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642756981, "uuid": "bdb3a6f1-d5e8-4d00-bb10-2e485855cec3", "comment": "Malware payload (GuLoader)", "value": "d6182222c7946ee1896f6b68c2cd099338afda45", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642756981, "uuid": "2473f5f7-4d1a-4043-a3ce-06553df08cee", "comment": "Malware payload (GuLoader)", "value": "87b674a12fc8106909fc353fef02fbb85eedaebaedf905cca149decf559bf89678e407501e4389758f37ff37d64fd4f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642756981, "uuid": "8fcfbea4-c0f7-41c7-ae62-5ed410e8fe4f", "value": "T155143A43438001F2FBEA1638E576CE5054C9BD351361ADDAF59F3A9A0EB3093A85F267", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642756981, "uuid": "f8e8e2d1-0d92-4381-ad65-777d0d06ac2f", "value": "d1dd9a1cc9b847fb0a2f2da39dd0aecf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642756981, "uuid": "bdacb788-3072-48a0-91c0-8de2cd8b9394", "value": "3072:p/VpX9s5yGGbb47o4sCVlvkQlqRQjbN6W/U2LMsyis5dpAv:BLVGeADlq4NE2LaJE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642756981, "uuid": "47e5220e-a400-4dc8-828d-50c5122c593e", "value": 192512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642756981, "uuid": "83cfffbd-7713-4c46-8de6-d996513dac28", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642756981, "uuid": "2fd45f04-3205-45fe-9e99-c6e5d8e8da04", "value": "SecuriteInfo.com.Variant.Midie.106755.28386.14528", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c748c412-7a77-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642741540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642741540, "uuid": "6c67e990-6657-4945-b388-3fe34aa6d51c", "comment": "Malware payload", "value": "40f26b4c48d78250b916d896d0a728e6", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642741540, "uuid": "26861e19-fec0-48d7-9d71-d69d5e2680ce", "comment": "Malware payload", "value": "440cb31e30662fad4fde3b1629137542ef77b49eb3214ba7bd61c93fc515f93e", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642741540, "uuid": "16b383f5-fbb4-4cc2-91ed-e04ac906187d", "comment": "Malware payload", "value": "fb9fb0f89fec41ba4b295b6d1bce534ed345d20f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642741540, "uuid": "047ad39b-2079-4948-889b-d065b36cd06f", "comment": "Malware payload", "value": "a316154060c6a04b929034237b89fc338d151c92808d1e36819f47ec7e99bb1d8f5719fd2da68371b9a21b939abe8ae1", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642741540, "uuid": "ecbae611-7e14-4a47-85d0-a4c21fa3a28b", "value": "T194D2F786F5819B11C4D5127AFE0E164E73135B2CE3EF67226E146F3467879BB0E3A806", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642741540, "uuid": "7c9a36f6-d3ed-415f-bd07-4b56ca3cd7cc", "value": "768:W9noOEXlpD0mm5IiJdiFeB9VhaMPZVxEO:W9nVwpF8IQiFePVhaMO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642741540, "uuid": "6c7df67b-a31b-4962-ad6d-1f0197b1ec87", "value": 29984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642741540, "uuid": "56280ec8-1c8d-4985-84af-4a36e14fc956", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642741540, "uuid": "4732297b-6acc-48bc-b168-8b13eecc5fc7", "value": "beamer.arm6-20220121-0505", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4cb4c3b-7a90-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1642752246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642752246, "uuid": "e541e71f-eae1-4909-807d-ca966a09c284", "comment": "Malware payload (AgentTesla)", "value": "c185fecbafc7e226e4eb5577d8777ae3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642752246, "uuid": "6793462d-5e11-4ca0-9693-0fd28bd380b7", "comment": "Malware payload (AgentTesla)", "value": "440ea2ee8ce0040d8915262110fc3a99d3970f1da78c162edc86e2b25c50a579", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642752246, "uuid": "61a405c1-7199-40ad-9e01-432d60e8ef97", "comment": "Malware payload (AgentTesla)", "value": "f11446b804d76503626d1f99de9dc6492d5e2145", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642752246, "uuid": "01cc40ed-5418-48cf-ac14-6f6c6448b1ad", "comment": "Malware payload (AgentTesla)", "value": "ee1c1d6eea3343585cd7505dc3287796822cc6b7b0a209f816ab6ed78fcd6208419a0410212af7f3be09b1194cbfaed4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642752246, "uuid": "56963d56-cff1-494a-b250-71f011c0206c", "value": "T10665BE73A0146F59E83FA3395731C4254BF5AC2BE735D19E7DD4B8CB2EB1B428225822", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642752246, "uuid": "4d394782-a475-46f3-9ae8-9d18bde63778", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642752246, "uuid": "a2f10483-d25f-4116-9100-9d93cf9734e3", "value": "24576:qPUnjATeHu7dAjjhQcAK/HQt/iqNFiekgwMq9t:OSHuujjhPAIQt/iqN4+bq9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642752246, "uuid": "00031d8d-775b-4c28-b2ca-61998018c5db", "value": 1446912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642752246, "uuid": "af121ba5-ef02-495e-8c9a-97d2297e80d5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642752246, "uuid": "6258f71f-c77f-499a-90a5-2a7bcb494bcd", "value": "JAN SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dade0cf-7a59-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642728478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642728478, "uuid": "c78e0dba-10eb-4dec-94db-142bf70882a2", "comment": "Malware payload (Heodo)", "value": "98243298267d53aee8f08f98f7e897af", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642728478, "uuid": "508c3bc4-84fc-4470-b55e-aa79a7358ca9", "comment": "Malware payload (Heodo)", "value": "4520398e8aeabb1aed9cd4899a2ac014545d9ad9383959288cf2470f9c1c4731", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642728478, "uuid": "76b48642-4614-4c00-86fe-3ac3c2f8ff1b", "comment": "Malware payload (Heodo)", "value": "4ec1e8ce74bdd64d46648d4fcf80f2ccf76a9e59", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642728478, "uuid": "55cf570e-31f1-41be-9814-195d0df886df", "comment": "Malware payload (Heodo)", "value": "0c0226f6d5657f6cc988c88ce7dcd764c27391191f98d49f13471cb953354aa30bc7ce33e2a3a201d33c922fb72ce504", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642728478, "uuid": "4a45458f-3c40-4464-aba5-ce3add03a2f9", "value": "T12D636CA7B78299EADA0483394DB643C5B717EC104F9A43C73694F7346EB49F08D9324A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642728478, "uuid": "fcf29b3e-0e2e-46c6-a23e-06b38e09e1f7", "value": "1536:bpEk3hbdlylKsgqopeJBWhZFGkE+cL2NdA8eXZiozeOgXVZKyaZpvyR1kZkJvU+:bCk3hbdlylKsgqopeJBWhZFGkE+cL2Nr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642728478, "uuid": "56bfcaa7-691c-46e5-a15a-90145ebbda3d", "value": 72594, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642728478, "uuid": "ed5a554b-9aa8-40b1-9c9f-4e21fbc75fd2", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642728478, "uuid": "44f75bc2-63d3-43e4-ad65-94a046ea1b99", "value": "98243298267d53aee8f08f98f7e897af", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6700da5-7ac5-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1642775120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775120, "uuid": "edfbab8d-355d-487c-8a47-689d98e8f612", "comment": "Malware payload (AgentTesla)", "value": "f2c800050f669a7ac42407b9b9fe0e57", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775120, "uuid": "1e90c646-df81-4fae-8e47-1c5491996316", "comment": "Malware payload (AgentTesla)", "value": "4609093cae7be486994f47b76f6f254001fbfd697fea54835ffaa5410f393728", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775120, "uuid": "d6e2f6ac-47b2-4d90-850c-e303c9db686a", "comment": "Malware payload (AgentTesla)", "value": "b1b32e37f09592a6453d5839ecb42fdb3e75e3f3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775120, "uuid": "bba2fdaa-5917-47d4-a67c-4eb1264d25f0", "comment": "Malware payload (AgentTesla)", "value": "908900d32eba3df64ef94648f0e4d6762591af339bd964cfe0a82d2934791a487996fc51ccba1179397eec549dda3f0a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775120, "uuid": "7d430c76-cf42-4ab2-aa08-0a95dc4c4094", "value": "T10E050131BFD11719C71FC7B45978BC208378F88A2954CB6F4A4A6CDA1638BE59760B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775120, "uuid": "07c02782-2f14-4868-b337-d426917f69c7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775120, "uuid": "80dcec66-04b9-4ed0-819f-4b3a9c3977a8", "value": "12288:79QiiiiE9WfXGd3334avYjxGSenJ6YNPGMN3X6Fw+Re:pQxfXk3334aQAnJ6QGMVqFw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642775120, "uuid": "1ad6a825-02f4-43eb-8477-447b57139817", "value": 828416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642775120, "uuid": "b4734f70-35f7-4b82-b981-aaca7d5bd83e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775120, "uuid": "00827c95-c725-485d-b80e-3ea87c7644ba", "value": "hesaphareketi-01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ccbb7d3-7a9a-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642756313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642756313, "uuid": "4da8b8a1-5879-4270-9c00-124be6d7171d", "comment": "Malware payload (Heodo)", "value": "cbc9568e7dbaa353b37b9ea2c68f3093", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642756313, "uuid": "f1680a02-c184-411e-b82d-36b654fda3f2", "comment": "Malware payload (Heodo)", "value": "46882c3121ab7988e53d6c0870a97e8e8525f0faf932ebbabdd573283c6ca8f0", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642756313, "uuid": "6017d921-925d-4d98-81f1-551921491b8e", "comment": "Malware payload (Heodo)", "value": "2b349f432fd6c5f4c96ba2bc15ad3017251416e7", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642756313, "uuid": "0e334a13-c1fa-43be-959e-52a0cfbfb16e", "comment": "Malware payload (Heodo)", "value": "6f774115e324c0af74d038e22812439168249e421d8ff285c474a67eea944dcea8f02061b8dcf63548be8131e02f26fc", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642756313, "uuid": "796fd923-84ca-4f32-9a9b-fbc9f1087346", "value": "T147636CA7B78299EADA0483394DB643C5B717EC104F9A43C73694F7346EB49F08D9324A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642756313, "uuid": "9814f20d-bd97-467a-80f3-a25c0af352f4", "value": "1536:bpEk3hbdlylKsgqopeJBWhZFGkE+cL2NdA8eXZiozeOgXVZKyaZpvyR1kZkJvU+:bCk3hbdlylKsgqopeJBWhZFGkE+cL2Nr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642756313, "uuid": "fbd75690-e8ca-4dbf-bd43-7045d0125208", "value": 71314, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642756313, "uuid": "a4fa3bbb-3614-4dfe-8b99-e180f52cff3c", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642756313, "uuid": "f3836a6f-b46a-4898-bb2b-7133992a9cbd", "value": "NF-7949 report.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "966ddad5-7a65-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642733727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642733727, "uuid": "f035ae1d-b03f-4764-9ba8-c60ad41e367e", "comment": "Malware payload (Mirai)", "value": "d60f2b0aded8eb8614c30b43b6944fd9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642733727, "uuid": "441fef0f-c60e-48ae-b574-3c8e58668387", "comment": "Malware payload (Mirai)", "value": "478df6827563def2d75e26b35c3444f10474ebbe970766127f941f66a2e391da", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642733727, "uuid": "4317318b-028d-4e71-9ab0-33f0756f50cd", "comment": "Malware payload (Mirai)", "value": "8afb2e9490ca96238e6be2abd660da2350a220a5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642733727, "uuid": "c3cc1694-d79c-4b84-8f3d-5553f080fd2f", "comment": "Malware payload (Mirai)", "value": "b365c6c7bff2d607339650e248497fa143b18d709eedab97a03d4851da065fad3a5ef4993c5af2f206cafff7e83c1b48", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642733727, "uuid": "d327e05f-adca-4c32-bbd8-7e82898ddc5b", "value": "T1E4431925AD792E26C0D4B57E51F78324F2E2220D22B8C65E3C721E4EFF14B4069577BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642733727, "uuid": "0ebe90fc-af1a-4c63-a427-c422cff31b6d", "value": "768:02oW+YBq9esj3ld89S6h/KpADsB06WslGiChXd//qxTxcO+hI7Q:02B+YBSesj3ld8wm/KeDsB06vlwKm7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642733727, "uuid": "0586a01d-5731-480b-838b-b2dafe99d5ae", "value": 60196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642733727, "uuid": "275fd2f0-420e-4f65-97bc-debb8fd3a77e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642733727, "uuid": "763149d5-d19a-4237-8ebe-68268102e64d", "value": "d60f2b0aded8eb8614c30b43b6944fd9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c0e7722-7a9a-11ec-9275-42010a9c0029", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1642756312, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642756312, "uuid": "86df6082-99d1-40bc-b230-7badf0d7ba70", "comment": "Malware payload (AveMariaRAT)", "value": "4deba284f263559fc20e6f08f5a4b451", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642756312, "uuid": "609bdef0-64e8-4f06-af60-db319e7e0b3b", "comment": "Malware payload (AveMariaRAT)", "value": "482141529511a59394d78f3a0199068ef8c5fe102dd3194034e92d45d2f4adfc", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642756312, "uuid": "22b97527-24bc-41e9-ace8-a75b1370819f", "comment": "Malware payload (AveMariaRAT)", "value": "354a657609dd51f59b7fdfd2a9e06d26444cfbd0", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642756312, "uuid": "6b69e72e-5d6d-4721-ab7d-2f7cec7ef9ed", "comment": "Malware payload (AveMariaRAT)", "value": "43d820638f5f2926a9c349a53055011a08fffcaf0a6aaa0c251378734253fa804acb7f705dd4be421dfc8a0e8b355e58", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642756312, "uuid": "db7e74ac-5209-4d03-9d88-9d9136cd0282", "value": "T14D84026D82683517C4AE177AF5513184A23B9287FB71E70D398EF4EA5B07BC20B06793", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642756312, "uuid": "c11a68fa-57fa-480b-b459-8b1d7c7cb3e1", "value": "6144:nZ2Kqkbb9pzLRZqejH5tg8qyoNibOhpRRRRRER+H:nZ2Kqkbbj5ZLtfqyoNqkRRRRRER+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642756312, "uuid": "20f06ff3-bd17-43e6-b35c-46594134ba8b", "value": 389120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642756312, "uuid": "5044c532-f8ed-4e3f-8934-eaa9ed2db9f4", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642756312, "uuid": "bc7a3e2b-842a-4a03-9997-a5831cc4ef31", "value": "Muestra de producto 018833,pdf.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6660a6fb-7acd-11ec-9275-42010a9c0029", "comment": "Malware payload (BazaLoader)", "timestamp": 1642778314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642778314, "uuid": "f1a3f9e8-2411-4f9b-af1c-7161fc8fb8d8", "comment": "Malware payload (BazaLoader)", "value": "ef224d17c7b2d2887a238e037496ae83", "object_relation": "md5", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642778314, "uuid": "c07edfbd-7ed3-42d4-bba0-7be12224e777", "comment": "Malware payload (BazaLoader)", "value": "48d33f902d5d81182b60d6a3f1ccb88dde3538a4a07abf40617dc12e039fb7bd", "object_relation": "sha256", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642778314, "uuid": "88023fdc-1cf7-4745-a214-053f9ccbffbc", "comment": "Malware payload (BazaLoader)", "value": "aece94262ddca2bf181f02c17ec93d35fc3aab91", "object_relation": "sha1", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642778314, "uuid": "2cc7b8e1-c4c5-41ad-ae20-02180adcdd70", "comment": "Malware payload (BazaLoader)", "value": "ed560aaa66cff3c98bfa04156bc1442e776a5b860866ea41a607b2760ef1e940a72022fd3341372d0e7c713bc0ae97cc", "object_relation": "sha3-384", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642778314, "uuid": "242524fc-67a1-4f29-bd3e-1c0027926c9b", "value": "T14C047C68FD4829F5D2EBE776499A6CBA327331764AC79DCD4349B7D21A23361BF02004", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642778314, "uuid": "1a38d7f9-704c-436e-a0c7-ec139e0f783e", "value": "3072:Fe0c55sO6ONG9vAjabe8sfSAOLQc/Yqb4HA2DW/r7Tq7YFvmjfQwhE4XKrb8d9:wGOavAjGFsfSp8HhW//kYFejf7hhX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642778314, "uuid": "24b7c8fb-e29e-4a8c-9929-f91eb97fa297", "value": 178688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642778314, "uuid": "b7f45d00-4d1a-4625-bfd7-7ceced386fb8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642778314, "uuid": "fd413862-3de1-469d-9272-655dba90e991", "value": "ef224d17c7b2d2887a238e037496ae83", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1a08bc2-7a61-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642732082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642732082, "uuid": "a2a71c66-4c86-419c-967c-9bbc1bdcab2b", "comment": "Malware payload", "value": "1ef48cc2684a60f945aef0b27a4b71aa", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642732082, "uuid": "2436bcf7-59ab-42d1-b478-9811f160f005", "comment": "Malware payload", "value": "4a221b5ef8d3d6957123698b818a49f786220ee1aed8d0855fc1400a201747fd", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642732082, "uuid": "58cae3e3-37e9-4dbc-a78d-8363efb9ee42", "comment": "Malware payload", "value": "04647d615c483ade77e42c36a3bd45b1f6c4d98f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642732082, "uuid": "a1569210-2f66-41b4-b5b3-40f7cb81d806", "comment": "Malware payload", "value": "085d3b7bb9c2c5f65001c3cf3de7fad1984142bb8573b9116849a4c5822f5abc0fa8a3fa5f250a0bda301f01f64798a9", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642732082, "uuid": "ae303ebd-87af-498e-bbf3-e63c73572816", "value": "T177230856F9815B11D5C1157AFE0E124A73134B3CE3EE73226E28AF2177879AB0F3A815", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642732082, "uuid": "0dbaf0da-383b-4de9-bde1-dcdbd23ed70f", "value": "768:2UnYTWkfoHwhaG88D0mTwII53xiO8/Ik5Mc+ZLHzTVq15SYnI:2UnUdaGhFkIWiO8/55McKDO5SYn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642732082, "uuid": "63457212-0fa8-4062-a3e7-7162976d25ea", "value": 46488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642732082, "uuid": "34d80e14-d4e0-4bc5-8ec4-9c246940b143", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642732082, "uuid": "8f99be9d-69d5-4709-a8c1-2be5370adddf", "value": "beamer.arm6-20220121-0228", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9667d35e-7afc-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1642798581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642798581, "uuid": "1a3328be-f6cd-4c3f-9137-d764fabfee17", "comment": "Malware payload (RedLineStealer)", "value": "48b4b6f666eb706f29bcd0444ef93386", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642798581, "uuid": "bc12dad5-23fc-4004-a460-a4eabc44a7d4", "comment": "Malware payload (RedLineStealer)", "value": "4a4749f37517ada9dcf74ec18a03247a9682ce45aad3b7c9d10acb492f1de76e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642798581, "uuid": "1e455e0c-00ec-4920-a184-d6a68a922fae", "comment": "Malware payload (RedLineStealer)", "value": "b6ed8e9fe97285ad42798250c5e99b55ad16e54d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642798581, "uuid": "28052fa3-d45b-4211-b197-59c93d6febf4", "comment": "Malware payload (RedLineStealer)", "value": "7c7d136a3f7a33d39c87971b25ee2ff97ebbba52050a15030b496990c82ef52aa468c9f4dd3d734cb9149a7ab1ae632e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642798581, "uuid": "5a131110-638a-4704-aef8-20ff7cfd11d5", "value": "T1C1C4AE723155CC96E45BAAF50B6FC5201FB87AAFC111D61D3F82BA2A50D330221AB75F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642798581, "uuid": "4e4fc265-f4d2-4416-893f-a42626df8b9e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642798581, "uuid": "eceb83f3-eaa0-4363-b584-51a240cb4381", "value": "12288:E6UFjApgZMnM1NOW+z1/Gxdfjv3cpSiyyjK:E6UjAEiM1NOT5IIpd8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642798581, "uuid": "a94ae282-9f1e-4da0-afdd-aaea4013d52e", "value": 589824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642798581, "uuid": "ddb6a759-92c8-4bde-991e-bbcfd7404e4b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642798581, "uuid": "6e3d3904-91b7-4ca7-a79a-d4be78b59a6f", "value": "48b4b6f666eb706f29bcd0444ef93386.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "677f1ec4-7acb-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642777457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642777457, "uuid": "76a1f40b-540e-4b31-ba80-04871099d761", "comment": "Malware payload (Heodo)", "value": "21df993800cf669ad6b181b1dfc050b5", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642777457, "uuid": "b9a689a8-0429-492d-9774-9b3739402498", "comment": "Malware payload (Heodo)", "value": "4a8963c13906d8437eaaceb39a1fd8b65446b82b8f8c0f16e1e4dec89b4c2d37", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642777457, "uuid": "a3506d4f-0e81-4cc9-9418-987d8b7af9a1", "comment": "Malware payload (Heodo)", "value": "74c2e20d06c005da2b1e45c236d7eed0c65d00b0", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642777457, "uuid": "36568078-9b9b-409f-b3ae-246e87aadf68", "comment": "Malware payload (Heodo)", "value": "ac14fb4050ccc70dfafdfd9768be4cffdf85949e55b253def78250de8ee5ccb21be369d262dfb376907ba881fe72d5a1", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642777457, "uuid": "f230f047-fa93-4c3d-bda4-055fd645f10e", "value": "T194636CA7B78299EADA0483394DB643C5B717EC104F9A43C73694F7346EB49F08D9324A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642777457, "uuid": "e492c0d7-4be7-4234-9711-598da9e5582f", "value": "1536:bpEk3hbdlylKsgqopeJBWhZFGkE+cL2NdA8eXZiozeOgXVZKyaZpvyR1kZkJvU+:bCk3hbdlylKsgqopeJBWhZFGkE+cL2Nr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642777457, "uuid": "4380ada0-27e6-498f-bac2-0342caa16f94", "value": 72245, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642777457, "uuid": "28aa0fb4-525e-4fa1-96f6-3a37dbc0db23", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642777457, "uuid": "427a22ee-2981-498a-abad-7dd5da2f466d", "value": "Contact.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00efb937-7ac8-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1642775996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775996, "uuid": "b1b976ed-4887-4f61-ac49-553017855c28", "comment": "Malware payload (RedLineStealer)", "value": "a986b55079bd928ea3ba75c1f2faa0ec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775996, "uuid": "1b82717d-66cf-4cb2-964b-72c2039fd9f5", "comment": "Malware payload (RedLineStealer)", "value": "4ad6b39205820514f582d1208726367822f8b1e17fb646ffc7e923fe577871c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775996, "uuid": "909b8b1e-94a3-4af3-9788-0ba850e39fd5", "comment": "Malware payload (RedLineStealer)", "value": "473e13260ca1fa8a1ae740006e68355608284774", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775996, "uuid": "a40362e3-d621-4ba8-9cc7-c818f6110d77", "comment": "Malware payload (RedLineStealer)", "value": "9e512b53cc1308f4cbbfdfcff37085d3089d3338a6f8c906ee4b8c4ea364461fe67c8903753d519dc0b59a65a4351476", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775996, "uuid": "021e40c4-b929-4cf6-a39d-0192498d3c4d", "value": "T148A4BE10A7A0C439F6B752F449B9826CB53E7AF19B2890CB53D526ED5B386E0DC3131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775996, "uuid": "faee2652-eb4c-4110-b158-2e4a10529d9c", "value": "0152c21ced523378d45e83b1b3a1fdf0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775996, "uuid": "354ffcc6-99a7-45ae-842d-8cccf6dad7d9", "value": "6144:8dXTrs04FC32y5NT7AFz6+dQ/+4xGt3njjHkIzSKUKHUkYLV+84OJsZGOE35E:8d3qYDrT7k6+dL4I3TSKUS0+yO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642775996, "uuid": "162ba595-82ee-498a-bcd6-302071e78eac", "value": 449024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642775996, "uuid": "f1fbf976-5edf-43eb-9c31-92a8ebe495a2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775996, "uuid": "a5d7af8f-adde-407b-b5d7-438120d86382", "value": "a986b55079bd928ea3ba75c1f2faa0ec.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ccb642f-7a6d-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642736959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642736959, "uuid": "6392ed2f-eecf-4756-a277-15f67d1eade4", "comment": "Malware payload (Heodo)", "value": "d78e79ed3186ac22edfeb4f2c0db4ebd", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642736959, "uuid": "eec2449a-4f1f-47e1-835c-00a4774512aa", "comment": "Malware payload (Heodo)", "value": "4beb6b5929b3b8354a098b5f4232886f8db6fe5d02cec83ddcce82e47806ec04", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642736959, "uuid": "43dbad8e-8fac-45bc-93df-a2da2817e07f", "comment": "Malware payload (Heodo)", "value": "a1b0849635056cbae52599841ff0a7989f15026d", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642736959, "uuid": "72bd0b1a-6464-440a-868f-6892ae940cd9", "comment": "Malware payload (Heodo)", "value": "d754acbe3c2f343643aecd908427cf8aa265cd2a79fc07bd76e2323f1bec4632e745b8f7d5479fce9342bcc4cc829a79", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642736959, "uuid": "ae1ce1d1-6ab7-4b14-8ff9-7920a7e10d29", "value": "T187636CA7B78299EADA0483394DB643C5B717EC104F9A43C73694F7346EB49F08D9324A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642736959, "uuid": "44e86928-c8c5-45d7-acca-beb6ef8e45ba", "value": "1536:bpEk3hbdlylKsgqopeJBWhZFGkE+cL2NdA8eXZiozeOgXVZKyaZpvyR1kZkJvU+:bCk3hbdlylKsgqopeJBWhZFGkE+cL2Nr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642736959, "uuid": "481a8894-9b1e-4af7-89b5-79c309de8b01", "value": 73120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642736959, "uuid": "c79753b1-6bc8-4864-b3f1-d5dad8723e2c", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642736959, "uuid": "447faaa0-8129-4887-97af-a37355377feb", "value": "d78e79ed3186ac22edfeb4f2c0db4ebd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd61fc83-7a9b-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642756985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642756985, "uuid": "0698032e-e8bc-4125-80d6-a655d524f172", "comment": "Malware payload", "value": "57e8ddbc27a4e40057443a9af4ddb0bb", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642756985, "uuid": "7dfdd8c0-2e0b-4a3a-9366-595159f843f6", "comment": "Malware payload", "value": "4c8aeb192fc82ae0e548e69f3340caf91268c10127ef4f2f10c4ad8688489aee", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642756985, "uuid": "1cfc0153-0da3-4be9-aac6-b34d8f488a2c", "comment": "Malware payload", "value": "1f8d435cb57be2daf262361404a12b8d44bd1aef", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642756985, "uuid": "1dd80696-bcca-4b14-ab17-6744dfe515f7", "comment": "Malware payload", "value": "6297f90517cdf892f6b71a850fc43e221a5f3a754a3e953925c084739af110529c95f52b77b3462f445abfab8554947d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642756985, "uuid": "bcc00e30-110e-4b79-a0ca-f3f81b089df8", "value": "T1C181B85F7A22806FE0005E71FE1E9E294026DD27FD06690BB58D721F953D3904D6E549", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642756985, "uuid": "e9addeeb-693c-4941-87f9-5787606300c6", "value": "48:rBO8IK3tOknVsiDIQXNIRqO8i2vQ6Yk2rNzGjU:NO3KdOkd9OaQvk2rN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642756985, "uuid": "4daf358e-2bb1-4bc8-bba2-e52465453dbd", "value": 4096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642756985, "uuid": "39336008-7680-489f-961c-4f00bbc0673b", "value": "application/CDFV2", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642756985, "uuid": "7f1b7896-ed0a-473d-a407-7a9dcf807ce5", "value": "SecuriteInfo.com.Exploit.CVE-2018-0798.4.31091.7327", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "823c106a-7a86-11ec-9275-42010a9c0029", "comment": "Malware payload (Gozi)", "timestamp": 1642747867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642747867, "uuid": "1348127a-7992-4591-ba1f-a4a52d951329", "comment": "Malware payload (Gozi)", "value": "3b4e9e88c0dd6e82ecc65e2d219544c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "italy", "colour": "#161A3D", "exportable": true, "hide_tag": false }, { "name": "pw vodafone", "colour": "#096C78", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "vodafone", "colour": "#8E01DC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642747867, "uuid": "88fd9537-03f4-4769-816d-47bd47a05c14", "comment": "Malware payload (Gozi)", "value": "4d4bedbc795e2dd4fe929b6dc57bfc314165795e25c362959fbabc59c0a60d80", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "italy", "colour": "#161A3D", "exportable": true, "hide_tag": false }, { "name": "pw vodafone", "colour": "#096C78", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "vodafone", "colour": "#8E01DC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642747867, "uuid": "794c40a6-7692-48b8-b4c8-394e0b8d0bf0", "comment": "Malware payload (Gozi)", "value": "5d4f4d60773ed452188c8a099b5972edbbb03f90", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "italy", "colour": "#161A3D", "exportable": true, "hide_tag": false }, { "name": "pw vodafone", "colour": "#096C78", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "vodafone", "colour": "#8E01DC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642747867, "uuid": "2c541e75-a468-4509-9cac-16395d66601b", "comment": "Malware payload (Gozi)", "value": "2f1fa54a0256469b97600a327748b546d9f54f04ba743c6d52c776f2f6e76076d8f739f0687cd792d8cb915de5a82c77", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "italy", "colour": "#161A3D", "exportable": true, "hide_tag": false }, { "name": "pw vodafone", "colour": "#096C78", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "vodafone", "colour": "#8E01DC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642747867, "uuid": "3d4339b8-67e3-43d9-9ef5-ceda26924cf9", "value": "T1A894D06787FC2C48F2F3AF75B8B1A2538E66BC366D61C05E4684150E88B1E25DD78723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642747867, "uuid": "1e936cc6-c93d-45e0-b56f-54e6e1c89b79", "value": "406900a52ebbaff2418df7f831674972", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642747867, "uuid": "08518b37-fea8-419d-a251-dcdcbab3dc25", "value": "12288:YudQDXhMYGldQDXhMYGldQDXhMYGAGj7:YKyXhPSyXhPSyXhP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642747867, "uuid": "c4ed2131-8978-4851-b8e1-7714493b6798", "value": 442368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642747867, "uuid": "1c768f94-810e-4ce2-a525-65847d52d2e7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642747867, "uuid": "96e873c1-4d53-4a83-a1f9-e30bcd4db367", "value": "Wartless_v8.8.9.0.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c8aa276-7a91-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1642752501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642752501, "uuid": "19c97ea9-69fd-4803-b968-194b213bf4ee", "comment": "Malware payload (AgentTesla)", "value": "b5b538aa1648c32d03b5e445ca78fc89", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642752501, "uuid": "20c14e1e-c44a-431b-ac78-1cf7ff942fdd", "comment": "Malware payload (AgentTesla)", "value": "4d4d5739a6da66c87152d4bbbeedd36889f966a3f8279193766ff40be2628027", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642752501, "uuid": "3a474771-ffa3-41eb-95b5-fa8360508540", "comment": "Malware payload (AgentTesla)", "value": "8a28eb2f7b5e5e94f2621c134072d3f88f21a28a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642752501, "uuid": "01613727-84d9-4687-842a-6d72f6489bb1", "comment": "Malware payload (AgentTesla)", "value": "518ccb54fa69ceae72137ccdc5c59c95766077594764e2651612272480f2104c7cd4318a4b83fe2ce2794ce43f874dc6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642752501, "uuid": "cb441782-031e-4e4d-9cde-b3680a9953f2", "value": "T1B515CF687B40B1DFC90BCE758A686C60E720B4AB570BD65790571AEDDA0C7DBCF102B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642752501, "uuid": "aca84541-d5d2-494b-8096-328a6a8d3a98", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642752501, "uuid": "5eff1325-2961-4798-b1f9-bb03fb624cf1", "value": "12288:mgSGPsxlsftiiiE9WfXGd333YTW0qRdkrWq6w0fi4jUCmrO2QXuARRwQlnq7070P:npUxrfXk333YVqY78N7x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642752501, "uuid": "6a62f2af-0f1d-4446-8476-fceca991f39a", "value": 960000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642752501, "uuid": "884a7e0c-4e20-4db3-9539-7eb8e189cd8d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642752501, "uuid": "fed839d0-39d7-4dca-8ec1-12837bf646e3", "value": "Inquiry - RFQ HMG U66 sw5558.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d72da5a-7a8d-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642750731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642750731, "uuid": "dd0a8a79-f7ae-4e66-96b5-6c6a1f91f5c2", "comment": "Malware payload", "value": "6c5d4eb77d5305e8cce44171a34a400f", "object_relation": "md5", "Tag": [ { "name": "log4j", "colour": "#B82EEC", "exportable": true, "hide_tag": false }, { "name": "perl", "colour": "#DF45C7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642750731, "uuid": "35f8900c-0b66-40f5-897c-38cc9f74192e", "comment": "Malware payload", "value": "4e8a817738abb78d92879b390fcfa937cfcb7a25cdcb51e644464f24b11e3390", "object_relation": "sha256", "Tag": [ { "name": "log4j", "colour": "#B82EEC", "exportable": true, "hide_tag": false }, { "name": "perl", "colour": "#DF45C7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642750731, "uuid": "6936a14d-9cde-427f-83de-408a738a6917", "comment": "Malware payload", "value": "bb8c62710488d848088d6adff9226e5cb09a7d03", "object_relation": "sha1", "Tag": [ { "name": "log4j", "colour": "#B82EEC", "exportable": true, "hide_tag": false }, { "name": "perl", "colour": "#DF45C7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642750731, "uuid": "57ebf783-a377-43f2-9569-5b148766a856", "comment": "Malware payload", "value": "83d3484152e8c531aaadae2d92732f732f93b8a92f9c318448989a827a2850d5eaf989bf5413afe6143177169561c6e5", "object_relation": "sha3-384", "Tag": [ { "name": "log4j", "colour": "#B82EEC", "exportable": true, "hide_tag": false }, { "name": "perl", "colour": "#DF45C7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642750731, "uuid": "6b49f63b-1bdd-4093-81dd-eee4bf94fcc3", "value": "T130C2844919E34952A3B7F0761BDED4187A5BC1974B0DDE207DAC42DABF90039D2F8AC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642750731, "uuid": "40a7293c-6314-423a-95d2-88138a63c270", "value": "384:NsAAHe4XDp2fv6Mf8JSN6WWabfd43+yZzB3lJ:NsAke4XDp2fv5f8J7WWARy1B3D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642750731, "uuid": "f89d2ad4-712f-465f-b65b-e4e021a18124", "value": 27982, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642750731, "uuid": "5d787d59-e821-4412-9465-b0290552f2c8", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642750731, "uuid": "ea2d0165-beac-4217-b765-7f510817270d", "value": "sal", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65a51783-7aea-11ec-9275-42010a9c0029", "comment": "Malware payload (CoinMiner)", "timestamp": 1642790768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642790768, "uuid": "a366dd5f-e0ef-4ddf-9647-abd24939da10", "comment": "Malware payload (CoinMiner)", "value": "2a628875bc4af3da9d92a6e7720c16a8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642790768, "uuid": "70c19181-3ee3-49cd-910e-e8755f3daf34", "comment": "Malware payload (CoinMiner)", "value": "4ed1d3fdded148140258ad401ec1ff099bdcf3e3270d7deaba4a63b762e3e863", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642790768, "uuid": "1e257259-c74f-4fa8-83b3-721fcf969da3", "comment": "Malware payload (CoinMiner)", "value": "f49c3ef8569ab88e7da31b3eea630346e0cf2be3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642790768, "uuid": "3bcf5619-1871-4d4a-9bb6-65032b30c9db", "comment": "Malware payload (CoinMiner)", "value": "b6a54b8bfb16f073169c6d48c85e038ec4e6ec98581fef197fb6d2270d5e3d15c25c2b02dbcd7b6033491d23c65c16fe", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642790768, "uuid": "d5fd4de3-c6ce-4921-ae34-43e55e7b0636", "value": "T174F533C0224A2711D91520320991272E9475B3886F3C948B35ADE7FBEF9AEE77B1D13D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642790768, "uuid": "5f5ac875-474f-4b27-85ab-212c1aff6b46", "value": "c284fa365c4442728ac859c0f9ed4dc5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642790768, "uuid": "28dd12d0-3201-4858-8402-6b9d225d8e26", "value": "98304:DYyG3EYd06Ezb5YMVuM5bH11t7/z6H2DwvJ7wNCx:90EGA+M5bV/6H+wZQg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642790768, "uuid": "20998589-40cb-4d86-a964-7b681c4ea906", "value": 3621680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642790768, "uuid": "99764ebb-d364-49d5-a988-8147c801a6dc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642790768, "uuid": "22f95d80-cbe6-4b0a-bd10-58183e7c872d", "value": "2a628875bc4af3da9d92a6e7720c16a8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69013e16-7aad-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642764575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642764575, "uuid": "e7cb6af2-fa7d-4139-8dc6-70376326d6a7", "comment": "Malware payload (Heodo)", "value": "516309f9bfd964533f0ba6bfca748f1c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642764575, "uuid": "09e0fa88-0838-4a8b-8f8b-dbc031003bcb", "comment": "Malware payload (Heodo)", "value": "4efb60a79f6e3af3650d87cc5f8139542b436e35a9c654717baad60441559972", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642764575, "uuid": "550b5422-462a-40c7-b2fc-2356d442666d", "comment": "Malware payload (Heodo)", "value": "be192bb5bcf03c286a54292f299bec94dad393ab", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642764575, "uuid": "fd00d6ee-4612-4898-963f-2118dcdaf8f1", "comment": "Malware payload (Heodo)", "value": "7f04377f1d3216a84e4c8407ca844858983bf9500f0e65c39f4deae954ff6fb5a358df4cf1426193f76e42c4d950ba61", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642764575, "uuid": "db93edf7-a693-4617-9d5f-1886788e8d0a", "value": "T13DD4BF11B2D2C07AC1AF1674596393A463F9BE90DAF9C257FFC06A4F1E315828B39712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642764575, "uuid": "6b7ab7ba-a101-4f16-9ec4-e3c49997cea6", "value": "24b46ffcf60dc8d39e8124f411ebd08e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642764575, "uuid": "26f91b4f-84d0-4442-98c4-b0b600872c36", "value": "12288:kqdJaxkOWFornPmGZqnTFWbD2UYVubhesslBvQqEPO7:kOOsornPTwFWbPYVohevBoi7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642764575, "uuid": "026e9ec7-6de4-42af-a84c-d97d2c7c1d59", "value": 626688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642764575, "uuid": "808ab205-c358-438e-aefd-0c6997e452c2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642764575, "uuid": "d4eba763-c15d-4b2c-b881-0e9d0730d187", "value": "emotet_exe_e4_4efb60a79f6e3af3650d87cc5f8139542b436e35a9c654717baad60441559972_2022-01-21__112930.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35730828-7ac5-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1642774796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642774796, "uuid": "bc469a3a-7d00-4b4d-8347-fc6e816e5703", "comment": "Malware payload (AgentTesla)", "value": "e349712c44a20f65a6d99f051e21539f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642774796, "uuid": "3638bc69-ceb4-4dff-ba65-06c605a7c782", "comment": "Malware payload (AgentTesla)", "value": "4f0de4873b95294a8b732c2a8d4851518a4c1d97d3ab79afac39c3d095ec21b5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642774796, "uuid": "fa72e10f-2492-4690-b4a3-64239220c14a", "comment": "Malware payload (AgentTesla)", "value": "6005533d5f08d79513e08d46254d30c1c40df676", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642774796, "uuid": "6ed16ca8-021e-4e9b-b5ca-bdcc7aa8478e", "comment": "Malware payload (AgentTesla)", "value": "78065b3759f7d6356f48209fed579ec4863ffafc4add043c655d9818ee0eeefba31d387e4fd4cd3b292578ce64ce2763", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642774796, "uuid": "b31f937b-3f2a-43ac-97ce-e863e1a58c7f", "value": "T19BA423368A538FD5D311D6B4B057E4A65F1F5DAA80CF2093CB08CB49B855E6FCA88F84", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642774796, "uuid": "56f579fa-061b-434a-9e43-c1b6ed5bec83", "value": "12288:tysFBy5trnaoRzWQ7Rdbyx6aubTrvzvhejBn/RPBqN0:k/rfRb7R2m3vlKFdG0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642774796, "uuid": "1de569d8-4e09-4020-a196-cf9d022314b4", "value": 489856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642774796, "uuid": "d8f68dab-1cff-4728-b1fa-1703b67136ad", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642774796, "uuid": "d6d195a8-c330-40bb-bbc4-2519075abc00", "value": "BOQ_pdf.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b945924-7a9e-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642758136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642758136, "uuid": "eb29e6fa-1c80-49b9-aa89-4e38018bfff0", "comment": "Malware payload", "value": "8a3d0cdf030779585ff1b396b7bde2c0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642758136, "uuid": "d356996a-0431-43ca-bd3f-856da9a03178", "comment": "Malware payload", "value": "4f783c2b9a094ec0133f2586acf0c0cc47ffc59b5709d8009268f70c1dd66546", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642758136, "uuid": "29d435b9-bdee-4719-94ac-fbe1bfd6b2a2", "comment": "Malware payload", "value": "5806f20fae7b1f94c58e0c15259fad602b2511c3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642758136, "uuid": "4043eeb2-a57d-4000-a36f-86c6df1fcf1a", "comment": "Malware payload", "value": "ff185baa3e474f9a8a2a7a313121d8b7ebfdb7ac34a8da76118589ee3818d63e3bcf365be94285ffcd91d3efa48f0f6f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642758136, "uuid": "0ee1630b-741c-4119-86b1-402ffb5ef017", "value": "T18A837D21B2C0D073E052013465B5C7B28A7DB9327A7A91C7FB9D067DAFB12C19A2935B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642758136, "uuid": "e48725d3-0532-4c0d-9602-3e50431b8a2c", "value": "f6b0f709f919a732206a3c71016c58b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642758136, "uuid": "fc113c04-adbe-46c3-aaee-da8b2b89d9d9", "value": "1536:dUEX3tABgvf/23ieV1243eDCliYvrZUBNnGDteKKIzppEyfSg7Lkxf6mx:dXb/6R0knli8ZmNnGDnz3fs6m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642758136, "uuid": "f61850d9-ef15-4dfe-868a-e92fcbd0f7cf", "value": 88576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642758136, "uuid": "cce3fa0d-f9d2-4e6e-8df4-c906b64ca125", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642758136, "uuid": "147682d8-8fb6-439b-a29f-439695f09c08", "value": "F3ath3r.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4ac8c68-7aa6-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1642761776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642761776, "uuid": "ee07bc26-359c-4e14-98eb-7a21ab681b30", "comment": "Malware payload (SnakeKeylogger)", "value": "969f6afd136e4d4531035d04efe1dc19", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642761776, "uuid": "688b9bb4-3a40-416e-891c-a9b7ba55f1d8", "comment": "Malware payload (SnakeKeylogger)", "value": "4f932ea60ac54baa3d8a26705d2ba0013b6728576055457e301ffe96efd082c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642761776, "uuid": "872b82f3-af30-4ccb-8468-60ea4aef582b", "comment": "Malware payload (SnakeKeylogger)", "value": "8d585c8b41b505666af24b9db4cc631f16640984", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642761776, "uuid": "036d99a7-3aa6-41dc-965c-791871de5a98", "comment": "Malware payload (SnakeKeylogger)", "value": "9455eb801390e7220dc7a5faacc292d5aceb68470f99bd490eb2a7fa146680473e95708c282c1b573aae84286e59598f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642761776, "uuid": "280ae0f0-1926-4f86-8437-d59b86e5d2e0", "value": "T1DFE401317FD21B14C74E87B85D7C6C3083B8B9866858C72F4A8ABDE91328BD55761B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642761776, "uuid": "645d22fb-0b57-47c1-ba7a-3c956aeb9f78", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642761776, "uuid": "ff0fbede-8b0a-4094-9249-9b6c865bbc16", "value": "12288:kiiiiE9WfXGd3334C30o1nX46+yw0unREk38:kxfXk3334C3t1XO0unT38", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642761776, "uuid": "41dcf508-af43-47b7-937b-b4ccf2623d26", "value": 716288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642761776, "uuid": "1a66c611-5735-4626-85ec-4dee5075c629", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642761776, "uuid": "4432f0b2-b4d2-41d7-a54b-c91e0cb8e60a", "value": "PL FT220122L.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a629c23-7acf-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642779019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642779019, "uuid": "2d32fcd9-6ac1-4212-944d-47a9e1612b55", "comment": "Malware payload (Heodo)", "value": "84a9c882d46cb02d2a35e0d573d6bbce", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642779019, "uuid": "08c9a85a-2144-430b-b1c6-6ba5dd35a40f", "comment": "Malware payload (Heodo)", "value": "4fae4157bb174962906487d08f4562ab7f7aa8f89b4ed7d3795efb1460a744ca", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642779019, "uuid": "9f6b88ed-8c2f-4109-9c7b-0336f7ef4a80", "comment": "Malware payload (Heodo)", "value": "68567bcc6f8f8a487b3680e2ea5e43c5d26ba9ce", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642779019, "uuid": "25b1e78a-67c1-479e-b036-b83ffcfd8fb9", "comment": "Malware payload (Heodo)", "value": "77a4e3f5e5538c64d6c8e9b1c6f9b04a5366bf8995f30e8e5df5b303ba17d012ed82d1f30cf1cd7215e8574c924c39a6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642779019, "uuid": "18d793d2-ec8c-4eb9-bde1-c7a943ad55f0", "value": "T1D1D4BF11B2D2C07AC1AF1674596393A463F9BE90DAF9C257FFC06A4F1E315828B39712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642779019, "uuid": "911f0822-ba12-47a1-b4d9-baf6d1f7a864", "value": "24b46ffcf60dc8d39e8124f411ebd08e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642779019, "uuid": "60ea651d-c8c1-4253-9ce8-0cc69ad9e104", "value": "12288:kqdJaxkOWFornPmGZqnTFWbD0UYVubhesslBvQqEPO7:kOOsornPTwFWbpYVohevBoi7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642779019, "uuid": "9f0e5b7e-3421-44eb-ba1e-70ca95515c69", "value": 626688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642779019, "uuid": "703732f1-b835-4c6a-b736-18f0ffb6fb93", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642779019, "uuid": "5a19d046-aebf-48b9-b118-b5cfae317aeb", "value": "84a9c882d46cb02d2a35e0d573d6bbce", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e130965e-7a67-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642734711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642734711, "uuid": "b16f1bbb-720d-4eb4-b85a-2ff789ea9515", "comment": "Malware payload", "value": "e5cebfe077cb3d81b861d1da482848d3", "object_relation": "md5", "Tag": [ { "name": "fraud", "colour": "#F52547", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "scam", "colour": "#AE17DD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642734711, "uuid": "620d38ac-9b20-425f-b95b-a88374c29302", "comment": "Malware payload", "value": "4ff741a791c5745b455b82371bb73d889def2d51fa04b977a5d1376a3bdd6208", "object_relation": "sha256", "Tag": [ { "name": "fraud", "colour": "#F52547", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "scam", "colour": "#AE17DD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642734711, "uuid": "7caa59a9-77d7-4ff6-a680-2d047e318e10", "comment": "Malware payload", "value": "9335780419b6dd8db53fcb29948beff3c26478fd", "object_relation": "sha1", "Tag": [ { "name": "fraud", "colour": "#F52547", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "scam", "colour": "#AE17DD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642734711, "uuid": "4e1d852f-2994-4430-9c83-5f9afb0d088c", "comment": "Malware payload", "value": "22be89dd461c907982a3b79ceecfc6fa1102e978c97d8bee5477f93766655ddfa09ac166a4f38d7e568a324e650fb6e2", "object_relation": "sha3-384", "Tag": [ { "name": "fraud", "colour": "#F52547", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false }, { "name": "scam", "colour": "#AE17DD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642734711, "uuid": "75f94b2d-ef4e-4892-a778-2df9b2390dfa", "value": "T1EF84026A4A58979CA402C7D0FF032E5D7F0F629D38C850AD5C5669DB8C10F18A8BF68F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642734711, "uuid": "ef91dcd1-565a-429e-a94c-f755f5f61b6b", "value": "6144:BwoDtykAZrPIIbg6Nqf8MzQQhuj05ICtIDUV+QZUd52mXQDRd6aj9brx2IjrcvtG:BAPrPXbv9MNhujrCiIhUfQNd6apbo0l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642734711, "uuid": "aebc894c-4da0-4ed4-8414-c7717625e35b", "value": 407158, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642734711, "uuid": "469e7da5-e500-4c81-aac7-d08d8fa18858", "value": "application/pdf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642734711, "uuid": "75d370b8-3521-422a-bf7e-79321bc956d5", "value": "CONVOCAZIONE N\u00b00901199023521072021.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad1f8195-7a62-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1642732477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642732477, "uuid": "e6a362eb-91db-4bed-8d09-923ce803bd83", "comment": "Malware payload (Formbook)", "value": "014943ef94289a9d1b9c711a9ee1bf91", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642732477, "uuid": "a4f02d1c-df59-4b37-a415-fea69c0f68ef", "comment": "Malware payload (Formbook)", "value": "502303edd5a9de57b3667146e84f15fc4957242ca2ef8f75f5e503946c452ee2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642732477, "uuid": "046f980b-e5d0-43a1-a853-56303da20046", "comment": "Malware payload (Formbook)", "value": "92f96c08bc514b4087fee5e362e5b67223fb2fce", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642732477, "uuid": "7bfe239d-9332-40e5-848e-9755dd90a9ee", "comment": "Malware payload (Formbook)", "value": "5d9108108e6e169427c917e2d7ee968bd4badf168fb76890ff8d27922fdc4bb0c1df31cacdbf58045fe3f33303a04641", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642732477, "uuid": "7dd484ff-32d6-4013-a132-30c904b078b8", "value": "T10C6423AA76C284D3DF15153634B6DEB5D3F7D00A0214756F63A02EF03E288C57B5AB8A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642732477, "uuid": "cc66ab76-1f87-4b99-8e59-f7513c17c459", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642732477, "uuid": "d38395bc-d6f4-42ca-a4d2-2d98e0b7d165", "value": "6144:owf0RjsfKGaMF0ffEQpu2cg1LPuJnOfWZb3qNYzg++:4LGkJuJkLPuYEaGzY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642732477, "uuid": "37b81414-253e-4d49-9ba9-157eaf223d1f", "value": 333426, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642732477, "uuid": "b784b380-2a06-4e7e-ae0e-b0d50c96ccb6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642732477, "uuid": "a2ca0835-2b8a-44d1-b3fe-7c3904b74b93", "value": "014943ef94289a9d1b9c711a9ee1bf91", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d48c7826-7ac5-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1642775063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775063, "uuid": "833943a9-12aa-4a23-bb00-c49195c20afa", "comment": "Malware payload (Formbook)", "value": "c8df5e6047cd338743e32c7e79067a45", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775063, "uuid": "8d4ddf67-65de-4839-856a-e1286d949e1d", "comment": "Malware payload (Formbook)", "value": "5111f4fa05b89a9d727c4686485acedc16553a7715fd36776c68972acf8e5382", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775063, "uuid": "29d479fa-b915-41d3-9aa9-a9014e497273", "comment": "Malware payload (Formbook)", "value": "848cdb2e9b7415ca7689b74ffd076fb92a8637a4", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775063, "uuid": "d0ccd5e6-696f-4dfc-b460-50a215b2eff6", "comment": "Malware payload (Formbook)", "value": "19acc7252b7353cd9b9b35c7f58952d656909843e7603d6df72930aecb1cc3983d17b939d0717a6e6d026cba358cba44", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775063, "uuid": "3a3434f2-29b3-435e-80e5-e134c7d4bd17", "value": "T14F64120F22E4CCF5CA256A704C3FD779EEF46A510791161363A80E3F66B32D61A1B0D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775063, "uuid": "db950a87-811c-40c3-8304-fa0a5c675f44", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775063, "uuid": "28bd7c7e-e642-4beb-8bfc-88d1c9a633ed", "value": "6144:owP+u6fNm3qOw79L8xo0YpbxQdqCL24ON9Uu+weOBVKeAYazi/rMcBiccMezviD+:bnEx8xeptQdqC7oOKeOBVzIETB7cMaUW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642775063, "uuid": "6e489a55-a8a6-4aab-9f52-1823f87c9871", "value": 334556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642775063, "uuid": "35528836-579c-4c10-b1e4-44811ad330c9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775063, "uuid": "76b5b3a8-b763-4295-9d6a-35270c01a3be", "value": "DHL_AWB# 9678547836.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73b1084a-7a4e-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642723790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642723790, "uuid": "51b5bea3-1fa5-4e62-b5e4-12b141e900f5", "comment": "Malware payload (Heodo)", "value": "84ae4f1030003b91bc1261ef94df6549", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642723790, "uuid": "84d34faf-8506-4e99-868a-10b2d99e435f", "comment": "Malware payload (Heodo)", "value": "51596f5eef3075f3c83656f6e331a92d99881e201fb8ffd04496dbb72b092d05", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642723790, "uuid": "28fff4ef-7261-4aaa-9756-63007d9927b3", "comment": "Malware payload (Heodo)", "value": "29ef2b47fe4855f172882a292c0e786b9955ea3f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642723790, "uuid": "278668d0-6a31-4240-80bd-cc690962a1f5", "comment": "Malware payload (Heodo)", "value": "d498eb92560998882a1ce840b34078a20070dd8dc697d1b85782ec832e26c7ed21920ca10dad6b3b6301e909fff33a6f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642723790, "uuid": "80f009a6-954c-4e68-8231-faec1680cf09", "value": "T1BDD4BF02B2D1C036C5AF11B08E76AB08A2EDFE905B7985DBD7847D5F1E31BC26635B06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642723790, "uuid": "33e0fcc9-af39-4187-88bc-f5d0d75780f0", "value": "42bfc936e90bcc6f5b01541917ef37a4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642723790, "uuid": "80071b4c-af2f-464d-ba4d-dafe66b5070b", "value": "12288:Td0saabmsb61ZuV3ZGuyfEgXkvPLEbsWrxD8iP29pi9NhG1DjsgqXXvhhcwEPwqh:68mi61ZuRZGuyfEgXkvPLEbsODYDLVnm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642723790, "uuid": "b456a155-f7f7-4bc4-a08b-5b35a3e312eb", "value": 638976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642723790, "uuid": "4902b10c-5896-4d49-a1e7-54a786aae5b2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642723790, "uuid": "6fcb4abe-11fe-4bb2-9c6d-e9c721ae1b7f", "value": "emotet_exe_e4_51596f5eef3075f3c83656f6e331a92d99881e201fb8ffd04496dbb72b092d05_2022-01-21__000944.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "977da0cd-7aac-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642764223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642764223, "uuid": "74d797aa-4325-425a-a86b-b400ab094279", "comment": "Malware payload", "value": "0442a8479aa5f19dd5a64ddfd677b9f8", "object_relation": "md5", "Tag": [ { "name": "193-201-9-212", "colour": "#5EC393", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642764223, "uuid": "190d0b05-aabc-4464-bc6c-c98104d2fb81", "comment": "Malware payload", "value": "5161a16217b9d8b9817ad1f6e1020e2eb625bbd6ccf82fbf9423077d0c966aa0", "object_relation": "sha256", "Tag": [ { "name": "193-201-9-212", "colour": "#5EC393", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642764223, "uuid": "85f99757-42e1-417c-9cbc-3b0ae0ad1a66", "comment": "Malware payload", "value": "fa003104e8e8e6646049a49bd517224ba34ac4b6", "object_relation": "sha1", "Tag": [ { "name": "193-201-9-212", "colour": "#5EC393", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642764223, "uuid": "a66d8d6b-c906-49d1-b06f-eba212f33742", "comment": "Malware payload", "value": "78502ad31d1f3496ccb8b6e922b7be94d8a755d32e1582fdff0195030b9169f39a67ca9c88f8d21d0c210e7b888c3219", "object_relation": "sha3-384", "Tag": [ { "name": "193-201-9-212", "colour": "#5EC393", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642764223, "uuid": "a0b9923d-6524-4e2d-b258-f0cc318045a0", "value": "T10AF4C012F3D680B6D99338B1197BE32BEB3575194327C4C7A7E02E729F211509B3A761", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642764223, "uuid": "35ecd574-8fb1-4957-a50a-0069252a363f", "value": "aaaa8913c89c8aa4a5d93f06853894da", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642764223, "uuid": "a3b5e20b-0bb1-4943-989f-6b0d72dafa8e", "value": "12288:CaWzgMg7v3qnCiPErQohh0F4uCJ8lnyFQp9QudhzYOeoNTdVmoCihEa:taHMv6CrrjSnyFQc+eoBdVmoCeR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642764223, "uuid": "feaaab90-a8a8-4434-ae92-6a01bc8806b9", "value": 794544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642764223, "uuid": "81a7e313-e6e9-4bdc-9ad4-8da4165907f3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642764223, "uuid": "5fac33e5-78df-4970-b9b1-d8edd5f15772", "value": "DefenderControl.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3acfabd6-7aa4-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642760632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642760632, "uuid": "4c43be16-ef35-4a9a-928c-5cc2219eb4dd", "comment": "Malware payload (Heodo)", "value": "b2053c3d3aba4bb7bda1086ef7fc0218", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642760632, "uuid": "91e5af3b-2094-42fe-bba6-061b2d8c57f1", "comment": "Malware payload (Heodo)", "value": "530b184e57d1213fad1245d12dd2ab28b36bfe713ccfe33c71d029b9194cb5f7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642760632, "uuid": "eb2d91f0-51bc-4cc2-8cf6-14aaaa5bf9c1", "comment": "Malware payload (Heodo)", "value": "49d4a6f53a529d282b7ff16d2909beafcea93e8f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642760632, "uuid": "24335a91-9c89-452e-a2eb-11a4d79218f9", "comment": "Malware payload (Heodo)", "value": "ca91eeb37abbe44cde4ff8a823a10fc2256826bf42fe2e51e813be3818a7221eadb8b705f807091c36563b5e9cf96f0d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642760632, "uuid": "30bdb567-d8b1-4374-84aa-3cd2ff0b4ad5", "value": "T1A9D4C002B291C035D5BF11B44E666B18A2EDFE905B3985C7D3C87A5F2F31BC2A635B06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642760632, "uuid": "18546c70-4e87-48d1-87bc-b02d678d2725", "value": "42bfc936e90bcc6f5b01541917ef37a4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642760632, "uuid": "f1e31c4b-73f6-4edd-b898-55476d852be3", "value": "12288:hF8kySLmsbWV5WlvAuyfEgXkvPLEbs2gu1D0iv+9Ne1DGBkkQxCej+6IvUDEPwqh:wMmiWV5W5AuyfEgXkvPLEbsGDIfVLQxQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642760632, "uuid": "31e260a2-fb36-4022-8eb8-240e11599551", "value": 651264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642760632, "uuid": "84cbf18e-2ade-46f0-ad0b-d6c74d49ab51", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642760632, "uuid": "6286a076-7f58-43ae-b03d-31d43a274f0b", "value": "b2053c3d3aba4bb7bda1086ef7fc0218", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3bc7a57-7a93-11ec-9275-42010a9c0029", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1642753587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642753587, "uuid": "396a4fca-d198-4e3a-976a-d977ad612794", "comment": "Malware payload (RaccoonStealer)", "value": "280bc5e2f1429cd8678fa1b40ff28dac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642753587, "uuid": "e32d3b9a-5719-4447-83c3-4cd303e9cb15", "comment": "Malware payload (RaccoonStealer)", "value": "534f075ea4fec6ff94b5f6b00bbb8d47fb4f061a57d99be498d07800cba6cc9b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642753587, "uuid": "034d506e-ef76-4965-bb30-05d656ad3e69", "comment": "Malware payload (RaccoonStealer)", "value": "3ba183f405ce42bc63dce87686c425c90f4d8351", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642753587, "uuid": "7b6c6e89-3888-47b8-954e-3ee876b44e59", "comment": "Malware payload (RaccoonStealer)", "value": "be17790cdd3c7128fe9768fc9035153eaed5e20adb87ef723028e635c117eb4e1bc24580537279e47c79713c4d4c06d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642753587, "uuid": "195b2a58-d3e3-4b14-9f27-b2fadeb9d0c5", "value": "T1B2647C10B7A0D435F5B712F44A7A937CA53E7AA2572490CB92D52AED9B397E0DC3030B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642753587, "uuid": "9ceae6a0-abbb-4933-baaa-cdf39a20a06a", "value": "74049dfb008e04dc801074b384a97733", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642753587, "uuid": "bb68712f-2389-4eee-a287-b1f37f8fcbd4", "value": "6144:uPkyrVDj+tCGfhwJUr3lu3I9WL9mQ4k5ofYdyvmE:uPjVWtZ8UrVu3II9wk5c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642753587, "uuid": "dd615323-b24d-4175-951a-b66f03cc7b96", "value": 336384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642753587, "uuid": "a5540221-d025-4d19-ae3f-db87a79da69b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642753587, "uuid": "01df22d6-b611-41f4-8476-ae544e54e2d3", "value": "280bc5e2f1429cd8678fa1b40ff28dac.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55cfe054-7aa3-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1642760247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642760247, "uuid": "1a02f428-7e81-4d36-8da4-6520636c58be", "comment": "Malware payload (AgentTesla)", "value": "02593a51827f8d839f9374b9c6512289", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642760247, "uuid": "a4df05f9-bfd4-4829-89cd-057be1d7eeec", "comment": "Malware payload (AgentTesla)", "value": "53870aefd3a2ecf727142d294e55b106a70eba55996cb1ec50963e0bc49bfb09", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642760247, "uuid": "7fe8de92-bd56-4097-8d56-61d8884bc13c", "comment": "Malware payload (AgentTesla)", "value": "b5cede71f11151c67f3c975e2e60e78843ad995d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642760247, "uuid": "cf7f845c-8a4b-46b4-ab4d-341f2fb0f733", "comment": "Malware payload (AgentTesla)", "value": "c49635d76c7467c2ef2e4bdbe7e574ec39e5f4383b487963c12d1c2d7aac1a1c683d075e0e504b935d5449ed6315fe43", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642760247, "uuid": "3bfaa75b-be35-4375-90c0-ccfac579103d", "value": "T14AE4D05032F88B05C47FCBF6583500A017BEB91AA865E35F6DD2B1DF0972F819A26763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642760247, "uuid": "6f4b3cfe-dd25-4a33-9f63-f7490dac00de", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642760247, "uuid": "8325bfbc-1dc0-4abe-8d9c-12105c5cb61b", "value": "12288:7kGaCpQv4v/5tBR+YDifIh58fTzsVIgbARPmKz+DP6UQ0q6+ievYF:7pQv4v/TofIh6kbbeyDP6UQ/6+ievYF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642760247, "uuid": "3f39fd53-a2fc-4ad7-adf0-12b9c517b767", "value": 720896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642760247, "uuid": "a5088009-e194-4cdc-9997-4d3043234d60", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642760247, "uuid": "f2fa398d-20ee-479e-a9ad-c8ea18031a20", "value": "BL. NO. AWSMUNDAR360621.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3ad0edf-7ae2-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1642787490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642787490, "uuid": "ba04a6f1-251b-4356-b506-fb3ae6087fe8", "comment": "Malware payload (SilentBuilder)", "value": "26e87c6843f7d109e5e5d768c0a09d55", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642787490, "uuid": "55bd5f86-7303-4af3-a132-379ce889fa36", "comment": "Malware payload (SilentBuilder)", "value": "53a939650061ccc85824d5ed9366ca31ee21a9967e587ff208486842d994542d", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642787490, "uuid": "8ca48df4-1884-46df-9cf9-f37a270b5ed9", "comment": "Malware payload (SilentBuilder)", "value": "b9af26acbd23d58f930f67a1fb5c1084c49591b3", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642787490, "uuid": "128a9cc5-dc5e-4889-a538-a24bf995e6f2", "comment": "Malware payload (SilentBuilder)", "value": "86b6187b35336da815c2abcf9e46900ea67436c218752093f9593e12c087caa835c36d5e375656c02692f902dd4ecef1", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642787490, "uuid": "f85eedce-7829-4077-a8fc-9231d32c56e9", "value": "T149A3B0527BC6CA59EA4547710DBB024AA723FC105B7A63473285F3783FB89E08D13A1B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642787490, "uuid": "72bbe00f-5074-4b8e-9441-e36bbc20852b", "value": "3072:n/k3hbdlylKsgqopeJBWhZFGkE+cL2NdAFxe53lGvFTQ3IzxgdrvxpU0OKvMB:/k3hbdlylKsgqopeJBWhZFVE+W2NdAOK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642787490, "uuid": "11cb8e0d-dab4-4f3a-ab06-a66bc8451654", "value": 104086, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642787490, "uuid": "7b2ccbcd-fa53-41ce-8066-6d218ad70136", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642787490, "uuid": "d8439619-addd-4601-b6e4-adddcd93652e", "value": "copy payment.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "743d9ade-7a5c-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642729804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642729804, "uuid": "57a620f8-7085-4486-901d-50900d56a36b", "comment": "Malware payload (Mirai)", "value": "01bfafdc4ccf2e419117efa4eed652b7", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642729804, "uuid": "2638d302-13db-4f6f-ad45-928d159f5ff9", "comment": "Malware payload (Mirai)", "value": "53bb2803181ba0e1b940dbda9ff6a3cc3d718370dfc4caea47e61d194fc27165", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642729804, "uuid": "99aabe5d-2f56-4365-a665-ff7ce3ec79f2", "comment": "Malware payload (Mirai)", "value": "0081042770e96c556ea6bc456a420270a9a08777", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642729804, "uuid": "c322ecee-ed32-4d8b-a47b-2e7b743fe0de", "comment": "Malware payload (Mirai)", "value": "5b1cb7b29ea398b9b51a58bd127bf8b0208c8bf59be483ec2f3667c1d9e0d50d7b82214f6d800a52da68e96b9f2ec69b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642729804, "uuid": "fc91bf28-8eba-489b-a2de-352b2dec50c5", "value": "T162232AC47683E8F9EC15057C307BE7729FB7F43AA03AEDABD79895239841601960729C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642729804, "uuid": "99b2a9e1-fbb4-4852-a51e-d9af0eb46f7c", "value": "1536:xLCPsQehkHYL2HdxCxInN5qBNMivktYXPS6Vvoa:MsQeQy2HdQxIN5qv5vktsSIvz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642729804, "uuid": "214fa2a3-a574-43b8-b337-368bd5dafe6f", "value": 49752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642729804, "uuid": "79c17452-21af-4683-a9d5-9c0342468443", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642729804, "uuid": "b776d273-59cc-4d84-a521-89b41170dabe", "value": "flow.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c372e6bc-7a61-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642732085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642732085, "uuid": "be6d4d27-a2d6-478d-9b93-febc2eb58bc9", "comment": "Malware payload", "value": "eda1c2b4b402616f68ff109fbd42fb35", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642732085, "uuid": "dab86049-398b-4a1d-a689-ae81bff0fa33", "comment": "Malware payload", "value": "54d3f3dbfb69c364bc85ad8cfd567a9e863bae7d49bad3157ba432101f348738", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642732085, "uuid": "bf4306bb-119b-4101-bdd1-ab60542ddb12", "comment": "Malware payload", "value": "5ef41b1bbcbe4081024bb5d40e8b4aa37a87873c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642732085, "uuid": "2f887931-fa41-490b-a353-9a7eb581de0e", "comment": "Malware payload", "value": "5d2a5ac6b87342bd3af05f8e0600b327b0ab852091202b7c021a0ca913d0ae6027c164192dcfaa03109dd9d3330bc597", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642732085, "uuid": "d34485f4-8144-4d1c-a510-bf467051ddf6", "value": "T16B13C6456A318FEDF66C82304BB34A21A7AD73D913E19785E29CD5002F7038E546FBE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642732085, "uuid": "d5cb3076-dd59-4c82-8982-d986ede55829", "value": "768:e8ZZ4tZiW3o5+wT9xHfWLHyCS3SeIbRMPMIt:emZCwBd+LPeAMPMe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642732085, "uuid": "bb5f8ff3-e20f-4890-b432-a855d9943fb9", "value": 43524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642732085, "uuid": "11bddbee-c5b3-48e7-bbd3-4c230cd197da", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642732085, "uuid": "ad211a7f-b62d-4956-be22-17b5e43bfed5", "value": "beamer.mips-20220121-0228", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d91f7203-7ac6-11ec-9275-42010a9c0029", "comment": "Malware payload (Smoke Loader)", "timestamp": 1642775500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775500, "uuid": "5af31a26-d0b5-464c-bb96-29fab08688f9", "comment": "Malware payload (Smoke Loader)", "value": "0daca42454265a66cdc6b1ef4e44d315", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775500, "uuid": "bd9c0ea7-e7ab-4dd3-8f84-51c5ed499c9d", "comment": "Malware payload (Smoke Loader)", "value": "56a366fbe2babfa88e0e073d2c07e357ec4998d6d33077d53c222099ba8b97fb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775500, "uuid": "ba3b7c9f-23b0-445d-8405-7dba112ef36d", "comment": "Malware payload (Smoke Loader)", "value": "84e3a8c23289d811a507523c376777d5b34f6115", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775500, "uuid": "d1aed86d-dafc-4d24-a0ee-e58623d5418b", "comment": "Malware payload (Smoke Loader)", "value": "643a2182d815d7a6ce10cb868831ea41a65c1ad21fa9f78aa394ef8a1eba5152b0d142ae9d34fc0595534c6ab26f857a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775500, "uuid": "197a9158-9ddf-4fbe-bf9f-cf479cb1fcd8", "value": "T1F2748D10BBA0D035F5B311F55A799378A63E7AA15B2490CB53D52EEE9B396E0DC3030B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775500, "uuid": "2962f448-2a07-4231-8459-5c2d97a2f8f7", "value": "b4892f1130d31e71dc6b3341892a29cb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775500, "uuid": "112ee2ac-3cac-404a-8928-d8210494ef18", "value": "6144:C7Uzdbm8CoCTTKKstQW32SBHRWODcbW4BzcV+cC:C7Adb/yGKsyW3LXFcNlY+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642775500, "uuid": "63facac0-76e4-4242-a381-97b1a214f68c", "value": 337408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642775500, "uuid": "fa95a4e6-062f-41b8-9aec-8df9340329f5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775500, "uuid": "6318dd74-6473-47c1-898f-6dfabbb7958a", "value": "0daca42454265a66cdc6b1ef4e44d315", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a899ed9-7b00-11ec-9275-42010a9c0029", "comment": "Malware payload (BazaLoader)", "timestamp": 1642800252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642800252, "uuid": "661e4214-161b-4a1e-b754-b13d455bf6bf", "comment": "Malware payload (BazaLoader)", "value": "f198da6e1ffc5c8e76e126412f6a0fe8", "object_relation": "md5", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642800252, "uuid": "c3e6e7c1-4861-490a-b1f6-77d38cfd26fa", "comment": "Malware payload (BazaLoader)", "value": "56d8a969497fe0cf90aa6e71c8f7c1a2e76b621d0b18876db8e3ca198a7b4350", "object_relation": "sha256", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642800252, "uuid": "8167b6b8-ae5e-495c-96a7-1764862ab12d", "comment": "Malware payload (BazaLoader)", "value": "e3f2a10f79f2b07e2a80c5d218e15cc1ae3b9a8e", "object_relation": "sha1", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642800252, "uuid": "7134a0f2-d148-4b3f-abb9-7cda902329ad", "comment": "Malware payload (BazaLoader)", "value": "e817b3400c7a5e80ac2c91be0a1ba32b5a0fe1be99220c54912d665bdedc5a370d6fba51b2ecbea65fefa8763ce3345f", "object_relation": "sha3-384", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642800252, "uuid": "fa043691-f188-45bc-8aa8-28dfda9fa2ac", "value": "T1F385FE43180C819F9867D77421671D97EEB87E47F2C84E1ED1E428B84AEBDA674CA04F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642800252, "uuid": "32aa72aa-5ba4-4647-9ee7-32f23444c564", "value": "f30f2b5b65c947eccbf132b668fe3257", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642800252, "uuid": "f6b620a8-9218-42b2-ada8-7ac4ff64881c", "value": "24576:Ga1QHwgJMrQqj/wAc6QORNx2nAjwka4m0GV9igWwlnwXQBwfalj21X4GtZ+FdnZ8:gH5qloBMd8A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642800252, "uuid": "b34f29e5-bb6f-440b-ab78-c54516b6ee88", "value": 1816064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642800252, "uuid": "37af0dff-60a3-4af7-964c-ac3132a10a70", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642800252, "uuid": "29c1aa23-e39d-4942-82f7-1f39b6abcf2d", "value": "f198da6e1ffc5c8e76e126412f6a0fe8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dddaaed-7af2-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642794111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642794111, "uuid": "a3658db9-6856-4b4b-8f7f-c490c8f313b9", "comment": "Malware payload", "value": "a1a322a4360e327f29fa68728e1be12e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642794111, "uuid": "a55c5aab-7a28-4130-88ec-9f60d2f00864", "comment": "Malware payload", "value": "5701cdbcdea3ee9c0a8aa7470f90e78eed76b7192f1e4a31d019660b5345d86c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642794111, "uuid": "d3937182-ba0b-4b29-a4c5-3d299e922e89", "comment": "Malware payload", "value": "3e9318ecebdb6e7baa5e112244a484c3771a80ad", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642794111, "uuid": "b471b881-ec44-47dc-b449-6d3775bc110c", "comment": "Malware payload", "value": "68ee4443e3604ea08c5d3fd531c9a8f27fee913d28eb539878af72f57bb8abdf84285fc0081a7b6d534e2e23a482cb5d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642794111, "uuid": "8cb7271f-2bc2-48b3-997a-f84755cf2434", "value": "T15F23F1B141D898A5DD6BB9F5CCC621E0F2B09F5E16BBD120028DAF322E025576762FDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642794111, "uuid": "3349f6fd-f710-4958-8185-edd39c71d6ef", "value": "768:v/ZbWPdBFhJ9HQuUfA3DZuCImBAu72IjxxouZDoymQ0F/JiTBaH4uVcqgw02NWX0:v/ZmdzhZGAzb+IjPouZDoM1aH4u+qgwH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642794111, "uuid": "44f7cdb6-62b1-49d2-b3e3-053ca72c963a", "value": 47916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642794111, "uuid": "712fcafe-608d-4db6-9a75-10a240ab0101", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642794111, "uuid": "de2c09af-8e8b-42bd-823f-79a6dd2d6ddd", "value": "a1a322a4360e327f29fa68728e1be12e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c64b1d8c-7ad5-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642781911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642781911, "uuid": "0a56c70b-b983-46a8-95e4-c124ece1f2d1", "comment": "Malware payload (Mirai)", "value": "9339f193205286ce2f142f4d16c63291", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642781911, "uuid": "6b6d73d0-144c-4b43-99d6-715ad07b3405", "comment": "Malware payload (Mirai)", "value": "57616ff8b70ca94f6da0418d468bd13d651de03b894f4ed44871bca540ff056e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642781911, "uuid": "b9b93872-114f-4b0b-8219-e957314ad576", "comment": "Malware payload (Mirai)", "value": "d0dd5af7d71252eb67a9d8e174527e9f72990ac7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642781911, "uuid": "12ef9ac7-9d4b-4a4d-8be9-2b4332acb93d", "comment": "Malware payload (Mirai)", "value": "436d00342b1a47c97f3ec4bbf674d0f8707e683305ddfef15c68495ebd66745935a789957372be1dc25387e980802a75", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642781911, "uuid": "5bcd4100-ba20-4cc9-8c14-389508220799", "value": "T19F430856BC818A12C6E0127AF66F85CE3B2123E8E2DF77079D211B6136CB41F0D67D96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642781911, "uuid": "5fd62d72-5923-4689-b989-c245f0c5d0aa", "value": "1536:FH0Rv9hcS5f76tdOE1gSqwcO8rszBXuL27PahFBw:FH09gQ3jCBg27ShF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642781911, "uuid": "52ce6724-f94f-4279-a653-61615d7b9e17", "value": 60476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642781911, "uuid": "1bc83830-95fb-47b7-8e6c-cf7b83c4ea41", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642781911, "uuid": "61287af5-b03e-464e-85a2-6f4701958b99", "value": "9339f193205286ce2f142f4d16c63291", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b215f26-7a4d-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1642723320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642723320, "uuid": "c32294af-982b-4954-be6a-c190553b0bc7", "comment": "Malware payload (Gafgyt)", "value": "a231ed5575614f8b61af84db379217d7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642723320, "uuid": "592e0ae2-85ae-4bb1-b979-edc9fa5e9ac7", "comment": "Malware payload (Gafgyt)", "value": "579de38366607fedec1b749abdf6987dfe99382d15541fcb4f50d9184ef06498", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642723320, "uuid": "fc5c3ca4-043c-4c6f-ad3f-bbc7cf1c5787", "comment": "Malware payload (Gafgyt)", "value": "47979f48e108ab81ff09d0bbab7a481a3c8e1a1e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642723320, "uuid": "b4d0d472-2cfe-4546-8de3-3db66795b750", "comment": "Malware payload (Gafgyt)", "value": "850a805628681454a5da27a6ef79bc662042eda8d503172a627bd36a4c0b892b661027222adc3fa78b10caec27019d7b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642723320, "uuid": "381aeff2-0c76-43cd-b64c-7cb4744f69b8", "value": "T185041A09E810536BC2D323BFFB5E528E73371BA867DB33219A345AB42BC57591D39920", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642723320, "uuid": "75fc2505-1532-4377-bcd6-dc1d4a30a39c", "value": "3072:QdXg2uQawnAa1dKEZLxS5hUcpeDXH8zZ9y77NF3msQLnh0X0Kr:8XtlawnA6xS5hU5XH8HI7NF3msQLnh6v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642723320, "uuid": "eb50f05c-d5de-4086-81db-532e72d303de", "value": 175344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642723320, "uuid": "1ec150e1-c610-4077-addf-34cf9e3450fa", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642723320, "uuid": "1d969153-6361-4275-beb5-f1a09fc77c6c", "value": "a231ed5575614f8b61af84db379217d7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c15d4316-7a77-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642741530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642741530, "uuid": "468c9604-4c83-4dd5-b172-4b2a35204e4d", "comment": "Malware payload", "value": "64ca03668db6974a687b462afcd23b04", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642741530, "uuid": "a72814f7-e21e-4ef1-99bd-7dd8d44daa92", "comment": "Malware payload", "value": "58e1424d98e6575825f0ee68bd2329c6b068ec69a7dd99690dcbab90b2bd9554", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642741530, "uuid": "e2e1011c-5de0-4d52-a6d9-e68be54fa8de", "comment": "Malware payload", "value": "266e121cb14eb85cc934c0d416dc8736008216d6", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642741530, "uuid": "f5ec288c-5c57-4ee5-926d-4f6a79a0b54f", "comment": "Malware payload", "value": "2489040cdd7eb7f1567db4b177587299ba9762943c24914ae287f9067ea99e41d8bddb621936fe0a6ec69bb95e97baa4", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642741530, "uuid": "83722be3-14b1-4e9e-afab-29c7c36d06a4", "value": "T1B752C6D0B9959A07C9C54373BB4E83997B256709F2EF3703BA1E3F20665BA570E26042", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642741530, "uuid": "a868d745-6793-407b-9f32-8acc8cbcd9e1", "value": "192:9fv+g6W4S0GESpUx58GJ8UQv1b5B7KBZ1Iv6JzmZmgqZ0/VV:9faWgGESXjtBG1cql0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642741530, "uuid": "4ddb0225-37fc-4585-8269-5063a627205f", "value": 14212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642741530, "uuid": "a8b09177-3714-4d28-8a14-dc617037ad21", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642741530, "uuid": "466ee192-43af-422b-9ba9-73f00ccc6811", "value": "beamer.arm-20220121-0505", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f5b3755-7b12-11ec-9275-42010a9c0029", "comment": "Malware payload (BazaLoader)", "timestamp": 1642807803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642807803, "uuid": "5b975a58-5315-4394-bfb4-bf57e68dd00c", "comment": "Malware payload (BazaLoader)", "value": "d9dc8d21d1b662803907276a1c131b2c", "object_relation": "md5", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642807803, "uuid": "20674907-8a5f-4208-9a44-a9d73d163abe", "comment": "Malware payload (BazaLoader)", "value": "59136a8738af5783756405f46526e99f705dd94a14dd2629de96880814dacc0c", "object_relation": "sha256", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642807803, "uuid": "a26eb3a4-0820-4102-99be-02bf2791dce7", "comment": "Malware payload (BazaLoader)", "value": "ad15b7c845390a2964af34255cf50db8c1c98a8e", "object_relation": "sha1", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642807803, "uuid": "f8085290-a537-4962-b287-b3ddbee7c9ec", "comment": "Malware payload (BazaLoader)", "value": "bda6bf266e40bed4a45a075597eb8e1ec50ad4c00ebf168c87d0a3977e1e5f57323691710ca17351e37d36fba15220ce", "object_relation": "sha3-384", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642807803, "uuid": "336a0043-b6db-44e4-92bb-c365765e4e54", "value": "T1C285FE43180C819F9867D77421671D97EEB87E47F2C84E1ED1E428B84AEBDA674CA04F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642807803, "uuid": "900736e4-d406-4498-91fd-d074e898e17e", "value": "f30f2b5b65c947eccbf132b668fe3257", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642807803, "uuid": "c619a944-b031-44fa-a79d-c00775dc7688", "value": "24576:2a1QHwgJMrQqj/wAc6QORNx2nAjwkazm0GV9igWQlnwXwBwfaljN1X4GtZ+FdnZs:znEKFIhMd8A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642807803, "uuid": "e05c8caf-6fc3-4c0b-8f6c-afe4ba434c7e", "value": 1816064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642807803, "uuid": "4dfa6149-864e-469d-b1eb-a8fbb0f3bd75", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642807803, "uuid": "582fc257-41df-4fe6-9365-0b4891a35063", "value": "d9dc8d21d1b662803907276a1c131b2c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b1ab326-7ac5-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1642774806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642774806, "uuid": "3dec2ecb-8e2d-4730-a8db-7373d072855c", "comment": "Malware payload (AgentTesla)", "value": "ef4fa2666ac56f52c29bebe10a953269", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642774806, "uuid": "5b1f36ce-5fa9-4b9f-a7ed-2262ae75bff7", "comment": "Malware payload (AgentTesla)", "value": "59a1ca93228d0609cf40c5e6698e8d192553064d01a25f21fa4f240381d765fa", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642774806, "uuid": "28b664bc-ddd7-4664-925d-dd4b8df3d97e", "comment": "Malware payload (AgentTesla)", "value": "386adfa2d9ac290bc574aa0d61e73aefffee5475", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642774806, "uuid": "fb857a01-a673-4616-85d1-58c37a82e121", "comment": "Malware payload (AgentTesla)", "value": "96e045016bcfed1229f92c265fb007743d076ae045159b0e1c1b71a50361a90c550f43057b242d9bbd9382fec1155d44", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642774806, "uuid": "af838729-dbd5-4642-bd06-cbb3cc3c9854", "value": "T158E4DF4032F88B45D8BE87FA48710090177EBA1AA875E71F5EC5B1DF0DB2B819B16B53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642774806, "uuid": "de445ac0-09a7-45c3-bf90-695c6928bb47", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642774806, "uuid": "1cb088f0-8e75-4dc2-8f9a-ef63017a1845", "value": "12288:KzvH9RpQhj59BQgT9CIsYJ7w117Vb4F2bTXdedev7QKFErtRCO7q6+ievYF:OPpQv9rT9NsYitakbTXded0kMwzCl6+2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642774806, "uuid": "4a82d9f7-fc64-4c6f-9ab7-41269ccda603", "value": 720896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642774806, "uuid": "8a68930c-a7ec-45c6-873f-842d317b4cc6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642774806, "uuid": "c04d65e3-6b75-4c89-89a9-e2498514f584", "value": "BOQ_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77cc54fd-7aa7-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1642762022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642762022, "uuid": "66db5884-fb26-4af5-b41d-ea629f742e03", "comment": "Malware payload (Loki)", "value": "6c27a8966a8fed0fc50b1fe520b401e0", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642762022, "uuid": "79c4f067-5213-42a1-a7b2-52547a24645d", "comment": "Malware payload (Loki)", "value": "5bfde433abfb4b0bc6ae15f266aad29e13e5b4b27288cc32a7cb81adc3a3da73", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642762022, "uuid": "aa321f16-9654-4f6f-aff7-93077832e626", "comment": "Malware payload (Loki)", "value": "1324d0ddd390ad5489d30a3ee9f96cb6697786ef", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642762022, "uuid": "7e2cffaa-2982-43ea-8ef3-2e3dc57ca1a3", "comment": "Malware payload (Loki)", "value": "1e7edddeea1937936a4efa6c0159a1e24ab2cedd53d4c1857363f2ba676722fb7bd7bea8edf6bb236683730c06f7a0c8", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642762022, "uuid": "b9174629-3f34-4b84-88a9-46a051695a89", "value": "T13C94BFB876147DE6266F576BDA96BCDC03B62B6389CB94CD80687BC30563335FE02805", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642762022, "uuid": "b2fbf8c9-7852-4c9b-8e6c-234661ac867a", "value": "12288:LtN45zrtgVRUXpJLGE1tn2uwBC1voAUq0uOl63XmAf6/o3:Lv45zrtgVRUXnqy92wOq0plCXmAf6/S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642762022, "uuid": "fbd3cbbb-3d80-4315-ab94-d051a1e60a15", "value": 443715, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642762022, "uuid": "64063b3b-4540-4337-bad3-5e84c41507f3", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642762022, "uuid": "4cc25252-9efd-4460-85cd-21080c6f019d", "value": "New_Oder_Jan2022_Urgent_Quote.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0454b242-7a9b-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1642756675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642756675, "uuid": "d2ed2b8f-21a5-4316-a10b-7c920747e682", "comment": "Malware payload (SilentBuilder)", "value": "99130b164c6d3c4fbb33d9d4588551b7", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642756675, "uuid": "c5681f56-644c-4fe3-9b0d-3299da94718c", "comment": "Malware payload (SilentBuilder)", "value": "5c5a644377d6087d2f2f42c7bd198db0c02e903ad833e0f003ed0050fe9e2ce9", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642756675, "uuid": "035f4d36-d2e7-4d0e-8738-53d9c7d4f552", "comment": "Malware payload (SilentBuilder)", "value": "a3e9bbca528a24553d43ad72e4434ef58ca209b6", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642756675, "uuid": "67cffbba-d829-491c-825b-6a5676023818", "comment": "Malware payload (SilentBuilder)", "value": "ab2054a57957a09e7305a3f0002699d863e5c6e8417b9267738fb8241490ebb627c7c74096ff36126f41c5a8babf2435", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642756675, "uuid": "234398fc-ac90-43f4-845d-7732762b8787", "value": "T1E5636CA7B78299EADA0483394DB643C5B717EC104F9A43C73694F7346EB49F08D9324A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642756675, "uuid": "b82f1e81-b1a1-44d6-9525-76c5608f9505", "value": "1536:bpEk3hbdlylKsgqopeJBWhZFGkE+cL2NdA8eXZiozeOgXVZKyaZpvyR1kZkJvU+:bCk3hbdlylKsgqopeJBWhZFGkE+cL2Nr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642756675, "uuid": "fa72b0a1-d978-466d-a93b-5d872e178684", "value": 72548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642756675, "uuid": "ddbbd3bf-6714-4d65-8248-a0c0d9bd81c1", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642756675, "uuid": "475d4916-db9f-4c9d-83d0-a3bf3f78c23d", "value": "ZOC633374079GR.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5425a1e-7b06-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642802981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642802981, "uuid": "8cfbb9cb-bbcd-41c0-a6d8-ce57efad44f5", "comment": "Malware payload (Mirai)", "value": "6b7451ef33fe2e31e726a53af93ea485", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642802981, "uuid": "3ece9fc1-95d3-4846-9ba8-985a2f6ede08", "comment": "Malware payload (Mirai)", "value": "5dff7c3301c92f8eac79adb4f1a2f0d78a35f6e3c89528b6a04e03e0de833ba5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642802981, "uuid": "54e5bbe1-489d-4def-9c15-72525fae3dd1", "comment": "Malware payload (Mirai)", "value": "5485e27c408fc7ddbe84dc731acc18664fdd0eb3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642802981, "uuid": "0a6496be-bf60-44bb-b96a-f362c9759059", "comment": "Malware payload (Mirai)", "value": "5892704fc83c9fe85a1bb5bd3e7b7e66ecae4ea5cc4d3b83e909cd8c0b457b7c0bb79f2d39c4b0e008aca85a08deae78", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642802981, "uuid": "a542e94d-00b9-40c2-9351-3cab1942c755", "value": "T1F8535CD9B4119E7CF9CBEABE88224E0DF860221154930B27BAB7FD937D32195DC52D06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642802981, "uuid": "617cba55-7080-4775-b641-1314031ba24d", "value": "1536:j0klfwJ/mebn9ykMBR7l88g1pkPwtF5LR5kSF/zlgs178P:j29168xpZXlR5VgyA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642802981, "uuid": "aa92e0a4-181e-4b84-b24f-d574a845a7de", "value": 65940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642802981, "uuid": "9baa407d-09c2-45fc-8f27-238681455ca8", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642802981, "uuid": "ae044aa8-8ae0-4a68-b9f8-ceed49321ac4", "value": "6b7451ef33fe2e31e726a53af93ea485", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18165974-7b04-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642801805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642801805, "uuid": "62df8e4b-8c71-4b2c-b067-51382ce04730", "comment": "Malware payload (Mirai)", "value": "14de00fc048bbe37f8c7964d649bbeb0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642801805, "uuid": "c7405870-e2c9-4ea2-9c8c-2d3320baaa37", "comment": "Malware payload (Mirai)", "value": "5e1d778279dee9f18ec5cf830928161c0caac204b271e16c49ad88284c0a4281", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642801805, "uuid": "467d19af-de37-4b77-a13d-f42124bd35c9", "comment": "Malware payload (Mirai)", "value": "fabaec2c240bd866e09303253064af7c1eedf62b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642801805, "uuid": "cb66dd6d-d13e-4ede-abac-89d6f2b818bc", "comment": "Malware payload (Mirai)", "value": "f85e1fc22bffeccf44a22e4072c00de53986071263874db79da12f8ceb1ab91ae403993b6c1873b418531e654cf68309", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642801805, "uuid": "01dca713-577f-4cf2-aa71-d6ae17d34337", "value": "T159D2F1E8EF78DB87D4D5A73E486DDC0A71ACB8A71AB6D11D0B410C226039DA0D5ECCD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642801805, "uuid": "7377b179-eb8a-4ecd-84d8-49f4418bb069", "value": "384:MeMzN8f05Rpjk5Yfo2xZUTKmQAHHOvgm0vtsgV7EmQi3iDeGFXmLc1/Z3/e8Ummt:EN8fWlfoQmQAXV7EmQciiRcrHKOu3Iq7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642801805, "uuid": "228a5eed-91eb-480a-8834-73fbf5138a39", "value": 29912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642801805, "uuid": "a4954190-3741-44e0-91f8-c809bd155ab1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642801805, "uuid": "6bce598a-ae57-4cce-85ee-3ee8dbec7fd2", "value": "z3hir.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3fb290a-7ac5-11ec-9275-42010a9c0029", "comment": "Malware payload (GuLoader)", "timestamp": 1642775008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775008, "uuid": "76afdc45-3f8f-4167-96b0-5fa08c4a21ed", "comment": "Malware payload (GuLoader)", "value": "24e935f7534a81a7fd4e32daeab208a5", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775008, "uuid": "f068d411-d5f6-459c-b6e5-10093fbc2a90", "comment": "Malware payload (GuLoader)", "value": "5e6d8684c3f71ca6a76d22d1ddc536f302738a3027d22a5b1ce1852c9c551d99", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775008, "uuid": "38ef4e45-0fd8-40e7-9d9b-64543a9e24b8", "comment": "Malware payload (GuLoader)", "value": "251ac05ebc8c963418dccddda127d2a81b5097db", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775008, "uuid": "e77daedd-beca-4d87-b8d4-86e120655ca0", "comment": "Malware payload (GuLoader)", "value": "1d40a2c74476b509919019cff883c2d394a2ef62a56187d0dc38d33b718ba31b37ca1eff0bcbf236aaaef61bb132a56d", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775008, "uuid": "875c886a-6d7e-42f2-b1a6-ad49b790ea92", "value": "T1A473A3F8AAFD9C9237F77D41E12B3A8EB58F062581E70D39B399186E0B16174CB1B444", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775008, "uuid": "012f85fb-ee0d-45dc-a3f0-dbf05ca0cb38", "value": "1536:8KOb1Jqxa/spd61vkvf8+ZeioL7azKUkqnpnrwIYcfJHSzv8j6aiownmOTr7uAY:8zWPWav0+Z4azKOnpnMOfJovta37G5Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642775008, "uuid": "1d82e0e9-9668-4e74-85ff-4be1d3121234", "value": 79866, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642775008, "uuid": "ce6f4bf3-7eb9-4c71-8250-f937b69875b4", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775008, "uuid": "a3e71fc5-f1c0-4a0c-9a23-e6b5e6c1d2a4", "value": "New _Inquiry P.O4622.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac1c7ee3-7a93-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1642753520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642753520, "uuid": "dc1870dd-c447-480b-8f9a-b0c757912f8e", "comment": "Malware payload (AgentTesla)", "value": "147948fc6c865ac02c9092982c2ee569", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642753520, "uuid": "2e23eb06-5038-4e7e-95b0-afb114efe0cd", "comment": "Malware payload (AgentTesla)", "value": "6000089a1556c1c77b9f13779b89c33e5dbc87d27e8e7015e38e3f4fa58dea5d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642753520, "uuid": "d1461ab4-ee2a-4f40-a0ee-d34b9860936e", "comment": "Malware payload (AgentTesla)", "value": "632a0c9bf3ade4cf296833f9c277340795f55faf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642753520, "uuid": "c9ce906b-e5b1-4dfe-8dbd-d0760ab4fd5f", "comment": "Malware payload (AgentTesla)", "value": "b136eed832a1bd7fd7d9106ea925193db5ca3a65bf8bba5e7e704e6ee7bf7f326c658eeeab1cd5470177b38f028ddcdf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642753520, "uuid": "1f487180-eb7e-40e1-bc41-91d0d35943d7", "value": "T196E4E05033F88B05C97E8BFA4871009017BABA1AA975D35F6EC1B1DF0C71F819A66763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642753520, "uuid": "e375ed4e-0c2f-462c-9b6b-1e1db79511ae", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642753520, "uuid": "e4be352f-2d48-4def-9c23-5066a0500775", "value": "12288:Jg0OyM1pQnGt3aRnqQQ2YtfpL6B7oU3zwNt6bkq6+ievYF:mpQGt3QnqQufJ6BFrbP6+ievYF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642753520, "uuid": "e50b9d22-aa3a-473c-a3c9-5a2a971f11bd", "value": 716800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642753520, "uuid": "accd44de-9364-4f42-993c-ede71e43d4a6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642753520, "uuid": "7d985946-3477-4067-9962-4e95ef76d3c4", "value": "3qzVtNUWuDjoXPy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c90ee3c9-7a77-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642741543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642741543, "uuid": "1ddd68db-00f2-4854-8a33-10785f3731f0", "comment": "Malware payload", "value": "7b26975ce4bc1305854f64a7388b3e6f", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642741543, "uuid": "ed37c77e-8aae-45d4-be98-7456abf3fc68", "comment": "Malware payload", "value": "60a6a4d94a3fcbfc2a1298f577211e0e8e7e97183bd7444bd5324a460d3416a0", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642741543, "uuid": "8591fe16-6b14-4e26-b45c-4a816ad3ce62", "comment": "Malware payload", "value": "dc89758b12929156e2ecc2ad061cb0e6dd525f8f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642741543, "uuid": "eef7c876-f443-4539-b39d-302a5b2e7bc6", "comment": "Malware payload", "value": "53dc03d43136d6bb66c3401f295798cca4e2d40452a187ea5b8b09ce57ece8b6cedacddb7425512fa0e1b2165ad522c6", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642741543, "uuid": "ea586b05-af83-420a-9084-e1bfa7c4c495", "value": "T1FBA260592E329FEDF6AC863047B34A21675833D936E1D688E39DD0092F7054E251F7E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642741543, "uuid": "49a7526d-d60b-4412-912d-4f43f9143b5a", "value": "384:K6fT/fTb858Bav9q2csULdO8ldt5X2TbXqyNrAtNpMCW:K6fT/fTbu8QjJ1SkHqymtXMCW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642741543, "uuid": "a69e755a-de16-44de-b27d-408ba377d50c", "value": 23028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642741543, "uuid": "0b6d54a5-b4f3-4a4a-9d67-a3cd7ad8733d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642741543, "uuid": "04bfc58a-08de-416d-9425-681e384c70a7", "value": "beamer.mips-20220121-0505", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf00f7e9-7a8d-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642751002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642751002, "uuid": "874ca7ee-beb0-47e7-98ec-0b7c4a817d8f", "comment": "Malware payload (Mirai)", "value": "fe9572744af8b12af2896166b32f8d98", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642751002, "uuid": "9a2877cd-0596-49eb-aa95-5af747f3bd29", "comment": "Malware payload (Mirai)", "value": "60ca44ea4b506b3245ca90c99f54f28edfc8e437f48ca7c677eb9a69d1800e45", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642751002, "uuid": "48509cf4-400b-4016-b070-2d18ea685c88", "comment": "Malware payload (Mirai)", "value": "10993797cb0145fd1f3b3ce32302335d2fa10c57", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642751002, "uuid": "a538fb2a-6b01-4923-8b56-760de4888eeb", "comment": "Malware payload (Mirai)", "value": "d6968a528cc5de42a84b2d2ecffc45e6df89e4552525b8386b1cff845392ec5f42ae1214cd85bce7ac83b3d64df812b6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642751002, "uuid": "b3588ca3-c93a-481b-be1b-b13eeaab82a4", "value": "T15E639F23E8202E65C82151F9F4F4D57D93515EB181925CB16ECEE90A14BFE8EF88E7E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642751002, "uuid": "0c7aa7ce-9ad1-422e-9d5d-e51f2d60c6fe", "value": "768:eEvLdHqjJpxIW4M9uuwt5s4LThYTZYp0JlMYlLRSHA0djnqtklqGxiQwcBcoN5rf:BwPyTuUm4LmHLRSHX1sQajOWr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642751002, "uuid": "a15aee6a-98f6-447d-bdf6-2ae04f7d0b6f", "value": 70616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642751002, "uuid": "f9e35443-85f4-4942-a7a3-52ec4fcd306e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642751002, "uuid": "b6ec293a-4317-420d-8f3e-e863811474fb", "value": "fe9572744af8b12af2896166b32f8d98", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e9aa293-7aac-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642764208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642764208, "uuid": "e843eddf-b58d-4d4d-8349-d09cdb84f9fc", "comment": "Malware payload", "value": "f125a54fa3441360f0ce7ca542402c1d", "object_relation": "md5", "Tag": [ { "name": "193-201-9-212", "colour": "#5EC393", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642764208, "uuid": "b6c7506f-0f74-4135-9f93-cf5a4f21e1e2", "comment": "Malware payload", "value": "60d3c01d262319d5b87a9fdf1d05c840429e487def482ca581c6f4bf397efc8f", "object_relation": "sha256", "Tag": [ { "name": "193-201-9-212", "colour": "#5EC393", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642764208, "uuid": "ed95a586-c699-4c88-83f1-f22002bca1fc", "comment": "Malware payload", "value": "43ce420aa1fd48c49eff9769caee2913ad87a10d", "object_relation": "sha1", "Tag": [ { "name": "193-201-9-212", "colour": "#5EC393", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642764208, "uuid": "ebf7a124-ee84-452a-abdc-7bb35420be31", "comment": "Malware payload", "value": "5c58926860f9f893f464be9d5c9159431a7b2402eeed84aa5ee2d41ad28c63547c7f82c5771da0befd794f314d2ab397", "object_relation": "sha3-384", "Tag": [ { "name": "193-201-9-212", "colour": "#5EC393", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642764208, "uuid": "eda9a6a5-85d0-4d0a-862d-5e6f9a0d85e5", "value": "T11FB4021B77E435F4E0278D3988619B15C7B2B8361A76CF1F0354A7452F27A908E3AFA1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642764208, "uuid": "103d9eec-eea9-4ba7-a7d7-6259d9f46ef1", "value": "f30a089187e04ce234313cfb9ab5b025", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642764208, "uuid": "4a36f96e-6387-40a8-9eb1-e06734cf5cf3", "value": "12288:TPOggS8iIl+UVSjGxIZGqvubeIcIDHwmvANVhINUgy:TPOggSyQKyG4GRb3cexAjyUgy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642764208, "uuid": "60df0950-bfbd-4ff9-95f3-ed45e42335e5", "value": 501248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642764208, "uuid": "07e19ea5-87ca-4802-9514-fbff0df1628c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642764208, "uuid": "7c295374-3947-4b0a-9f5a-9456ad18ce5a", "value": "payload_x64_57119_staged_tcp.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7a22ac7-7b15-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642809347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642809347, "uuid": "369fd3ad-d99c-4fcd-9787-4775ff9fad70", "comment": "Malware payload", "value": "9b6e603d08ab129a83b0e5c6c9867414", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642809347, "uuid": "44f7fdd8-4e64-431d-8561-3ce8d828f1e3", "comment": "Malware payload", "value": "6187b7445fff5343ef45810b7bb1eb699b98479bd58044559e37e5ca67ffd33b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642809347, "uuid": "be2e35b6-e1e0-42da-8f43-8bff4a42bc17", "comment": "Malware payload", "value": "a9bc5eee56380ba466c43055dc7f0122df34f40e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642809347, "uuid": "7fd64c59-a121-434a-8cf2-c74833e65c5a", "comment": "Malware payload", "value": "a4780e41b5a846d3ff33927c68e02dfcb1b112b197f147a30285602e01fbc685f4354f031b123767d25ed096873ca2e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642809347, "uuid": "6746e0e0-0145-4753-b6d0-9da0cac6ae9a", "value": "T1713522EC6640B821CD947DB099B68709D2EAABD1DB92F9757084B20B6B763F1DC0331D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642809347, "uuid": "fbed8618-c14a-40bf-9340-199b1c6356bc", "value": "66e927d289ed14560383f86810a4b8b4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642809347, "uuid": "d1773a46-e3f7-41f0-9eac-e62b2bb78644", "value": "24576:rIya3SmVHb8Jsrm9n0zzepJCMzWPGkoWgYSJKsStHg3rWPTg:rIyaF7+ym90fzMWPGrLYS0s+HB0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642809347, "uuid": "983a9440-9617-47ac-b6da-815a539edbfe", "value": 1093952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642809347, "uuid": "69595e3b-448d-4ffe-ae93-0ce2746c8f45", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642809347, "uuid": "c3f91109-2d13-4364-891f-7a2852a05eef", "value": "9b6e603d08ab129a83b0e5c6c9867414", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da61f981-7ac5-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1642775073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775073, "uuid": "582971e1-5c8e-432e-9727-4a135853202a", "comment": "Malware payload (AgentTesla)", "value": "3116d1b48b6d1b08ad8daaac6213fcf4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775073, "uuid": "8a8e8e2d-ddcb-4636-86db-ab7be20e333b", "comment": "Malware payload (AgentTesla)", "value": "61d77bda89c1c7ad39ca23d14337cf1d1e0233dad8e91e55dc5c56b08ba914a1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775073, "uuid": "34589f96-3b9d-4231-bdfa-c45bba0ff221", "comment": "Malware payload (AgentTesla)", "value": "8a7cdb438482a31cd192aa4fdad55150ebb4ad94", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775073, "uuid": "945170e7-e274-40c5-a889-8dbad9c1baaa", "comment": "Malware payload (AgentTesla)", "value": "fb71e58fa5eaedb4b860773d13405d1c14bfd569aa5fbf0b4497c0eb1fa4484fb138dc9b2ad3143f367a0f70bedb906b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775073, "uuid": "e20f39b0-0568-4975-bd9e-78626de79e16", "value": "T14325D0A87B40B5DFC90BCE75C9686C60E720B4AB170BD64790571AEC9A0C7DBCF116B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775073, "uuid": "1d64028d-7c26-4f6f-b122-cb8abbbf83bb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775073, "uuid": "ca207906-f904-48b4-aa02-61d1fa19e936", "value": "12288:zZzV6I/OviiiE9WfXGd333YnLwgaY1A8PlfmUqHO3eZgiaODendJH8j7kBLE6A/5:zuITfXk333YnEGSJj0eZtD+d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642775073, "uuid": "52ba3aaa-b889-41eb-8546-f241914fd02d", "value": 962560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642775073, "uuid": "5a2086d0-3350-46a5-a842-f1c681b44f0a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775073, "uuid": "b8eed9a9-7aa1-49fd-883c-1415224433e4", "value": "DHL Delivery Invoice AWB 2774038374.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "634b11b2-7ac7-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642775732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775732, "uuid": "ffd43e1c-7905-496a-987b-8ea19bf81da8", "comment": "Malware payload", "value": "32205c304c7ae124f63684455dfefd50", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775732, "uuid": "060c4d1b-48eb-46e3-aeb5-e92bd28ec664", "comment": "Malware payload", "value": "6248995ca509223d8941ef0f7348b8a31dc71a453e5b5e85d3ae871abc2cfba1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775732, "uuid": "8e1ea8e8-e490-4644-a3fe-09dc80603d93", "comment": "Malware payload", "value": "b140aea61b87704afaa3f2b241e3b76f2c7cc636", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775732, "uuid": "d489db65-b207-4caf-a6e6-2616910443b1", "comment": "Malware payload", "value": "2d1376992a4e91f9b20d4ccd826c8c46016ef4ac010706f04e923c290970b533f6a3d046c609bedd48c661f7e166ed5b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775732, "uuid": "c989ddb2-ab5d-470d-8c9b-0948077c5527", "value": "T17DE4EF1EBE455A62FD0ED070CFD90A48BB628B036280AFD6579F14CA8F5F4655C8DEB0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775732, "uuid": "26175ed1-c40a-45af-9472-8f6929311310", "value": "3072:gCimSirZcsns9/xLIpt8XSrkkGcvbrcmYmB4D2d0DLwjk5sZnkZellPGM:aCyspjBLvbbrYIqwI4Ie", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642775732, "uuid": "9697a14d-51da-4fcd-b898-d0de30b6968b", "value": 718848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642775732, "uuid": "5c19c31d-6087-4039-98d8-2f4ba6a9e3ba", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775732, "uuid": "5088bdc2-9b28-4163-96ab-5b3c2abcc1e9", "value": "MV PERFECT TBN - VESSEL PARTICULARS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0efb5e6-7ac6-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1642775540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775540, "uuid": "a2d706d8-f415-4f97-a8a5-ae52e0d9bc0e", "comment": "Malware payload (RedLineStealer)", "value": "2e38d8f34ae5c354984a585ca246ac6d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775540, "uuid": "13f12e88-c8c4-4436-b26b-420dce4d1d76", "comment": "Malware payload (RedLineStealer)", "value": "62a24331bed84b85c01dff2891b0526da5e196b5a86d9d59779958782b410001", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775540, "uuid": "84df715b-6bf5-4db3-b1db-f77b17e673db", "comment": "Malware payload (RedLineStealer)", "value": "a0b3bfb6faa0723249c6b0ee8f4c5c5ae9decb0c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775540, "uuid": "afe5be33-3234-4f89-a57a-33e133e1ba8f", "comment": "Malware payload (RedLineStealer)", "value": "51f8e7e8dd3bdead4a94805d1cbb20624e012729399042dba5601423a986d433eaefacc0969f7f333cb508d19ffbe722", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775540, "uuid": "eee04986-eacf-434c-9d1a-8a24b9b9154f", "value": "T1AE35126363C56E77C25C8B325782C4FE35332C81262D4DA5AF54BE1B6AE4B80C6C279D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775540, "uuid": "8b14ddcd-750d-4312-8185-50be25cf3480", "value": "07647d46065f09a4bd0ed70e3d120b6e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775540, "uuid": "8df26c49-d965-4ed5-a358-cde593b00301", "value": "24576:ra+SUbO10O54tgkC6GjVCJMt3iGK5E8idjOOpkv:ra+ZVUr6PJM85Xice", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642775540, "uuid": "34d4073b-9157-471f-a772-a405b04d1e88", "value": 1125728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642775540, "uuid": "481d3b81-c61b-4456-94e9-784ba9e62727", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775540, "uuid": "11b280cf-71b5-4a57-ab46-d3433d4f0fe2", "value": "2e38d8f34ae5c354984a585ca246ac6d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49d07377-7a85-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1642747342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642747342, "uuid": "67f76274-e795-41bf-bb8e-de27cdc12808", "comment": "Malware payload (Gafgyt)", "value": "bdcba1bbc28618db0462a019f1c1b4ba", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642747342, "uuid": "d98ddf0e-808a-424e-9175-cc6c49094a3b", "comment": "Malware payload (Gafgyt)", "value": "63a6e3f1bbfbd4abfdb1457ba4d2d10569265ca6cba34922a5b35c6e5e195828", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642747342, "uuid": "be6890ab-86af-4b82-881c-ddea2c728460", "comment": "Malware payload (Gafgyt)", "value": "99f94c04365ae632b6ba3b565799e3f0267c9a78", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642747342, "uuid": "01c3c01a-4e74-4dc9-b629-474070a81c83", "comment": "Malware payload (Gafgyt)", "value": "4b95a1d33e597a25d85885651a606330a4335172420ebbc7cf73a1a5d8e9246d721fd93c4d09c9cf470afe813d2eedc2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642747342, "uuid": "b5a31547-860e-4d2f-8c93-2f109247c440", "value": "T19CA33A37BB130A23C0CA547212E30731BBB5D3D928FA5247BAA16DEC6F166803566FD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642747342, "uuid": "530a82ce-afa1-4c98-9abf-6640257c8725", "value": "1536:xfRuqNM5h7t/RiRt4n6phaQoRKzO6F6OXj6ufeRTe:OqN8jRiRtphaQoRKzO6F6OXGufcTe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642747342, "uuid": "a305135f-f883-4a40-aaa5-8bc5d0a6c621", "value": 102442, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642747342, "uuid": "ee58af21-4145-4d0e-864e-7420f3219e95", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642747342, "uuid": "ee3a5042-b383-403d-bf6a-f84c8d20bb1f", "value": "fuckjewishpeople.sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e6c87ac-7a8a-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642749632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642749632, "uuid": "0b60b131-a879-4544-b75a-2767403bed4e", "comment": "Malware payload (Heodo)", "value": "21fc12ef8a4a4ba5b38a303fa7e70c08", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642749632, "uuid": "18c5c25d-cb67-44f2-a9ae-c4d339dae187", "comment": "Malware payload (Heodo)", "value": "6407591df6ce61f946e24715faa6fba1b1f3221e2baf22f6c4f5a64f1ea98eb5", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642749632, "uuid": "0287b530-b573-41db-b687-3079c1b5fd1b", "comment": "Malware payload (Heodo)", "value": "5700a2231371b289eae19ce62e1a73457ee582c4", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642749632, "uuid": "6e4c7987-d912-458d-850e-e4f331dee0ec", "comment": "Malware payload (Heodo)", "value": "7e2cfa5861890e093258c3ea9fa275fe9542db29224c0281cfe5e699e43440dd7c2dcc234c016dae14df6de6b334cb6d", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642749632, "uuid": "8fb5fd00-0882-4338-9d1e-092b407a1173", "value": "T175636CA7B78299EADA0483394DB643C5B717EC104F9A43C73694F7346EB49F08D9324A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642749632, "uuid": "5f78c386-bf6e-4e23-980f-030c06d339bf", "value": "1536:bpEk3hbdlylKsgqopeJBWhZFGkE+cL2NdA8eXZiozeOgXVZKyaZpvyR1kZkJvU+:bCk3hbdlylKsgqopeJBWhZFGkE+cL2Nr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642749632, "uuid": "7126f1b0-3481-48b1-ae1e-bb8dd091b596", "value": 72721, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642749632, "uuid": "8bf80167-5c2f-44b3-9c7f-ee61b98aee55", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642749632, "uuid": "bc96bb6e-ec76-4302-96c0-463f2f700ba4", "value": "21fc12ef8a4a4ba5b38a303fa7e70c08", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fab98893-7a51-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642725305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642725305, "uuid": "b8d24ba6-6d00-4648-bbca-3793032a854d", "comment": "Malware payload (Heodo)", "value": "8510ad982100d93f2f2e73f6efa6f1de", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642725305, "uuid": "15203cca-9599-4567-8be0-7ba13bf71faa", "comment": "Malware payload (Heodo)", "value": "649143ea8e6ec1173106ac1bc3034951327ffc75a1d8324a1b80d280998e2fa2", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642725305, "uuid": "6678b95f-a265-458b-b24b-7f1a5b887e3a", "comment": "Malware payload (Heodo)", "value": "08f057ed15c17ce3abdb3c51aa48edbb27adeaa3", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642725305, "uuid": "1db420a0-141e-43de-b639-53006e779d79", "comment": "Malware payload (Heodo)", "value": "6a9d9e60056962ebac2c64e458bc92ee2d60fa364dc0bed598742904586d20ecb4c84c09d1ab086ea910e0c0de9c8c6c", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642725305, "uuid": "6b839710-823e-45de-8979-d825ce953819", "value": "T10B636CA7B78299EADA0483394DB643C5B717EC104F9A43C73694F7346EB49F08D9324A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642725305, "uuid": "742b7301-21f7-4721-9299-f283c615bc0f", "value": "1536:bpEk3hbdlylKsgqopeJBWhZFGkE+cL2NdA8eXZiozeOgXVZKyaZpvyR1kZkJvU+:bCk3hbdlylKsgqopeJBWhZFGkE+cL2Nr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642725305, "uuid": "abd4819d-8174-40e3-a61f-56b9da126734", "value": 71659, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642725305, "uuid": "bd677219-f085-4b0d-b29f-99d3cf7f5748", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642725305, "uuid": "c3f397ba-bc28-479e-8771-e25c27844469", "value": "8510ad982100d93f2f2e73f6efa6f1de", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f16958e8-7ac2-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642773823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642773823, "uuid": "523f7d43-e7dd-4852-8514-b2f7d0cdd82d", "comment": "Malware payload (Heodo)", "value": "716c3aa1e0da98b6e99cadd60363ae7e", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642773823, "uuid": "da8b6163-72bd-4564-b022-730683b55d7e", "comment": "Malware payload (Heodo)", "value": "64c6ba33444e5db3cc9c99613d04fd163ec1971ee5eb90041a17068e37578fc0", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642773823, "uuid": "32ea2a8d-467f-4f08-afbc-2ce518fc93de", "comment": "Malware payload (Heodo)", "value": "094623e555e4d525293ae7fa240bc445a3fbcecd", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642773823, "uuid": "3c37ed9d-30d2-4856-bdc7-211464527cff", "comment": "Malware payload (Heodo)", "value": "3f7b1518a4e40ad556528f5883648085cf6cfd48f6fd238ab17ce92b76cf9073f3821281f2b71518aec5d47b3b6e90d2", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642773823, "uuid": "b7ffa0de-50d7-4259-a6d9-93b985b6a2a6", "value": "T1E1E3596576B5C9F6D64403B50AD2C6FA2327FCB39E5603E33189B30E1F791909AC26C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642773823, "uuid": "62c28bfb-c55b-436e-9ed7-cf899dee3025", "value": "3072:w7cKoSsxzNDZLDZjlbR868O8K0c03D38TehYTdeHVhjqabWHLtyeGx6Z84TIJGx/:KcKoSsxzNDZLDZjlbR868O8K0c03D38h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642773823, "uuid": "37ba6dd0-c2f3-4e8b-bb44-5ee32eb8144d", "value": 144896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642773823, "uuid": "62df1360-15d3-46b2-b017-b8e0067b1677", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642773823, "uuid": "01021a95-08f3-4112-80d9-925890d5a44e", "value": "SecuriteInfo.com.VBA.Heur.Emotet.1.B18FAF69.Gen.2007.29516", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b41531ae-7aad-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1642764701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642764701, "uuid": "3eea7303-3bfe-4356-a4e9-3fcca5ba787f", "comment": "Malware payload (Loki)", "value": "2b5c1f4495e220401f03e1b31c83b33a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642764701, "uuid": "cb8d22e2-8599-4dea-821f-46b70329f4c9", "comment": "Malware payload (Loki)", "value": "669247f973870da293e534e1dfad8ca9327cf2623cc5dc108fca05b7e0d701b2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642764701, "uuid": "926ee391-8ca1-4629-a529-685c4b3abeca", "comment": "Malware payload (Loki)", "value": "892fbfea232384e2cc12890d0823a41b6c2f5850", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642764701, "uuid": "1c5315b1-23b7-47df-8e91-3716cb48e8a9", "comment": "Malware payload (Loki)", "value": "f23ecfbdaf8f8c0f4f8e1fa6411ed593cb41cad0efe7360eb04cde01243d244d31d1390c63eca1879b3daa353496a59b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642764701, "uuid": "773ee4dd-7877-4df5-8f2b-ad763bd5424c", "value": "T1F3647C10BBA0C435E5B311F459B9937CA53E7AB16B2491CB63E12AED5B356E0EC3031B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642764701, "uuid": "705d0d23-7135-42b0-b9de-bb4647f23778", "value": "0152c21ced523378d45e83b1b3a1fdf0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642764701, "uuid": "18ac2162-8c3b-4f2b-afb9-e15bb63fb7bd", "value": "6144:mGAnrZrnCHCnv1Uyg/XFzVSv4qSQ2lfc8WvLetnI9J:mGEZco9Dg/RVSvWQ2RXyD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642764701, "uuid": "09114b5b-e042-428a-878b-6acc81c725aa", "value": 336384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642764701, "uuid": "2fe7a5a6-74aa-4da4-8246-47afc2ae07f4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642764701, "uuid": "7556a245-25d9-4dc3-9c6c-cadb7767514a", "value": "2b5c1f4495e220401f03e1b31c83b33a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7f2f722-7abd-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642771552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642771552, "uuid": "acc23e98-7a4c-45c7-97a8-f02805123bf0", "comment": "Malware payload", "value": "af4b6275ef00e303d9827d78b3777a81", "object_relation": "md5", "Tag": [ { "name": "#LALALAInformationStealer", "colour": "#78DBD9", "exportable": true, "hide_tag": false }, { "name": "germany", "colour": "#0A5679", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "InformationStealer", "colour": "#E2B662", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642771552, "uuid": "5b584a13-d899-4c8e-9343-fbfec5ad76d3", "comment": "Malware payload", "value": "66ddb69926e242b770d41495e004fe72853d73fd3eb53cf404f39ef3b50a7e40", "object_relation": "sha256", "Tag": [ { "name": "#LALALAInformationStealer", "colour": "#78DBD9", "exportable": true, "hide_tag": false }, { "name": "germany", "colour": "#0A5679", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "InformationStealer", "colour": "#E2B662", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642771552, "uuid": "96019cc0-6f70-448a-94f1-8ccc117c1608", "comment": "Malware payload", "value": "9c1b664729246118b3ca0f491f5d6de552b21731", "object_relation": "sha1", "Tag": [ { "name": "#LALALAInformationStealer", "colour": "#78DBD9", "exportable": true, "hide_tag": false }, { "name": "germany", "colour": "#0A5679", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "InformationStealer", "colour": "#E2B662", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642771552, "uuid": "4b97138e-c392-4e5a-a815-c62ac58ae6b0", "comment": "Malware payload", "value": "4ed6bc240c56f80f077075bc134688aa97e1ecfe7f601baaa23619b600103c08645def2df54519dade819a997dcc15f1", "object_relation": "sha3-384", "Tag": [ { "name": "#LALALAInformationStealer", "colour": "#78DBD9", "exportable": true, "hide_tag": false }, { "name": "germany", "colour": "#0A5679", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "InformationStealer", "colour": "#E2B662", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642771552, "uuid": "881f2c5d-42c3-4344-9c84-a72f9c218cca", "value": "T14E4300143BC40B15EB708A36B4E79769222BF844C976531B31CDA7A94B933807D16F0E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642771552, "uuid": "a220f73f-3c8c-4dde-ad01-d3b64ed36c6f", "value": "48:5iL71OS11DJ1OS11DUTZ4sAy4VbQIVIc:5idp1np1gTyey0AIc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642771552, "uuid": "016e4332-bedb-4127-985a-4ac6d0392afd", "value": 57344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642771552, "uuid": "5f24a7a2-2030-4bbb-ac2b-6f466bd9c1f6", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642771552, "uuid": "adaea8ca-b53d-4a48-964f-556f2a184ebb", "value": "lebenslauf_2021_10_7.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42b146e2-7ab3-11ec-9275-42010a9c0029", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1642767087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642767087, "uuid": "3c01ac1f-21cf-47c9-aa77-60486d030c7e", "comment": "Malware payload (RaccoonStealer)", "value": "f4b3a0eb0762ffa12c24b2db739a4674", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642767087, "uuid": "3f431b6a-1b15-4cba-a117-aa8fa72f34bf", "comment": "Malware payload (RaccoonStealer)", "value": "673624ae9081ef97c65a9c68991174eca697485696fbba681e9c6981adbd09ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642767087, "uuid": "c7b0c3ab-8dbc-4075-b75a-0b4a35649626", "comment": "Malware payload (RaccoonStealer)", "value": "a81a1c38ef9b55d2cdc878d93459ac35c7a750a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642767087, "uuid": "0b8ca725-63a0-46da-95b7-eec080c5c28c", "comment": "Malware payload (RaccoonStealer)", "value": "f65865d5a3a66f843975e40f756169003d1de5921a64d3ef749aec134ac9d28669a6e53a7024cdc6b29d91e8256cec8f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642767087, "uuid": "475056ae-4ab1-41f1-8430-783ee5f173d9", "value": "T198647C00BBA0D039F5B322F44A79937CB53E7AA1672495CB52D52AEE5B356E0DC3031B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642767087, "uuid": "8006feff-afdc-433b-a584-40a5a669123a", "value": "475f7058e090be99fd15edb6d2e40c10", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642767087, "uuid": "81d830e5-2fe0-418d-88ff-746f9839973a", "value": "6144:xld5vQX2C/JJJzwkzo3//Tc/2UxWPG6UZ6ljQO/tpxN:xlT7YPJckzo3nTc/dkPG6UAP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642767087, "uuid": "692f3a67-b8dc-442d-9ff6-84f177845dfc", "value": 336384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642767087, "uuid": "60640330-7811-4f46-b8cd-f933bf8b446c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642767087, "uuid": "ff3719f7-a7a3-4dff-9e22-0d3ea97c7158", "value": "f4b3a0eb0762ffa12c24b2db739a4674.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e370482-7acf-11ec-9275-42010a9c0029", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1642779025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642779025, "uuid": "77e53f52-aa36-4154-879a-6fba91ca4e7b", "comment": "Malware payload (ArkeiStealer)", "value": "fe93af50c77fa3cd94d409045a394d81", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642779025, "uuid": "a3630ce9-d13a-425e-865e-013715a4f188", "comment": "Malware payload (ArkeiStealer)", "value": "67bf11a81845fc0304895598855656632fc3b9a06ec0917adbf0daa1973e7a22", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642779025, "uuid": "ae807ab1-dfad-4ada-b596-a528cdd93b5c", "comment": "Malware payload (ArkeiStealer)", "value": "3516043e14b2da3cf816682b5dad45634325e527", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642779025, "uuid": "8b7b4d99-61bd-4be8-b1d6-97099a6821c1", "comment": "Malware payload (ArkeiStealer)", "value": "b5abf7407addc5e9ccc97f7b35beb39a1cea69beedc185044e08c8953a0236dbeb99e010f27f1f2467b01bf6a6a4d6d4", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642779025, "uuid": "a59cbd10-7b83-4e00-b1aa-d0c16dc603e8", "value": "T1D67523C37B85EC96C02B4E358A3386B0BF37AC99A63B8B057598751DEEB47C05D81364", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642779025, "uuid": "77c23eb2-e3f4-404b-834e-5a80953a6087", "value": "c6b63ed620929916c5836a3d30fcd838", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642779025, "uuid": "8f5cd9e8-0fbf-4b68-8fc5-147374132d82", "value": "24576:qNSSHW310R59tpZPDnsdp5dphfvYt0qEOmOU7b8CLsGBSyz1+7E+glIAhdoGBQ:qNSC1DjDCnpheE5T7ASsGBlx+ihdo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642779025, "uuid": "1322fcf4-4b8d-46b8-a761-67403692b898", "value": 1572544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642779025, "uuid": "dbf24135-9a7e-4e4c-8dec-513e9936110e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642779025, "uuid": "6ab21ecc-cb2b-4d69-9721-a58caf366a59", "value": "fe93af50c77fa3cd94d409045a394d81", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "691450f8-7aad-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642764575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642764575, "uuid": "4789debf-b293-4980-be6a-b5ad80140187", "comment": "Malware payload (Heodo)", "value": "6770c9462c2b2606bc4730377fad5177", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642764575, "uuid": "08355c5f-ec57-4adb-bb84-061e241f687f", "comment": "Malware payload (Heodo)", "value": "67d57ecca6814be4d0aaed34be616849dab3885f29f009b0bb6fb74f7d258e5f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642764575, "uuid": "e41a1e64-82b5-4bd4-a58f-fac15ece82e7", "comment": "Malware payload (Heodo)", "value": "a8c8dc7ba99efcaa62bc1550dd31a41ab850d875", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642764575, "uuid": "9b162c11-0790-4440-a2d3-8d0804b5627e", "comment": "Malware payload (Heodo)", "value": "ecf620f845b236d94c072e47c75c4fd7c3a14fa35e15a80ba8096188a38f9178e14bb1b50b7cc99cdd9ac691d60df07a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642764575, "uuid": "25477d41-44e3-4b79-a8f3-3427212007e4", "value": "T162D4BF11B2D2C07AC1AF1674596393A463F9BE90DAF9C257FFC06A4F1E315828B39712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642764575, "uuid": "2be18aeb-ab5d-4ea6-b452-ac571a46fec0", "value": "24b46ffcf60dc8d39e8124f411ebd08e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642764575, "uuid": "c419450a-4dce-4ddb-962f-c09c8f3a461d", "value": "12288:kqdJaxkOWFornPmGZqnTFWbDJUYVubhesslBvQqEPO7:kOOsornPTwFWbuYVohevBoi7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642764575, "uuid": "bb40ebe6-1641-491a-ae5e-dbc09ed750b7", "value": 626688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642764575, "uuid": "2b910587-36c0-4243-9bca-f3e7b5649025", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642764575, "uuid": "e0c59195-4a44-4725-b893-5340dc4beb71", "value": "emotet_exe_e4_67d57ecca6814be4d0aaed34be616849dab3885f29f009b0bb6fb74f7d258e5f_2022-01-21__112930.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6837a6c5-7acb-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642777458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642777458, "uuid": "caa394db-edca-4f8c-a7ee-163bbb75f904", "comment": "Malware payload (Heodo)", "value": "808a2fa15fedbf76e7d7742329381823", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642777458, "uuid": "4e7d17e2-f6a2-4bde-862f-e4286c51bb9d", "comment": "Malware payload (Heodo)", "value": "67d620bdd7518e5afea9ddc65ea59587f4f46404993ff451386b85f4bb48fd23", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642777458, "uuid": "0865ac57-9fac-40c3-8403-bdd3188842af", "comment": "Malware payload (Heodo)", "value": "2368cd54ea53286a2a9f35c973b5bb16ede1a992", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642777458, "uuid": "f07f5e6a-9eb2-44e6-8b07-f2fcd34e4e47", "comment": "Malware payload (Heodo)", "value": "1c7fcd105d6fe221feefaf6b9e97f8ca30df615abc48faf8da8eda4bd053adeb6a3e4425ea7f9f63a0df234ab9a9838f", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642777458, "uuid": "28bc0ae8-f47b-47f3-8aeb-f504cab83682", "value": "T116636CA7B78299EADA0483394DB643C5B717EC104F9A43C73694F7346EB49F08D9324A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642777458, "uuid": "d85cd4fa-0db6-4364-b6b0-721b27e1f06f", "value": "1536:bpEk3hbdlylKsgqopeJBWhZFGkE+cL2NdA8eXZiozeOgXVZKyaZpvyR1kZkJvU+:bCk3hbdlylKsgqopeJBWhZFGkE+cL2Nr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642777458, "uuid": "5283d8a9-8799-4fdf-a3f8-41d6302bbc83", "value": 72807, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642777458, "uuid": "ccf983f0-e875-468c-a0e6-c79b65f1ad6d", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642777458, "uuid": "e62f9e1f-03b8-4c61-a9c0-2bd7671b29aa", "value": "CV56335629776.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1233534-7a75-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642740671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642740671, "uuid": "2deada37-b9ce-45e5-902d-25553845fcf2", "comment": "Malware payload (Heodo)", "value": "a14c0952a5e05df30aa6a94b99b6bfc6", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642740671, "uuid": "59b6ea5c-b526-45eb-b6cc-4acd2fbad254", "comment": "Malware payload (Heodo)", "value": "68ac40fe87dde757e87dd5e24f31fa32b8936e445748bf112e3b2bfd8e50c713", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642740671, "uuid": "d1218fc2-f937-4630-97ba-91ecb09b8d33", "comment": "Malware payload (Heodo)", "value": "af2ea35fc446f2f9450a480499362d2c91ded92a", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642740671, "uuid": "79871adf-4095-4ee4-89fe-12852a8bc086", "comment": "Malware payload (Heodo)", "value": "252e10ddba729cc522c13b0f627567b31b539c53ff95649f70df239d0cfe1caa13b2e3926c81d3a9e562efc3049a321c", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642740671, "uuid": "b8f9f307-ff40-42bd-9b9b-2fa42edc30d3", "value": "T187636CA7B78299EADA0483394DB643C5B717EC104F9A43C73694F7346EB49F08D9324A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642740671, "uuid": "d50f8ae3-e5ec-4f9f-8dd6-947ec0df31b4", "value": "1536:bpEk3hbdlylKsgqopeJBWhZFGkE+cL2NdA8eXZiozeOgXVZKyaZpvyR1kZkJvU+:bCk3hbdlylKsgqopeJBWhZFGkE+cL2Nr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642740671, "uuid": "b3a3c0f2-7d48-411f-8677-c8a89b6be087", "value": 72580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642740671, "uuid": "1dfabe17-d857-4a42-8a02-9dd76f120bc4", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642740671, "uuid": "16cae2fb-13ec-40f2-9f1f-42097f91ffd1", "value": "a14c0952a5e05df30aa6a94b99b6bfc6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f55767c-7a85-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1642747325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642747325, "uuid": "920d1e29-e9ec-46d4-b4af-f036ab8df662", "comment": "Malware payload (Gafgyt)", "value": "471159734e7b33fc3c98a2ba3e7793ad", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642747325, "uuid": "a6a7e628-2f7f-4003-97f8-326aabea2b94", "comment": "Malware payload (Gafgyt)", "value": "6906eaad02ef8ffd9a9551e1daf4c9a954e99cd4e8b9ec9751d6eab5dd960e7c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642747325, "uuid": "e9716e0a-46e3-4ebb-8746-07b251a2d559", "comment": "Malware payload (Gafgyt)", "value": "10ecd696fc897abe06af3b4ed36d43994e510a17", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642747325, "uuid": "f06402e6-abb8-4599-80eb-1d24fe7f112a", "comment": "Malware payload (Gafgyt)", "value": "9a82a0d8c0c75e0cc3d2a1ebab8111c0e1a7fa64038725ebd8afeb27281b555ab48aa6536771dd40b4daf2296b2345f3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642747325, "uuid": "195d4d40-27c9-4ad4-8ecd-ec080cca3cfb", "value": "T137B3D86A7921AFFEE06883310BF7AF20C7D521D626915386F15CE7585E3128D2C5FBA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642747325, "uuid": "4eb9e34c-a092-4a7f-b872-3252e4556130", "value": "3072:C/4g3Kd1rN5hZmxgA9OKdwwjF9GhsR1Ae:O9anN5hZLHKdwwjF9GhsR1Ae", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642747325, "uuid": "0a2eedd9-6292-40d9-a9f6-7eecae757e45", "value": 116503, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642747325, "uuid": "e904f4c3-a919-4e05-a2c3-55fa3635be1f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642747325, "uuid": "a557e4ce-34e3-458e-b3f4-56dc06a06557", "value": "fuckjewishpeople.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "990772b4-7a5f-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642731154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642731154, "uuid": "fc5abeae-9038-4105-a0c9-db1974f631ee", "comment": "Malware payload (Mirai)", "value": "86c18d04b0c32c87e12069a36ff9d692", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642731154, "uuid": "a974f99e-34bd-4ffd-afa6-3e1a2b523021", "comment": "Malware payload (Mirai)", "value": "698f46aedf6cb3fdac377fc2636ed56f17683eb8670fec0795e5a81ca059d3aa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642731154, "uuid": "006f8466-dba9-472e-9d10-47538418f838", "comment": "Malware payload (Mirai)", "value": "1cfb56a12db31a2f0d60c6ee2fde6c55a7440997", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642731154, "uuid": "5843d50d-3f02-4c83-8081-8636088e4240", "comment": "Malware payload (Mirai)", "value": "20b220bd16da90cd2df223e7ca20d737937acc744a26770173001bc9b7f3ff2ed267cd668ff691c62bb4ea0c6345abfc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642731154, "uuid": "e8bd7552-1068-4689-8a92-05f5f5cf07c7", "value": "T1AC337DA585BAEDA4D1544AB4BD158F3487B3E00086A73EFEE7448A598043EFCF5193F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642731154, "uuid": "6f7b73dc-65ea-490c-841f-2cb7e7230c0b", "value": "768:aa2Mewtk3JrgfEJ6HWj/nmOJddiufAPs3gsYAlO/LErC8//o909CT:aaJewtorXJddiTPs3FYAlMLEryG9CT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642731154, "uuid": "35a70b3d-1737-4f0d-a53b-1e1cbfc6d282", "value": 51400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642731154, "uuid": "8928d8e9-ffc4-4c69-9f53-e97a63b04cf9", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642731154, "uuid": "6b23c39e-9175-49ec-9902-ae071f2f68e9", "value": "86c18d04b0c32c87e12069a36ff9d692", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94562b59-7aac-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642764218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642764218, "uuid": "623599c2-6422-4e14-8f4b-529a2a2b841e", "comment": "Malware payload", "value": "14ee62fcc9163509856671400429ad55", "object_relation": "md5", "Tag": [ { "name": "193-201-9-212", "colour": "#5EC393", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642764218, "uuid": "e135b90c-cc98-4c06-a981-89cf3b19c1ef", "comment": "Malware payload", "value": "699159e695e230a48d94b6103b48940ed596d0b48fb6d936c04d86eed539cecd", "object_relation": "sha256", "Tag": [ { "name": "193-201-9-212", "colour": "#5EC393", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642764218, "uuid": "f25b1ddf-c953-4242-8f6c-7887bbb8f48f", "comment": "Malware payload", "value": "7544332b52769ca853d900669ef5e272a2ae1665", "object_relation": "sha1", "Tag": [ { "name": "193-201-9-212", "colour": "#5EC393", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642764218, "uuid": "ae4d0a83-f3de-4a3c-8270-2fc11c54fe86", "comment": "Malware payload", "value": "7ac1d3520c8c23be29f25a4257a75821add4fec94286320d2beeb7cb2e0230ce19e75ee40c308480aace24a049f5142a", "object_relation": "sha3-384", "Tag": [ { "name": "193-201-9-212", "colour": "#5EC393", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642764218, "uuid": "826c4d10-6810-43f8-b5b3-60334d03f6fc", "value": "T1B2F3E18BB1DA3C51C3F445F9720FAFB7644A9A336868A380D7BF6B47D174F001A92646", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642764218, "uuid": "82db0eca-87d6-4805-ad86-0831eea1dc35", "value": "07253c21dea4ccc980c087252fddc7a8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642764218, "uuid": "50726d5c-9aa1-476d-af4e-7509870bf91a", "value": "3072:bD7p4cx5vL2RyigBpUfoatwV6amXjc725K40A6v:bDnx1s/fo5mA212", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642764218, "uuid": "1b5f6da4-5df1-4775-835f-2d5d31ba0ca4", "value": 160256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642764218, "uuid": "cf436683-b182-4522-a260-e76458d9da38", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642764218, "uuid": "1a2ad49c-6ed4-4b84-9ac9-ad26575c3109", "value": "enc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ba20be9-7aec-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1642791691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642791691, "uuid": "cbf05c89-6467-4ed6-acfc-19553a0466f0", "comment": "Malware payload (AgentTesla)", "value": "a769d745ac3b63420387e71910b42297", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642791691, "uuid": "001f596d-64f6-49f9-95d2-0131ed5a10f5", "comment": "Malware payload (AgentTesla)", "value": "69c5945decd34fa3fc4cf665d8cc0bd2dba7e009bd7e88fbf7dfad12fe1314d5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642791691, "uuid": "e10740c7-3293-4bef-bce0-04f9ba6dd4da", "comment": "Malware payload (AgentTesla)", "value": "a6e4eae23be270596a254031bc39c64dc6da95c7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642791691, "uuid": "422a9764-fe85-4789-ba46-10b3792291ab", "comment": "Malware payload (AgentTesla)", "value": "858cc5a327b0ba624f6ecbff537befa31d1355e52aabe55a7330bc8435fc53e64b40075d4e51b810952367029f6f798e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642791691, "uuid": "007aede4-0d63-4269-b9c3-daa9fc45f467", "value": "T10394AFB876147DE66A6F576BDA96BCDC03B52B2389CB94CD80687BC30563335FE02805", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642791691, "uuid": "268ddd57-42fc-4ae7-8edc-3fb5700068ff", "value": "12288:iN45zrtgVRUXpJLGE1tn2uwBC1voAUq0uOl63XmAf6/om:E45zrtgVRUXnqy92wOq0plCXmAf6/L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642791691, "uuid": "f207b525-d66a-4870-878e-8b4868573c4e", "value": 443279, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642791691, "uuid": "bfc13ace-117d-44f1-8272-b9be9e3073d3", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642791691, "uuid": "c8c800c6-b01a-4000-80ec-10f439259b18", "value": "Quotation Inquiry.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2589fcf8-7a8c-11ec-9275-42010a9c0029", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1642750288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642750288, "uuid": "afccdfe8-8483-4f91-a137-f9dc5b912ea4", "comment": "Malware payload (AveMariaRAT)", "value": "ff04bd2c686d81f82e902d3023118f0c", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642750288, "uuid": "71067367-b79a-4f47-8462-af39ea62498b", "comment": "Malware payload (AveMariaRAT)", "value": "69c7e7d8730b4998b848f2731fa5b3db7783c390d23daebb00e02cbc5a53205e", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642750288, "uuid": "5e237971-cbc7-4557-ba8d-1e0ccb67d447", "comment": "Malware payload (AveMariaRAT)", "value": "defb6d7d72e0c25683408a15a8c5aab6889765df", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642750288, "uuid": "cd530701-306c-45cf-89ee-365b6a397c3b", "comment": "Malware payload (AveMariaRAT)", "value": "dfc423ae2cc869a8d84a149a6864d6aee6893923d49e4bd5d897d948749be4da31d8d10a7e213a0cf03f70d9b7a0d168", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642750288, "uuid": "80cf38d2-57d5-4fac-bd77-287c5d532052", "value": "T18435AD23E2914E33D57F17344C0797A5A827BE012E68B6CA7AE85E5C7F352817825F83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642750288, "uuid": "0855ee2f-aec1-4f75-8d09-c5c2938ce3e5", "value": "7d432c16623339e8ab5ce868f795be3f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642750288, "uuid": "11c75ab3-80ec-4845-9102-0d7fad643420", "value": "12288:AJ2cF5mwV7W+AsAm/CrA1v+81yOgikqqyWEzzy7T8YQ0VJRX4tKa/B1HoGW7T3b7:gB97W+rAm/Ck2Y4y1GZxNXranXKT7vT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642750288, "uuid": "6a046b6e-9a70-4204-ad26-17283cf81a5b", "value": 1093120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642750288, "uuid": "59c751f8-d8ac-449f-99e7-5fed197ab377", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642750288, "uuid": "e82f5690-b844-4b7d-ac9c-4a3d696de57c", "value": "PO-RFQ 372842997_Recall-Shipment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26b99d7b-7a9a-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1642756303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642756303, "uuid": "f26aa426-f550-4cf9-8dd6-0ae9387e6282", "comment": "Malware payload (AgentTesla)", "value": "fc6845edbbbbc68d37d1af846a652858", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642756303, "uuid": "9ffea5a0-ae38-414e-9964-dcd4590e99d1", "comment": "Malware payload (AgentTesla)", "value": "6ad7342653f4c254b3a497d7e34ef9d6f1af0d0550a0e8225804adbbe2f97d9b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642756303, "uuid": "30609480-024c-4dad-8da7-35aed77abd4d", "comment": "Malware payload (AgentTesla)", "value": "d321e29c1e44ef58bbd390a5714d1442e262bb25", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642756303, "uuid": "ee6e7cc0-8b52-4fb0-8790-3ffbe8397430", "comment": "Malware payload (AgentTesla)", "value": "fb9b06cb6170c54f915feb7184f81f09794c33a1bfc6f531f14f0eb9d75243ddbd8480b4cd5e731ea75ac85e3f34b956", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642756303, "uuid": "33d272e2-dc8e-4e13-8f9d-71b90d74cc19", "value": "T15525F1377693FCD52BBB2C00B1842E692DA03AE787209728F6801DD265BD560DF9D9F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642756303, "uuid": "08c26580-f7cd-4014-a8ac-19936022aec7", "value": "24576:5e9ULbIaVWe4xlf4zpvMfRDp28R8zohWx:5vNg4zdFea", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642756303, "uuid": "e4940443-d211-49db-a7e0-3d71a9e6a250", "value": 967614, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642756303, "uuid": "ae9f189c-494f-4a57-b386-e02d9595c661", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642756303, "uuid": "5397c030-6ce6-46b3-9da8-8ffb8cc81f2d", "value": "Documents.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "685fb3e5-7a9e-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642758131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642758131, "uuid": "68ae6e50-1fc3-4b89-8098-4494fda50b9c", "comment": "Malware payload (Mirai)", "value": "facc94a16d0a868042ff04b49b162e7d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642758131, "uuid": "58bec7ae-f064-465f-a5e3-ab59f657201e", "comment": "Malware payload (Mirai)", "value": "6be723513966ce1275a4d000de44dfa35ac5d288b878e0b08c340cf1218d0977", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642758131, "uuid": "dba1c976-1509-4d24-9e08-790472815b5a", "comment": "Malware payload (Mirai)", "value": "863a12cc4dcee99d7cd14b819c2d42e54cf68c67", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642758131, "uuid": "de5f5ee1-6481-49f8-b86c-f46e23a2e4f9", "comment": "Malware payload (Mirai)", "value": "c6f9fd742869f582ea799f4e0c5df5eef0fa8ce01d63b779e9bdd32d6aa6197564ae553e54ae0691b26178ac0ccd26ff", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642758131, "uuid": "999d7db8-02f2-4a28-ac85-f165e0caa1b0", "value": "T13003F78278D29A26C2E4637AFA6E018D332277A8D1DF7623CD216F1477C5A1F0D77A41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642758131, "uuid": "ccc9f8f7-7ae4-4b95-899e-bb91507192dd", "value": "768:OstF3nOGtG1gM3Py86Y65pxLZqmYVaTHkKr+ltKekm9qPN:fnOfyM3snYVaUtKXm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642758131, "uuid": "d0b13b9a-9ff6-4f33-b35e-c51bda5a91a9", "value": 39628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642758131, "uuid": "0bbbf68b-8493-4048-9ff7-9fd10f331ebf", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642758131, "uuid": "3cc7b2cf-6267-495e-956b-6afca6362ce5", "value": "facc94a16d0a868042ff04b49b162e7d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcf93db6-7ac7-11ec-9275-42010a9c0029", "comment": "Malware payload (RemcosRAT)", "timestamp": 1642775990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775990, "uuid": "557990eb-1e95-4af9-9b26-3d692fd09868", "comment": "Malware payload (RemcosRAT)", "value": "4e54fa32c59fe13dcfece905b30d9b1e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775990, "uuid": "d93a7b66-3439-44ea-a1d7-9c117944df07", "comment": "Malware payload (RemcosRAT)", "value": "6c1e347274ca3a36f91b70a7cc2dd5fa4fdab50e96aaf43cd33a750b9da16184", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775990, "uuid": "8a0f2851-30d3-490a-afbe-8e26725166f6", "comment": "Malware payload (RemcosRAT)", "value": "18ca6b12db1177cfa60729e22105b1bd7f2f9ce7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775990, "uuid": "241a83cd-d5b5-473a-8356-a9ed7bd31321", "comment": "Malware payload (RemcosRAT)", "value": "67f932300551f5ccac45c44a037216e6f72646cbf92105aaeda9965a605c14696cfdb05254b205452797f3f7bf548c4e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775990, "uuid": "ed331bca-aa56-4aa2-b5bc-308bff8600a7", "value": "T16EC4D010B6288D43C87C04F914564DD02B7ADE07A859EBCB7DC17AEE5BE17C66B2318B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775990, "uuid": "2c58c086-3e68-4849-86bb-5001b010c06e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775990, "uuid": "97c622c0-a32d-4ced-a768-e3765fc340e5", "value": "6144:SythUUO7TiBOpQymjZUw7X1X07d0b6vbS4Cvi4SZQLa6q6+iDX6vYbJmI/ZYPGue:SmUUOlpQ3j4RY6Dgq6Fq6+ievYFfh0O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642775990, "uuid": "266c407b-d82b-4d55-8007-187b53a02e53", "value": 546304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642775990, "uuid": "c422c57a-d0f5-4d72-bc91-1808ae3dfa66", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775990, "uuid": "927c5851-5cae-4056-aa63-8cfe694bb63a", "value": "4e54fa32c59fe13dcfece905b30d9b1e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5a3b936-7aa7-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1642762207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642762207, "uuid": "2eff4895-6e19-488e-8886-4403592bda2e", "comment": "Malware payload (Loki)", "value": "5d7706265984dabff0352776199537a2", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642762207, "uuid": "b4a72aa7-749d-4638-9888-b26079671f7f", "comment": "Malware payload (Loki)", "value": "6ccb291d67f48474087ecef56c05e1e4c20ff09ab26bed32ac0bf232e7b4cc63", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642762207, "uuid": "badbf333-4d5e-43ee-b6ce-3babc80c3555", "comment": "Malware payload (Loki)", "value": "0061ab0621fcf9b9a4d0aa3ebad461c8bb73e4dd", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642762207, "uuid": "e9d1f1a3-a039-40f3-abd8-c14b44e15978", "comment": "Malware payload (Loki)", "value": "4e9b76853bdd8ce25b6ccf63a72e9c3e5164a27ea1b16d653fb264d862376fcec3936446adabcb4d7abbc9447a4e9da3", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642762207, "uuid": "ef669e73-b0f6-46d3-9f86-f139addcab69", "value": "T1FF14025E7D2A450BE7BB36342E8C8448870CDF70945DA546266B346AC3F2262EF7235F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642762207, "uuid": "42485129-73ea-4677-b79d-fef93d87a76b", "value": "3072:yHbcunhWlGSxOGMFK5YG3LoY5tbBmPCHTSxxwkQdUedEFDPBcHsAL0VK:mQKWlGeOGH53LoY5BVHTSxxlQdU7DP2v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642762207, "uuid": "e9af2d41-d882-46b4-8b97-bc24ccbff1f1", "value": 191656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642762207, "uuid": "5e11727a-0324-4d7f-8407-f2861412d4a7", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642762207, "uuid": "421bf511-b286-4d14-ac75-fbd7878da200", "value": "USD53,511.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82f6c5b2-7a71-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1642738848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642738848, "uuid": "3eaa05b4-8886-4cc3-938b-406257085279", "comment": "Malware payload (AgentTesla)", "value": "8b33b1af27ff5758ebcb165eb0a5e16b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642738848, "uuid": "32e4a961-893f-4359-8c89-000d755e2fd3", "comment": "Malware payload (AgentTesla)", "value": "7008ea692d929cb39dc75735c2020128de663f205441a1dc9eb04727e2058226", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642738848, "uuid": "7a002e94-129c-4ff5-afde-0acbcf970935", "comment": "Malware payload (AgentTesla)", "value": "7e2da190088c08c90d8c7988ca1ca3ddb21a96ee", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642738848, "uuid": "c3ab0b2d-72cf-4563-bf46-26a6624465f4", "comment": "Malware payload (AgentTesla)", "value": "b3ae64bf922db952b292314aa426edfec6bccee03087ef286034d6be0886bbdc5d057ca4b4582b32ebd744be0e796308", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642738848, "uuid": "3af11fdf-2d89-4b5e-ab9e-e26fbf7d1309", "value": "T162E4DF5133F98B45C97E87FA48310090177ABA1AA824D76F6ED1B1DF0C72F819B26763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642738848, "uuid": "49655fd7-2abc-48bf-ad56-2b7f384720af", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642738848, "uuid": "c718fada-da82-4a74-853b-694344efbcaa", "value": "12288:uHaSlpQ+GxP4cpIurgqVOkgoXFebxMtMsq6+ievYF:cpQlPPIcnVOkVCx4M36+ievYF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642738848, "uuid": "c5063c92-a0a6-4235-8830-c842a90bccd4", "value": 720896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642738848, "uuid": "04013347-fbad-4c38-8417-74b8b25ebdd8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642738848, "uuid": "e46c57be-b2f8-4c15-883f-1d4a9ab85821", "value": "PO 9420206.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae424a40-7aab-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1642763832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642763832, "uuid": "759c6d3b-bbd7-4dd9-915a-633d3d9e0ef5", "comment": "Malware payload (Loki)", "value": "0b006c60f1718b6ef908347ca6b9bf0d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642763832, "uuid": "d1c72fd5-b3cf-4994-926f-56c9a415feec", "comment": "Malware payload (Loki)", "value": "71057920dae201fc638e1c016ff5748c21ccead183dea78c41b06f132e1058f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642763832, "uuid": "98db732f-2b20-461b-89d1-87f9bb57e985", "comment": "Malware payload (Loki)", "value": "840fb9e0673735126defab3ef30e04d4c2f1bb0a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642763832, "uuid": "8a9f2d05-4f44-485b-acaf-6203e14bdb4c", "comment": "Malware payload (Loki)", "value": "1dbe7f9c5cda759804c1be5b7942baa95ed81b3dc0c1ab016717cac720e906c9259611a2c40aa82d6f52c7756d973e67", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642763832, "uuid": "4aff5fb0-c48e-4f57-818b-772997a11cb3", "value": "T11964224830F2D98FFBE61B7025B2E7A582F6AF4419850E17CBC43EAF15141C79A1671B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642763832, "uuid": "d2f3b5c1-20a1-4283-aa86-8c538ff0cb47", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642763832, "uuid": "5399782d-8f2f-4f6e-b901-65124373e453", "value": "6144:owxj+vtCXoxQiEFRWIsBsyNUrBW7Muvu3jbpUnUQRwI:sl2dRhgNCBq4jkUwwI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642763832, "uuid": "c7716008-b491-483a-a6eb-901a6a071049", "value": 322835, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642763832, "uuid": "697528c5-b23f-4b69-81e1-e7703cf1ed06", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642763832, "uuid": "4d900782-8f15-4f70-93e4-ef12cc777546", "value": "0b006c60f1718b6ef908347ca6b9bf0d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3757fd4b-7aa0-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1642758908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642758908, "uuid": "752be4c7-7ec1-4070-8354-7605b3669f96", "comment": "Malware payload (Formbook)", "value": "0da6c44a23c1ee34c1d79ae4abd8547c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642758908, "uuid": "5df4c293-a89d-44b3-957a-01b24092a1cc", "comment": "Malware payload (Formbook)", "value": "71bad0685e5b2447a8dcdc960ee2930ad5ec4910d5d449040fb52cb9754df2a2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642758908, "uuid": "01c3226b-5b32-4069-9346-77a366882318", "comment": "Malware payload (Formbook)", "value": "b8e668d2d9cad532227f0c4ec8b25ca5d770684e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642758908, "uuid": "e23114c7-2259-4844-9846-6555a781a036", "comment": "Malware payload (Formbook)", "value": "0825902d83d815554ac318210e923b650310d1f9ad774cf7a57332ff9e779b9fca1b5f7c90de871be630d425660b3eb8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642758908, "uuid": "f501104d-4753-43b9-b9f5-7acfb59bcbfb", "value": "T132642329A1C3C977C45B293164377F6AD7FE71092212C30AA7A41FBE262749B6219372", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642758908, "uuid": "610c2da6-27be-4756-9aa1-57e2f6452352", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642758908, "uuid": "13ea4515-bcfd-4e4d-ad51-3c4b6d8353a2", "value": "6144:owmYj4Tt4AMO3rgD2oBE7oUAMetNVAPyoFpk14yotj1Kpc+ONHCn9YO3Uy8BUN:KQ4TaAMObVBletPAheQKpc+Ou9YCAUN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642758908, "uuid": "e36e19ec-9a70-4fe8-a6c0-01eae12a049a", "value": 333666, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642758908, "uuid": "1744be7b-cf8d-464f-91bf-f57faf5aff36", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642758908, "uuid": "0b6a1ed0-80aa-4f0b-9062-a34d1a9fe206", "value": "0da6c44a23c1ee34c1d79ae4abd8547c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a92085fa-7a8c-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642750509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642750509, "uuid": "4eeb8f2f-2221-4161-983c-f9df6c7da7e1", "comment": "Malware payload", "value": "b510392f55b7c0ba78a334038c6353d1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642750509, "uuid": "d76bde8e-7b86-4dcd-9727-a087dd0c80fa", "comment": "Malware payload", "value": "723abb6b0dee5d6f012a695ca483478595a08ba3b0dc73ca2032c8d4699605cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642750509, "uuid": "f9ff9f8f-ebb9-4c9d-af8e-ef83d4cb34d2", "comment": "Malware payload", "value": "4ad876bc689e8e46b5143696e47a9f4ee7081065", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642750509, "uuid": "2058a72e-42d1-4f4f-bf63-07642d082499", "comment": "Malware payload", "value": "a80577d3547101b1ddf7563fb3443d5e6899f0c571fc1231464d5e948da752af06a5910d771a840e6e67603ea3fa93c2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642750509, "uuid": "d1af2d63-a7e4-48f5-a0b2-58695321ee73", "value": "T13D050235BF916315C74F8BB48D7DAC1063B8F98A281CCA9E89462DE55338BC29760737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642750509, "uuid": "c8ab058a-5f90-4e5f-9948-e94d10308be9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642750509, "uuid": "f7390d9f-455c-4a35-9826-f81b5153d68f", "value": "12288:UouFnwk19WfXGI9WfXGI9WfXGiiiiE9WfXGd333:UouFZefXkfXkfXMfXk333", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642750509, "uuid": "ffa3dd86-41c0-4700-b77a-4f099f397aa8", "value": 832512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642750509, "uuid": "4fa20f32-5128-41f7-b481-d10544b5bbf1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642750509, "uuid": "7ab81b16-d803-42e8-91be-da7a048c6c84", "value": "bank-in slip.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7d8a816-7af0-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1642793456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642793456, "uuid": "e539e09a-e5da-4b2f-acae-30a3f46affff", "comment": "Malware payload (AgentTesla)", "value": "a2ed42c4b5887423ed1680a75ae8c716", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642793456, "uuid": "5292a9eb-23b5-4bf7-aab2-ac5636f8b07b", "comment": "Malware payload (AgentTesla)", "value": "7291efc2174f4ad5ee7a13579fb5e12f43fd5b27d610de22c50a152e540e92d9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642793456, "uuid": "f96956c5-e6c7-41e1-b8e3-7a1dd95b302f", "comment": "Malware payload (AgentTesla)", "value": "87de1335bc7bf11aa8b5fcb499cd9b0058abcce4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642793456, "uuid": "828ac26d-c707-4bdf-b28e-6acdc07affc8", "comment": "Malware payload (AgentTesla)", "value": "bc62e81675e024a0c25c18f426e833b1492e86c7cd6ac4e9297cde13a2b9b7b4c7ff9199cc95b09d967498a2067e8d8d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642793456, "uuid": "25ed87c6-e9de-47ef-963e-4a0ac102b9c9", "value": "T19AF4E04032F98B01D9BE8BFA58754090137ABE5AA835E31F5DD1B1DF0DB2B819B26713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642793456, "uuid": "873bdb62-5300-4004-b89c-b377e7c6e332", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642793456, "uuid": "9f6d3819-34a0-44e5-8728-2bff1d053b13", "value": "12288:YwmCDpQ4Mwhj73+LydiSIVI6okKoAKOM50e/3q6+ievYF:jpQ8qLyd+oi50e/a6+ievYF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642793456, "uuid": "9a3c7ee0-a8c4-4de2-baa6-b9c4dd7c6623", "value": 724992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642793456, "uuid": "026857d4-fcef-4f1a-90f2-56cedb136c16", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642793456, "uuid": "b3a49b2a-6e51-4808-b7a4-551b21abb8c5", "value": "a2ed42c4b5887423ed1680a75ae8c716", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b686ab1-7acc-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642777839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642777839, "uuid": "d1229fa8-6caf-4aea-bca7-dd6515db8ec6", "comment": "Malware payload", "value": "956d9a9e550cca451c2f56d896a70c4d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642777839, "uuid": "d0eae8c0-8a89-47cd-bc7a-d24862457f9c", "comment": "Malware payload", "value": "742f9f3fb0fb705d4363c00a685e8f2598cabbbeffdb1afc5a304b8ded7fab0e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642777839, "uuid": "efc1a75c-46da-4fbc-afe9-a5fbcec1a9ec", "comment": "Malware payload", "value": "d54871088c5781109af1fc7b593cde096413b718", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642777839, "uuid": "69f997c4-6a38-433f-90a9-a96aa84add94", "comment": "Malware payload", "value": "cced73c88a6cb69ac06ad67883c937c8a599b6be632b8b7d3596249681d7d4be2bbf28881f7ff6b89800232510953cca", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642777839, "uuid": "35453d75-cbe9-432f-bc12-9cfcd0dc592b", "value": "T15F25E1673E808798CF5E46F5961A884033F8DCEFD908D60D5F853AD25BE4BD24A2172B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642777839, "uuid": "1103549b-0081-42fe-bd33-bcb49c642185", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642777839, "uuid": "b74452b5-0da4-4f8b-9498-4070fd66a8ec", "value": "12288:Cb1/119WfXGI9WfXGI9WfXGiiiiE9WfXGd333dv6nnjqKoe:CbTefXkfXkfXMfXk333d6nnjqKoe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642777839, "uuid": "48ee0d3e-0eb3-4967-90f6-eb0279764b7e", "value": 1056768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642777839, "uuid": "da25c9bd-14d9-4280-b017-d9af72dc830b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642777839, "uuid": "087af578-bd4e-4ff4-90f9-67e25e409a19", "value": "956d9a9e550cca451c2f56d896a70c4d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "837bc70b-7adc-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642784805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642784805, "uuid": "687953af-b3b4-4529-bc16-f3dd9cbbd4ea", "comment": "Malware payload (Mirai)", "value": "476c135ee0374fc4b69b1630f8570030", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642784805, "uuid": "d45c8973-c796-495c-a54d-8ec05320eb40", "comment": "Malware payload (Mirai)", "value": "75f00e31f22ad053ae30ab44ab7f01150e3d91747789e92c1396c471953e5029", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642784805, "uuid": "fc349ff7-6e8d-4987-af6b-3f66e532b0cb", "comment": "Malware payload (Mirai)", "value": "f25acb712a65219b2c232b49f4e6f0f9a4571237", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642784805, "uuid": "a34330e0-0876-4ba2-b938-8c98e4946018", "comment": "Malware payload (Mirai)", "value": "4ae7800ecb1a7ddd34fc7ccea3109006db9c1a554f0ebbf530e34fbec1fd2572f8acde2ea45233a3dbbeda2f8e23373e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642784805, "uuid": "93256101-d5e4-4694-ab14-5e08c6ec7641", "value": "T1B623F28A9465EC329C202D3B192840CFB6CD2F708A7917AA6175B54C3EE17430BFDE1B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642784805, "uuid": "a2f24713-21f6-42be-9fd8-9a920a3f1156", "value": "768:ylgdDvmlPrJqCP+K7wga1Ejaka0NzwRqs0atf7esv1HScfh3fzaI74F9q3UEL11N:yluDvmxrJqKsr16lNMRltaUfMYL115gO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642784805, "uuid": "70929174-c852-4488-9c96-324a40b1e62a", "value": 49088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642784805, "uuid": "4840193c-b111-4f5b-a52c-6013ecc5e1d4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642784805, "uuid": "9a0fd533-1eae-4b8f-8650-f46bbba5b67c", "value": "476c135ee0374fc4b69b1630f8570030", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef276b06-7aa7-11ec-9275-42010a9c0029", "comment": "Malware payload (GuLoader)", "timestamp": 1642762223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642762223, "uuid": "44433835-0442-4570-bf9b-9b3ef9b04238", "comment": "Malware payload (GuLoader)", "value": "4aae6390327810b9cb4055320ea85c31", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642762223, "uuid": "559aa4e5-88b3-4d0d-9ac8-d4179c51a448", "comment": "Malware payload (GuLoader)", "value": "7830f70d3c66ebdb8bcd854c46efd02c4689fd952f0f701029b14c2c37ee1bc0", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642762223, "uuid": "e7c1a62b-e152-4662-bbd1-6c0da0d9ac66", "comment": "Malware payload (GuLoader)", "value": "aec6f3bfebe0e92c2d9d16c2fc50e7ab06349a8a", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642762223, "uuid": "1e1d0d9c-c15a-41a1-ad16-33856d7f265c", "comment": "Malware payload (GuLoader)", "value": "bf2a020f71ae51f844be8f7530d14a8b107852faea8685a4285671f6467d4e6b5747927a82b781351a68ee563fb167e9", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642762223, "uuid": "42715ec7-7bf4-4502-bc43-4dd75ac991bf", "value": "T17304129D3104B550C577F8B8A12884EA7E53FF79AC73C70BAA8AB72468FB1054439D2D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642762223, "uuid": "002e2be6-80f1-48df-86a3-ce078def3f32", "value": "3072:VtR6u66KGemWbUuzh8IVvk36xjGaoyMt2+Rza3ZYsLY0jcDHs8KVois7/vckKDW7:h69hGyUuHV/jjob25RYWcDHsnNsouN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642762223, "uuid": "a93efdb0-a37b-4b49-a98b-deb87afeefa6", "value": 187256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642762223, "uuid": "abdc14e6-9a5a-4982-a6d1-282e0aa2d4a3", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642762223, "uuid": "194949ab-1fce-4201-8b4b-bd39e4119899", "value": "listing new.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e033716e-7aa7-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1642762198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642762198, "uuid": "6bd0e722-3675-413f-8e64-85d4128b7ff7", "comment": "Malware payload (Loki)", "value": "9a57a67b55def09ee308eabee97a0345", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642762198, "uuid": "33535193-d9ee-4dcf-86e7-56cdaf33bbd8", "comment": "Malware payload (Loki)", "value": "786cea3b50aa0d3db0063a3c25d8ee4a5bcb24c3608c45c60bcf62c41206dad1", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642762198, "uuid": "65dc6db1-e53c-408d-b079-0978328c927d", "comment": "Malware payload (Loki)", "value": "39a6ab5863890d3c6c1e3c4d73c8f0f95b5aea9f", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642762198, "uuid": "8e46f2c0-0d7a-404b-8b0f-9e43a8870617", "comment": "Malware payload (Loki)", "value": "82f97adbcd2c89c9df52a2429ec74124f0ab9ef4078cbb9865aa5b2a69c7ef492fc06572c42d737df78de4f25d5af7bb", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642762198, "uuid": "891a29c7-41ee-475c-ab97-f69bf4ab2218", "value": "T1CC0412F5BE6BB29DD02BB075236D0A51EE25FC5CE64E8D52F4C735BE18B2C720019A12", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642762198, "uuid": "6eab9e31-b706-4655-8bf0-e942eea0cc88", "value": "3072:yht+GlA7siKtQG/Q6tkK+qRkqJDFEcasz8vpcYkOISBLyN4oDOy13:anlesTtQAF+nBcaszotBLyyy3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642762198, "uuid": "d769cb1b-a3d5-4338-8e72-32e8c97a047f", "value": 187384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642762198, "uuid": "860318b7-d3aa-4a57-8ddb-d6e74ccbd758", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642762198, "uuid": "b5948bbc-236d-4780-b8da-d023ccd4db49", "value": "Draft #BL, CI, PL.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2997f28a-7ac7-11ec-9275-42010a9c0029", "comment": "Malware payload (NanoCore)", "timestamp": 1642775635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775635, "uuid": "d419b414-3470-4db6-98f6-9e908cb3ac16", "comment": "Malware payload (NanoCore)", "value": "da3cb7622834a14916d498c1bd8a7827", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775635, "uuid": "0ca8514d-6e31-4062-adb0-92dafdefd40f", "comment": "Malware payload (NanoCore)", "value": "78dd589c56a6d216f597f149bad69d510a88fb3257b4a643a7250381126d963c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775635, "uuid": "941e624e-3f4f-4643-bf1d-fbdab3a3c167", "comment": "Malware payload (NanoCore)", "value": "2179db1ae11496ee06b62dff337986316dd298ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775635, "uuid": "47959ca3-93a6-42a6-afeb-bda7cbe83f9d", "comment": "Malware payload (NanoCore)", "value": "69d89f93ed13d436307990bb2c42d3217212f5d17c3a104fbae19f5dcc86f12918d72c820f2d53db2d88d746876899b0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775635, "uuid": "7ad0d70e-91d0-4af5-a654-cfab34818593", "value": "T14E55D03261055FDAF53FE3358321752687F65A2BE725E2AF3D9064EB0880F4A8367D12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775635, "uuid": "088f438c-7cf5-4130-b891-1c88c754c5ac", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775635, "uuid": "d56c1c00-192a-4601-9661-7726102c88f5", "value": "24576:KeZkjA8sCUrevlzuC6+iDUBQ2Kq1gekgwe0+U:lPCUczj/IYtKqq+F0+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642775635, "uuid": "8e424132-13da-4813-b69e-0ca3d33bb043", "value": 1345024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642775635, "uuid": "e4184381-370a-4953-90c0-3711cc49ec16", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775635, "uuid": "bbfa550e-bfa0-48ac-8a71-baa31794e678", "value": "da3cb7622834a14916d498c1bd8a7827.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6287003-7aa6-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1642761778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642761778, "uuid": "452bf8b7-6cba-40be-aa00-b162ed88cd22", "comment": "Malware payload (SnakeKeylogger)", "value": "7e0221bdd4e5e3e90d1f7acdd37bdef5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642761778, "uuid": "8afa3c48-eeb6-4026-8ac5-94908bb58631", "comment": "Malware payload (SnakeKeylogger)", "value": "790c65e0ac00a4ece426fafb0fad2159bf8598be0d97ce9e026719975947e78f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642761778, "uuid": "c044be79-edc6-4349-8533-c68a96284191", "comment": "Malware payload (SnakeKeylogger)", "value": "e24d15d00817ca60304679c2de572a50c9370460", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642761778, "uuid": "01322b04-6904-4436-b419-1c6aa20072b8", "comment": "Malware payload (SnakeKeylogger)", "value": "c5e16be510ecc1088a08e8697d594478bc134bef78fe2a64ea5822fe9c63168baccc0e2428810fa4587e2b0548386d2c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642761778, "uuid": "0df04191-3685-45e8-9aa6-cbc351144f25", "value": "T1EC94591329EE66DAD12E46F09D62F34C066B6C0E1831ED052C6BF4DA0635B2146F3A7F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642761778, "uuid": "39f1f268-8fd3-42de-a4be-b6cf3433789c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642761778, "uuid": "9336a855-6ff2-4dac-bb00-71999b1afa86", "value": "6144:bT1TUtvJ/xalxWnKd51jhID2nLuHoI4f2:dTCFxgIKd5KoI4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642761778, "uuid": "e778a55e-0eab-4f0a-a63e-5c7d0b5d4e9b", "value": 408576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642761778, "uuid": "29e3b150-9945-4426-a707-6bb64c3ede9d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642761778, "uuid": "5ade9d32-dbcb-414b-b462-c4087610edf6", "value": "New orderpdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a71ac31d-7ab8-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642769403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642769403, "uuid": "96008356-1e0d-4dc3-8d88-f3de75989058", "comment": "Malware payload (Mirai)", "value": "5f71914a0df4a6fd4fcfbe24ea5629dd", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642769403, "uuid": "538f3537-755a-49f4-96a7-589988c4843c", "comment": "Malware payload (Mirai)", "value": "792e4eb27a14033a48e6b8116d67f8a37c63f74a2fded3fec42fdb80d6e17aca", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642769403, "uuid": "4c24bfbd-9a16-4c3b-aa4f-2b792196221a", "comment": "Malware payload (Mirai)", "value": "f4d0af0e06bb6800286e8c68d2c8795659f64c2b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642769403, "uuid": "0ea7852c-1bcb-4a17-8d7b-a1bfad8d9dc0", "comment": "Malware payload (Mirai)", "value": "80ccef9d4713e5bf1ac2a76cf213c93b131a2aa3c16116195b6e41e8a694f7794a5eb8128880a9ed1536b8f04274cba0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642769403, "uuid": "84bf92dc-a90b-4368-8f88-39e40fcae529", "value": "T19A330234A678F2B02DE0EC74DF18CADF551101B2E5E834B4A117971E3EDA914ED54EC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642769403, "uuid": "de791ce2-f7c2-452e-87ed-2e96c542f2b9", "value": "768:AcidfHINzR62/Ef8eK0sFnIX2Z3qij3S0fz0H4yx9q3UELt41140ORu5u5rgGXFi:1RpR62C8L0SnImFqiDVL6114phBLV4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642769403, "uuid": "ca68cf5c-8221-48d8-97b1-ff0a387ce030", "value": 53588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642769403, "uuid": "361e756a-79c6-4a2e-8ef4-6bd8718fb98a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642769403, "uuid": "0a6139ca-709c-46d0-905f-1c678d638eaa", "value": "Tsunami.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25eb7687-7a9a-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1642756302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642756302, "uuid": "72108ab7-3094-4b90-a9a3-b86c73e9fc73", "comment": "Malware payload (AgentTesla)", "value": "d49cea249cc8c48c0f62e76fb2dfbd62", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642756302, "uuid": "41cda2a5-273b-4d3c-a5e9-a9ea3b64355a", "comment": "Malware payload (AgentTesla)", "value": "796b0134e4b1fc3282ab2c2193bb0c2e3e8b5a4376b06bce5bef4c99fe829b55", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642756302, "uuid": "e0ee8556-b73a-4946-af4d-f38d8ec77167", "comment": "Malware payload (AgentTesla)", "value": "b9aa87e218630527734c07e0dfc6dfb1d34564c4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642756302, "uuid": "31fd0022-3ef2-4b6a-aec2-00e977417238", "comment": "Malware payload (AgentTesla)", "value": "ff06a36ee695d95165fabca3071632a2fda3c1132e7b3fdb6650e5a5f12c0a3e599dc4b2826df1a134b4e7ef60c6fb05", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642756302, "uuid": "553ec193-9167-4af1-b266-32ee728e10ea", "value": "T10A94238EE783D0686AF67FB5E8E093E053F4FD5110DBEDFC45E500698AAA4167852C23", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642756302, "uuid": "dcc39ae9-f305-49d6-aadc-a46e1ebac00b", "value": "12288:lvjRcseZkDU3KV4chzV6OE+lpdhm/pS/N:tjnGkDsK4LOJzZN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642756302, "uuid": "0577f98e-da56-4efe-a7ca-30f74e18a077", "value": 420327, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642756302, "uuid": "051c0866-da0c-40fd-ad6d-cb44d7fdd1c6", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642756302, "uuid": "b7b24833-18ad-4a27-b2ca-9e9f4a6f1103", "value": "DOC.r15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e62f1721-7aab-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1642763926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642763926, "uuid": "336cb051-d2b4-4910-aa4f-4752b510d083", "comment": "Malware payload (Loki)", "value": "61ebf514943a7bf08fd5c5ae0019e0b6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642763926, "uuid": "828e2ab3-6009-4561-93a8-903838f40066", "comment": "Malware payload (Loki)", "value": "7a0a852b98b6ab642c2c3017510db837d52091d3ad495d4a69db6e7bc172c0e0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642763926, "uuid": "47856922-25e8-4ac7-9230-ba0d2815cb2e", "comment": "Malware payload (Loki)", "value": "73c8d5d237859b55b3a37784864d35607aeb2e67", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642763926, "uuid": "10aa3360-2d74-475d-bc50-bd23e0b4bc7f", "comment": "Malware payload (Loki)", "value": "d392e8b326317ee9780991fda2cc5579d2f71965fc4cc6271fa8ebcace1720cca74f55d78a75f48c376cd0dbb8cdd969", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642763926, "uuid": "8888798c-5d7f-46d3-b078-6420e96364d3", "value": "T11D642349E9D2C9EBC617493646B1AB3EE2FFDE121B85000B0F9C1A557D6B08B851738F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642763926, "uuid": "59e3e13d-a7c3-4c91-ae83-42fb7a88a8e7", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642763926, "uuid": "8b519fbc-cf51-404e-8020-65f089f25557", "value": "6144:owDuBae/aXdAhoRYFlxXgWLGQro9zyfpmhervCoxn5SQbnPnZ5nFffIEkiCt8C:vuBZ8LRYzpgGGiemffCy5B7nhXtS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642763926, "uuid": "4737e356-718f-4950-93b5-12d3c6768acf", "value": 324062, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642763926, "uuid": "d859d084-a052-4c28-b652-3a069abb41d7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642763926, "uuid": "048f5d70-eb9d-4ca3-8853-65521a4e2949", "value": "61ebf514943a7bf08fd5c5ae0019e0b6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecba7e49-7a76-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642741173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642741173, "uuid": "7cedd33b-2f40-405f-961c-21f821c55ec3", "comment": "Malware payload (Heodo)", "value": "4eec78ff78cd7f80a50ae10ca92e9d3c", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642741173, "uuid": "1e6043a1-755c-4ee7-8e5f-4ba9872f9233", "comment": "Malware payload (Heodo)", "value": "7a3969b1e92a4a62603c4b8425817218d6ca7cb0d2e456bc68202da14faead52", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642741173, "uuid": "cfe59546-446b-401e-bbe7-16ae93a98cb7", "comment": "Malware payload (Heodo)", "value": "322ae23468c3160994a021b788be948da8ca7f2a", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642741173, "uuid": "b2827da2-67ce-42e5-86f1-c3ed1db870f8", "comment": "Malware payload (Heodo)", "value": "9a1b59a787a2b222172f33c25f967043154c63c29c0808021a0ec4fe15aa96a4cd714bb6cf9ab20dc4166fc98a0a8574", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642741173, "uuid": "7e63a65a-a8ea-48af-bdae-2b7c6c85c288", "value": "T1BF636CA7B78299EADA0483394DB643C5B717EC104F9A43C73694F7346EB49F08D9324A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642741173, "uuid": "d18b5469-4b20-483f-b2b2-29c1cf884862", "value": "1536:bpEk3hbdlylKsgqopeJBWhZFGkE+cL2NdA8eXZiozeOgXVZKyaZpvyR1kZkJvU+:bCk3hbdlylKsgqopeJBWhZFGkE+cL2Nr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642741173, "uuid": "1f8416bc-4ef0-4a76-bebd-6ffc3fcc90b3", "value": 71226, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642741173, "uuid": "9a1354e5-03cf-4341-95a8-aed8c3545571", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642741173, "uuid": "2aebdab7-13e5-43e8-85fc-f633c3fe0607", "value": "payment.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6e63bab-7af7-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642796461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642796461, "uuid": "e54c7f89-8ff1-4128-b6f2-88e8297be1fe", "comment": "Malware payload", "value": "79fb2d25bf70496cc7e57a9c890e9f79", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642796461, "uuid": "a84d59ef-ab70-4637-893b-8be424a09a05", "comment": "Malware payload", "value": "7aafa65cb474fc579d665d93b23d91e8f9cbf34acbfa4254131af57bbd0a00c1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642796461, "uuid": "34559e49-496b-4f26-a87e-3c841d3a71d7", "comment": "Malware payload", "value": "915820544ce99e2988ac0d21c90ba0144cfc7058", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642796461, "uuid": "b115ccb1-0917-4237-80ab-dfe6872e93b9", "comment": "Malware payload", "value": "fe3597c6b6cd68cfa83849e74ed54e175698e05ed9ee6d8618c63357ea1e99ed4c3375aede96c65c4853c1e7ae3e2c21", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642796461, "uuid": "1bf45944-d604-408c-824e-bd11293126e6", "value": "T14A1508AD325071DFC8A7D972CEA81C64EB61747A571BC207901312ADAE0DA97DF242F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642796461, "uuid": "d3c0e54d-87d4-4112-9691-424f68c76f38", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642796461, "uuid": "860943b4-c0de-44f9-a688-28e79e9f53d8", "value": "24576:zXkKxpQlVzp0r/pN3Am3DWGtfmX4U6+i9vYFU:zXrpwr0rz3D3l+i6FU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642796461, "uuid": "9cc8a475-2be1-4186-bf1b-850e91181d55", "value": 884736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642796461, "uuid": "775fbc57-55d2-4c31-8f34-f3f674e9bc8e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642796461, "uuid": "3a367341-346b-4624-a8f5-4a923c895ccd", "value": "P022-008.pdf________________.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74b6b25c-7a4e-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642723792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642723792, "uuid": "44d53ea7-466a-495d-a33d-dc6ad03c9d7a", "comment": "Malware payload (Heodo)", "value": "906dd2a3c7d137bc2acc6344902a69a5", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642723792, "uuid": "01a684d0-8397-491a-ad94-98fd5adbab06", "comment": "Malware payload (Heodo)", "value": "7b3120e793a188b1e267295cb469391d27870ec38022f7a17490bc22e67219ee", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642723792, "uuid": "04859672-7ae6-4161-acbf-d7a6e5b4e2c5", "comment": "Malware payload (Heodo)", "value": "22339d95c87588663d92280d78a2abd9529c071a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642723792, "uuid": "4cea2560-7d58-40dd-a77c-6f9a10dd87d4", "comment": "Malware payload (Heodo)", "value": "f46808234f88b38bd793d10f7f870557f4272c9c90a7ca55b56c77690b70b1f917aeee0fb3917e1872dff1f8916c614f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642723792, "uuid": "7f6549c6-daee-4109-8c39-ddfd4f4dc8d3", "value": "T1C9D4BF02B2D1C036C5AF11B08E76AB08A2EDFE905B7985DBD7847D5F1E31BC26635B06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642723792, "uuid": "70cd2661-b3a3-49ac-a90c-1c1ad455138b", "value": "42bfc936e90bcc6f5b01541917ef37a4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642723792, "uuid": "9e497408-419d-4549-bc73-ef090dcde1a2", "value": "12288:Td0saabmsb61ZuV3ZGuyfEgXkvPLEbsWrxD8iP29pi9NWG1DjsgqXXvhhcwEPwqh:68mi61ZuRZGuyfEgXkvPLEbsODYDgVnm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642723792, "uuid": "97b84c05-546f-4e85-8db7-75d502c5e882", "value": 638976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642723792, "uuid": "df53bfdd-668d-4356-a2e5-6e5f1be28934", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642723792, "uuid": "9fc997dc-205a-4acd-9615-f76a3b08192e", "value": "emotet_exe_e4_7b3120e793a188b1e267295cb469391d27870ec38022f7a17490bc22e67219ee_2022-01-21__000944.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e6c20e7-7a88-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642748665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642748665, "uuid": "d97ac139-f820-474e-941a-393205c38dbc", "comment": "Malware payload (Mirai)", "value": "b2499605d6cb98e1d428956ca720f9f3", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642748665, "uuid": "478afc32-9f04-47b9-a989-abbe317dae7b", "comment": "Malware payload (Mirai)", "value": "7b876157fd5cc9e7ca92a6d9702911160a96b4fa400befd40bd1307bbb06e656", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642748665, "uuid": "8a30cdbf-e3b8-48a1-9daf-997af50864f4", "comment": "Malware payload (Mirai)", "value": "25c3039bf8fdb8814b1f61fb25c3fe299556e0e1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642748665, "uuid": "b452d94c-415f-4974-831a-40c830617d02", "comment": "Malware payload (Mirai)", "value": "6d3108fc84ea2934200199cb2da22bd0418ceecf3a281114118a9db7212c09f6d50aeec2de2dde36b91e1b81227cd293", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642748665, "uuid": "922c99d4-811e-4abf-95a8-a4fa71f2ebf8", "value": "T135732945BE82AA16C6C4477BFB0E43CD33226398E3DD7213DE166F51778AA2B0D6B051", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642748665, "uuid": "47d88970-de24-4b23-9e99-275373f66d6c", "value": "1536:EG5ixEJIFOnozX7mgbivK/fl2uHQTnsVqbVb3G33x8vqIT0YwbZnZ:DJgzLmDvbuwTfRb3GOvxwbZnZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642748665, "uuid": "8a04090d-e4b7-4019-ac3b-44b521f8e66e", "value": 79440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642748665, "uuid": "39ab80ea-11b1-4804-b783-c73c5a62e085", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642748665, "uuid": "a5968503-9449-4e5a-97fa-05a532f6b1b6", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb031373-7ac6-11ec-9275-42010a9c0029", "comment": "Malware payload (Smoke Loader)", "timestamp": 1642775557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775557, "uuid": "5b149b8d-8065-40b3-b978-7e715a7058c1", "comment": "Malware payload (Smoke Loader)", "value": "ca10ab6332751e0c3c01b3af4ee24e8f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775557, "uuid": "27769012-b33d-4f5f-b43b-1f7e25b24955", "comment": "Malware payload (Smoke Loader)", "value": "7b9295a7c05dcc77f1f6892f1ce74e2e34baf133f95388ab2c94129736df89de", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775557, "uuid": "2600f9b1-c2d7-48dd-a518-e84b4dd3569d", "comment": "Malware payload (Smoke Loader)", "value": "097c67b0390e4338816fe030a8cc62de37e99c9c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775557, "uuid": "ea1a71e8-cfaa-40b4-bd7f-36afd6a3f8a4", "comment": "Malware payload (Smoke Loader)", "value": "3c544badcf5a52e7b973affbe2aab7201802c876405154696969636969a077a9d1dec4a08dc087521a6ebbac859dbd36", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775557, "uuid": "1f6b1285-c02d-4b70-99f0-e9b704cb7ffa", "value": "T14F648D10BBA0C035F5B321F44A799378A53E7AF16B2491CB52D526EE9B386E4DC3131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775557, "uuid": "c5ab0876-2e1d-41dc-abe7-c6ec4b60dcf6", "value": "b4892f1130d31e71dc6b3341892a29cb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775557, "uuid": "29092b7a-8e4c-4dfd-8be5-bde89d773c37", "value": "6144:k7ywuv8/cCECTt4lIaQ+pRizbP3cOHmQt2whL5pTaHbkC:k7Vu1ny2lIT+pkHFHmK2G5pW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642775557, "uuid": "36ea4306-68f9-41c6-b6be-3c5151540dfb", "value": 336384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642775557, "uuid": "b17d7464-d10f-4424-8ac4-84737e5c00a1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775557, "uuid": "459e727c-9b01-4853-9b27-714d4dc2a33e", "value": "ca10ab6332751e0c3c01b3af4ee24e8f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc95f0af-7aab-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642763883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642763883, "uuid": "4142c59a-2918-4ef3-ab3d-d195550dac2c", "comment": "Malware payload (Heodo)", "value": "bde98e84d969f1986d0c00d4e734380e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642763883, "uuid": "5102b5fa-d6b4-4cf5-bdc7-66ee1735416a", "comment": "Malware payload (Heodo)", "value": "7d2202f1f29388ec803137e1949adf3faa99922a3e20f0a962153c52c5207292", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642763883, "uuid": "e8e0180e-c21a-440d-89e4-62db55c84872", "comment": "Malware payload (Heodo)", "value": "80a2c67e59ef357547a877bd85184e78f14387c1", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642763883, "uuid": "32a4740b-4db1-4c1d-a25d-ced620eba34b", "comment": "Malware payload (Heodo)", "value": "9b59f1dfdb8c8cd6097c1acb93b086dd13fbc8da937a62f96cc33e5f94cc8407f7fab86720df31522e6e0d119ecefa9d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642763883, "uuid": "f928b9a6-9328-456f-9df1-b87cbfd1f645", "value": "T19DD4B011B2E2C07AC1AF0175595297A973F9BE90D9FDC247EFC06A4F5E315828B38722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642763883, "uuid": "f88c71e7-7242-43e4-98d0-7f85fce0058c", "value": "24b46ffcf60dc8d39e8124f411ebd08e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642763883, "uuid": "44c98839-3d0e-4cda-b993-36dd1bf2340b", "value": "12288:vClISqMT89ornPmGZtn5yzrD71ywIdO3D7AfojAxOBnVV0KOFD3EPO7:vmTWornPDryzrdywIdOz7AfOAxsVZOFZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642763883, "uuid": "25808208-5935-4b0f-8420-e3e560546d70", "value": 634880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642763883, "uuid": "3af7ba9c-f30f-4278-b57c-1b11ae8c1013", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642763883, "uuid": "14d33a8d-d142-4932-8667-f7c770b16a47", "value": "emotet_exe_e5_7d2202f1f29388ec803137e1949adf3faa99922a3e20f0a962153c52c5207292_2022-01-21__111757.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78b0c553-7b0c-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642805403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642805403, "uuid": "1d7f39d0-7b9a-42e2-aa1a-1a2e530354ca", "comment": "Malware payload", "value": "17c6b0291cbbf034d7d61148244324ca", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642805403, "uuid": "3648a967-0fac-4943-9674-653e31632bcd", "comment": "Malware payload", "value": "7da75d007a81b9c7def84b3a01541f7bf2fc5ac869b7f89f7957c84607b9abad", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642805403, "uuid": "3be89596-fcb6-4ac2-901e-c703860862e7", "comment": "Malware payload", "value": "6d7b368ad50bccd8c1d0602f7bf2e91b679e0452", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642805403, "uuid": "a97c65b1-313b-47e7-ae0c-566305772c25", "comment": "Malware payload", "value": "e01bc459c7515a307120b17848bf8108e2a5119a337fd75b8b91f2d4e7e8d17ac4edad98a59f006c495620511f1ae611", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642805403, "uuid": "266619f1-48e4-41b2-a088-8c158dddae10", "value": "T179E2E163A1A5C65EC11B30F0588E7C0B0C51A24BAD6455FAEFFA2951CDE1EBA2C247D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642805403, "uuid": "8c291758-3483-45d6-b8ff-4e60eb4905cd", "value": "768:U/CybT+4JlS6HEW79mXtvGmeRnlnbcuyD7Uryqw:UdG4lS6HEucXVGmInlnouy8mqw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642805403, "uuid": "cd6f0c93-0db9-40a2-91e3-a1f53f5f52cb", "value": 31400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642805403, "uuid": "01119baf-aeab-4092-80ed-03bb94bf17c5", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642805403, "uuid": "c3d4ebde-3699-4ddb-aac0-56c8e8711829", "value": "KKveTTgaAAsecNNaaaa.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "704f1ef5-7a9e-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642758144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642758144, "uuid": "03648d31-c36a-4a66-8b58-5c78ee181ccc", "comment": "Malware payload (Mirai)", "value": "ecfe2353e4194837a271d96f76305021", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642758144, "uuid": "f69b8114-805a-46b1-bc59-1626bc0bd1d1", "comment": "Malware payload (Mirai)", "value": "7e3e7e67ab2d28d3ab7c2a89210b6d76214eee906ac021a2f6091953c4a6f4ae", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642758144, "uuid": "0dc20a2f-7b07-44d8-9b6c-fb29ca6ecc3b", "comment": "Malware payload (Mirai)", "value": "6943bc29fa11c46f9c2035b43fd754562df0a2f3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642758144, "uuid": "86ad525f-99d3-4725-952a-246d734dbaea", "comment": "Malware payload (Mirai)", "value": "b18e446d3e1d179eb2027c4bc703fbeb46b30e455ffba89945c76399e08c5540a2c8b750bd038225ced687d3cabc2480", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642758144, "uuid": "291517d8-ab0f-4d0a-a069-b280c0b06721", "value": "T18D231996B8029D3CF90FE7BE8817490CF625734560930B2B67A7FDA36C321A4DD5AD42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642758144, "uuid": "718ab367-dcb6-4c62-b9ed-471f15138fb4", "value": "768:8xCtDpeAXVw6iH0YzS/ZmgnuO86BztCF0xHl7XOQ0/o8Bk5V:KCtFJwvHXlguO8Sk0xHlbOQG6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642758144, "uuid": "eedff168-bd60-49da-bbe5-fd5191fb8391", "value": 48028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642758144, "uuid": "c6b5f96b-4ae5-4ea6-ac27-62c5bc165a5d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642758144, "uuid": "a33dadab-3301-41ab-b03d-06f43fbccd7c", "value": "ecfe2353e4194837a271d96f76305021", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb9abcb6-7a61-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642732071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642732071, "uuid": "5f7ed7ab-ac2e-474e-91ad-c5a5b6b7005e", "comment": "Malware payload", "value": "2e42cd6dbdfb1da6f9afa1693af26d71", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642732071, "uuid": "0cb909cc-2f47-4495-b737-e9b9a793a834", "comment": "Malware payload", "value": "7e801dc7ea593f053d736c5e2c35112a97b9a98007b59c894ee1938b77cf23b9", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642732071, "uuid": "e2bd9e90-0b05-4193-8bea-d20a838dc2ff", "comment": "Malware payload", "value": "4fdd06008ce32e59af54755a80a1e5b57d4e0016", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642732071, "uuid": "2d35e224-1cf1-48ea-acca-fb236862e7aa", "comment": "Malware payload", "value": "c8909c2c65379222d102a852646c233fb9bf75270fb7a09779575115a8b33e4f745237c8470b4714968d73b180b4f627", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642732071, "uuid": "18609644-ddf1-4336-abf9-15ffc62a9953", "value": "T11CE22981B9415613CAC256B7FB4E438D7B270358E2FA7703AD1AAF2137879570F3A512", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642732071, "uuid": "c1efc7c8-7944-4107-85a1-663ae3895ad1", "value": "768:qJV5Owpw55MaZevNulzYlcedgVTevQuI:QTawcMlcey5evL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642732071, "uuid": "c45ff77e-dd3d-4139-8be9-e2adb5817462", "value": 34204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642732071, "uuid": "195719ea-9278-41a4-aedb-857443870a5e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642732071, "uuid": "0f48a108-f3f4-4674-9184-d35a48471004", "value": "beamer.arm-20220121-0227", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4e81410-7a7a-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642742798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642742798, "uuid": "3ee78377-c1a4-4407-b07c-dd53d617b8fc", "comment": "Malware payload (Heodo)", "value": "56ef2bccaca7558aefe8f834c57fe2af", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642742798, "uuid": "1767a483-5357-408d-95fa-b78b1bb00bf3", "comment": "Malware payload (Heodo)", "value": "7ecf0d5b556f400f2d98ef9f7e90373854ec0bda7732f5300223f9c600405235", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642742798, "uuid": "42f0a134-32f1-4500-9c07-c1477c29b55b", "comment": "Malware payload (Heodo)", "value": "806d6227c68cebd4613926937d69eab04df22070", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642742798, "uuid": "198c8330-3424-4e40-8ac7-e0bded7d6ac4", "comment": "Malware payload (Heodo)", "value": "ef881c9d2e2b249eacf55605ecb85ba251490f051fc4f7605a11cd1d883999873e0f8ca460b9f00b5b235ee28f4e7ce5", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642742798, "uuid": "31c8cd32-4851-4018-ab8f-42b4e5f57180", "value": "T108636CA7B78299EADA0483394DB643C5B717EC104F9A43C73694F7346EB49F08D9324A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642742798, "uuid": "f4df6250-ea13-4e1b-8aaa-47f0e898b442", "value": "1536:bpEk3hbdlylKsgqopeJBWhZFGkE+cL2NdA8eXZiozeOgXVZKyaZpvyR1kZkJvU+:bCk3hbdlylKsgqopeJBWhZFGkE+cL2Nr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642742798, "uuid": "babf2c4e-a016-4221-bc3b-37cfb7f55a7b", "value": 71684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642742798, "uuid": "3326e835-c947-4f64-8b2b-9404edd8f843", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642742798, "uuid": "b5ade316-000c-4b6c-a4aa-bae7cbfb6255", "value": "56ef2bccaca7558aefe8f834c57fe2af", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75473924-7ad1-11ec-9275-42010a9c0029", "comment": "Malware payload (RemcosRAT)", "timestamp": 1642780057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642780057, "uuid": "6170730e-477a-44fd-9b6e-f9626d073eef", "comment": "Malware payload (RemcosRAT)", "value": "ddfcdfe9ef9ffa7be1241e1772f1e6ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642780057, "uuid": "63dad339-2abb-4eea-854e-b71d41a1923d", "comment": "Malware payload (RemcosRAT)", "value": "7efa4dff44ccd8ddcbf17ddce11837a80e21bc9c397cdcb1ccd2d4b86f74031e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642780057, "uuid": "68f65daf-9e08-4fc4-ae21-e20bde1f67ab", "comment": "Malware payload (RemcosRAT)", "value": "1f9612d80471c4fd11640a579158fe14bc520954", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642780057, "uuid": "2602cde4-fa30-49c0-b7f7-600aef06497f", "comment": "Malware payload (RemcosRAT)", "value": "9d194e84376333ccc376214762d8920cd15efadd885700ca461b1cbdaafca52a5c7edcd6f4a744a9f4fef74861575999", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642780057, "uuid": "f2fd31c9-69da-4da7-b781-588e343d2b65", "value": "T134A4AD11B9C1C032D17252700D29FB759AFCBC302935597BB3DA5D9ABE700C1BB2A6A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642780057, "uuid": "486fe38e-c82f-4196-b9f6-6f2989c94d7f", "value": "1f15bed3346039b42bc33c9080047f8c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642780057, "uuid": "f8166446-34e1-4764-b555-3f2e8158d06f", "value": "12288:iegN0jfYLclGb0bVT6e+MT2MffZS/gD8SSYo:ENywLclGIeMT2MXZRD8SSV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642780057, "uuid": "1eb1eb6d-8694-4d9e-b639-11bb78932c7f", "value": 474112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642780057, "uuid": "e7c1cc61-d394-428d-9aa0-19fc006795b4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642780057, "uuid": "58125508-8119-4728-afd4-acf4858398b8", "value": "ddfcdfe9ef9ffa7be1241e1772f1e6ae.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02e47eaa-7a81-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1642745505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642745505, "uuid": "b67f92cc-6439-49ae-800f-3f76b5539b3a", "comment": "Malware payload (SilentBuilder)", "value": "b04366cc788dcf84b61fc4335b1e4f6b", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642745505, "uuid": "258230c2-960e-46b6-be8a-c6f7f3e1b236", "comment": "Malware payload (SilentBuilder)", "value": "7efacaa6dacfe6bf20d27faaf86184458461e64165c615cede70b42cf913f8ae", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642745505, "uuid": "8bf0993f-aad3-4bea-9214-672472ddf1c2", "comment": "Malware payload (SilentBuilder)", "value": "7ec368710ac0dc5a1e01546391d0f2d62131d71e", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642745505, "uuid": "9bc3dd22-feee-4507-a616-6eb16f6c1c6d", "comment": "Malware payload (SilentBuilder)", "value": "81796d71b14e7aecf9017856c2340aac23f3266483ad486a906845ecb71aecca3010622448fad1745688089153234faf", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642745505, "uuid": "23b95cf4-9442-440d-9d83-8e4157ff301c", "value": "T14D636CA7B78299EADA0483394DB643C5B717EC104F9A43C73694F7346EB49F08D9324A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642745505, "uuid": "2d067d39-5c76-4a5e-be02-fb8ffae91f43", "value": "1536:bpEk3hbdlylKsgqopeJBWhZFGkE+cL2NdA8eXZiozeOgXVZKyaZpvyR1kZkJvU+:bCk3hbdlylKsgqopeJBWhZFGkE+cL2Nr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642745505, "uuid": "f63319d6-e7e0-4a00-9b05-38dd7f3bb3bf", "value": 71501, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642745505, "uuid": "968f9d39-a915-4ea8-8511-740632020c3d", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642745505, "uuid": "6747439d-ed41-45b8-8d72-de8abe6c0520", "value": "b04366cc788dcf84b61fc4335b1e4f6b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "737af521-7a87-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642748271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642748271, "uuid": "d6fa4b76-d4e0-4460-bdc1-a6758d589503", "comment": "Malware payload", "value": "cadadaa9cd4994ac063a9e6ff0d8888c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "vodafone", "colour": "#8E01DC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642748271, "uuid": "3805f00a-37ff-4438-99e6-a9209c9544b5", "comment": "Malware payload", "value": "7efc216f28686df549f764bc60f19eb50e86540cbedc4bac5e03df650579fa40", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "vodafone", "colour": "#8E01DC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642748271, "uuid": "9ce602b1-958d-4756-a653-9ef9ea36bbe2", "comment": "Malware payload", "value": "1e489714f252255928006ab005f0e7b1284a5dd0", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "vodafone", "colour": "#8E01DC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642748271, "uuid": "a9928757-0e7b-494d-b5fa-3517a6e3baa4", "comment": "Malware payload", "value": "07ee1fa3349462738b90b8e73a840f8a9f5e9e20efd35265d89f271f9e9bd6a529e99b87676cbdfae17a8a6acb7172fa", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "vodafone", "colour": "#8E01DC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642748271, "uuid": "6725dcf8-bcd2-456e-adc2-44ba372890d2", "value": "T16671111AA7EC496BE47747346EF3472367A4FC509BB3835D09D0022AAC613501D71FB0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642748271, "uuid": "83e5d750-0887-43eb-9951-5294c8055add", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642748271, "uuid": "bfe8129c-dff1-4193-b1d2-5eea988901f3", "value": "24:etGSM8OmU0t3lm85z7ntQW6gfg7tG4laUtkZfDhBzVUWI+ycuZhNzakSVPNnq:6GXQ3r5udarJ1P31ulza3Pq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642748271, "uuid": "30ffe504-3a90-4164-a7b3-07c3a97f172e", "value": 3584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642748271, "uuid": "3d4efa89-660f-4f36-a4fd-95b8bb52a1cf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642748271, "uuid": "cd2e5981-05b9-4c15-87da-7b620c85b761", "value": "qlvb1ydt.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d89eccdc-7a73-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642739851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642739851, "uuid": "b05d7ba5-7b2a-46f6-9996-6dbd1fb1259c", "comment": "Malware payload", "value": "24436256806530d3a75f82d019c10666", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642739851, "uuid": "01605cd6-a087-4063-bdc7-9808e446da7f", "comment": "Malware payload", "value": "8010cc9ea70156767432d0b7e719cf6338bf3f1fc675e2e560bd43b3f0c1fd0c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642739851, "uuid": "c9319c48-1fca-42ed-a802-dc42ce5c4392", "comment": "Malware payload", "value": "78d794ef9f7b9ff710a51175852342a095d74fe0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642739851, "uuid": "134ff88c-4b7d-496b-99a3-cebc2e369590", "comment": "Malware payload", "value": "4f4f143c3b1e8d44df86114dacd2fd1f9f9a5a56672da3bbc9ca3a3f9a18ca5266eead5970041a1670b145e453588405", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642739851, "uuid": "32b5aa47-edec-4dd4-8af8-868aa5586b43", "value": "T12FB31B8ABF95DCA7DD25433944E6C325533DFA8447878B172E2499391E37BA0BFC4282", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642739851, "uuid": "a1b86666-c07a-43d4-907e-598238de5b78", "value": "743c026e65ed86b87c2454cd06988f9a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642739851, "uuid": "fa8b4848-d869-4ddb-ad15-f0ac5b97811d", "value": "1536:RBx0l0cIj3zyjXtdXmsbx5j1wosuB0irzCl7MbiRLRv58ngb:fxO0vqdXLwosuB0pRx8gb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642739851, "uuid": "d1d81ae7-567f-44b4-9d56-28f8737aa8db", "value": 110802, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642739851, "uuid": "abe09c3b-3ec3-4dec-8553-fc23d0e58ee0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642739851, "uuid": "c0e2871c-d28c-4e39-98a2-1129ddbf3747", "value": "propsys.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "745b7064-7a4e-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642723791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642723791, "uuid": "f5e333ec-0acd-44d9-80c7-5d332499e8cd", "comment": "Malware payload (Heodo)", "value": "37da0e1da11d2e264fdf53d0d36c99b9", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642723791, "uuid": "ec7f698d-ab5b-432b-aa44-e706bb08ff6e", "comment": "Malware payload (Heodo)", "value": "8066783c5e2501c78a23a6b17cd65b686118bd4f2b83e8288fdb81dadbccef84", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642723791, "uuid": "fd065e3e-de68-492e-826a-25a0919c2855", "comment": "Malware payload (Heodo)", "value": "3a709c44118e06d9b6b277e3b5a2dc9601060a2a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642723791, "uuid": "5f269b07-24dd-4d31-b9ff-aeb0bdf65b78", "comment": "Malware payload (Heodo)", "value": "e549bc6ab23ef7bbf4d29d2b4f16956554182730f272ce9529496c0d3a49fc456087671941f313d3e06edfa7a5212816", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642723791, "uuid": "3d064d34-0cae-4a07-a0ec-bf9292619014", "value": "T180D4BF02B2D1C036C5AF11B08E76AB08A2EDFE905B7985DBD7847D5F1E31BC26635B06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642723791, "uuid": "8e91918d-daa8-4b43-9790-fa8e6d3b34cb", "value": "42bfc936e90bcc6f5b01541917ef37a4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642723791, "uuid": "30963729-6e32-4e7b-9ed7-e56b127e311b", "value": "12288:Td0saabmsb61ZuV3ZGuyfEgXkvPLEbsWrxD8iP29pi9NmG1DjsgqXXvhhcwEPwqh:68mi61ZuRZGuyfEgXkvPLEbsODYDoVnm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642723791, "uuid": "440c8e28-78f1-4256-8f1d-ca080386dc12", "value": 638976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642723791, "uuid": "044ed60a-9607-4df8-9b9b-b4a2747c37a5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642723791, "uuid": "3af6eaa3-0c33-49c9-9400-cfa401c60e83", "value": "emotet_exe_e4_8066783c5e2501c78a23a6b17cd65b686118bd4f2b83e8288fdb81dadbccef84_2022-01-21__000945.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1629eecc-7a69-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1642735230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642735230, "uuid": "78ac7b4e-f053-41c8-a67b-6a8804c4f9c0", "comment": "Malware payload (AgentTesla)", "value": "16b299ef8685574de4d444c0dcfe141e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642735230, "uuid": "0063d0f9-780d-4c17-9969-f39b41950ca7", "comment": "Malware payload (AgentTesla)", "value": "80d7bee80bb433d5abf96e8ec335f07034e97d0cd95c09ae94777bbd9c83cc14", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642735230, "uuid": "d8b31363-3a48-4a42-870d-f730d7489b4a", "comment": "Malware payload (AgentTesla)", "value": "5cfe3c25950d5925ef9b93e43c8ebe5d2c97e8c8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642735230, "uuid": "315bf609-aab0-4b96-aa0e-9c961eed1f7e", "comment": "Malware payload (AgentTesla)", "value": "79ce62fb62f3303336492859f38aee6d2d38f40233c385a8fac6ced04c4b9c6324083793931429a347c55861985f8873", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642735230, "uuid": "487cd899-8593-4112-84a6-15be8a174f5b", "value": "T19945DFB721191F99F83FA33E532054558BF8A52BE726D2CFBE84A4D74C81F02C716926", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642735230, "uuid": "ac38b928-619a-4409-a7bd-49daaa5519d8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642735230, "uuid": "299ae3b1-6f1f-44b6-8049-644e4a10e08f", "value": "24576:wPUhjAje402Dkf1pSh+CjDpf5d9ubFiekgw0qsd:Wi402wf2pjDZ5d9ub4+7qs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642735230, "uuid": "2150c292-e6cc-4178-9631-c00a9967cd6f", "value": 1263616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642735230, "uuid": "3115f253-7ebb-4ff8-aea8-5890c80db516", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642735230, "uuid": "844e866a-82de-4b9c-9edc-5ae9d3fee9d4", "value": "Invoice & Packing list.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6912d76a-7a88-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642748683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642748683, "uuid": "0f7d8574-5d2e-4d8f-a365-d71221facf6b", "comment": "Malware payload", "value": "a2f37c473342f9b587497663ad930bc7", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642748683, "uuid": "f0cb8878-a228-424e-88aa-0260eb109c52", "comment": "Malware payload", "value": "817afbcb466f5d50520f0d8b5036741a1652130a49ac1a58092e7bad2d957fae", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642748683, "uuid": "183f16f8-1299-4db3-8cb3-d512186def28", "comment": "Malware payload", "value": "433f2071b3b80f2fcfcb94de8fcf1d4a96f4be6e", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642748683, "uuid": "42fdcdd7-858f-486d-9aa4-2c39a16cf865", "comment": "Malware payload", "value": "ba5be72f1afa526481cafef159a93e92078adaf3f655c858b2d5c72e582e4463ee291f693613549bf0f87c711bb83810", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642748683, "uuid": "f3a93844-92cc-4430-ae2c-650c3eeaf0d3", "value": "T1DD73BFBBF515B834C1A72C7C548C14A6E50DA443B83BA81B37D0FF6E1A56E9703A21DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642748683, "uuid": "89baee70-15d7-4f65-9cef-91747ac3bd15", "value": "1536:393TjWxiNvz7IvBXb5EJqAYRgOHIVWgV6v6TU:39jaxipIvBXtJAO3HIcgVA6TU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642748683, "uuid": "27f4afa2-fc78-4711-9331-451f782c921b", "value": 73802, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642748683, "uuid": "5853e8af-a06b-4157-be04-d5c2554bd1d2", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642748683, "uuid": "de677859-5bce-4341-ab7a-45f1864bdad9", "value": "G&A Forecast Review - 045 Commercial Europe.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a38c4c1c-7af0-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642793449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642793449, "uuid": "4c48ef46-0ff5-493a-bfc2-9ff619dbc819", "comment": "Malware payload", "value": "e137b6adb62300961fbcdb997f6fb16c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642793449, "uuid": "87315d68-8e9a-4f62-a849-b45141f2cad0", "comment": "Malware payload", "value": "82ae666a4f1a55b1e36c0b705adc9f2841c1dfc552992fdca5a2eadd5a6f189b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642793449, "uuid": "4acbbb06-f73b-4be0-9643-57ac0acb0412", "comment": "Malware payload", "value": "94211f766ad75658953b6cf0b3aed6c83a43a5a1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642793449, "uuid": "f35ec7fb-dea3-4da4-ba95-56db4480a965", "comment": "Malware payload", "value": "35648a44d308536cc705ea1e2d7e397abd3e84086eed2a9fd9b6d30182065a5875c67b99c3f24be96e7c7fb4f1111adc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642793449, "uuid": "96261689-cb0a-43aa-a611-5945c713f5ea", "value": "T12433F18CC94A788ECDCECC7E8D081D729D51A1E0774B8BCA67481C55B35604F72AB8BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642793449, "uuid": "875ded43-3b26-4ffc-bbc0-ff3a27bbc0d1", "value": "768:o8t6qzvnYxbQcio760IfcFa5WAlvb2W2baKKQI3X11iybQFwOWRVwTaN9PHPA:ogzvnYBQfo75If5uLI1sybTLwet4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642793449, "uuid": "9f697831-b640-4c80-84da-369080fddd5b", "value": 53128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642793449, "uuid": "45fa95e7-3c45-482d-b677-a7707329288e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642793449, "uuid": "c732574a-d511-4f27-af88-ad9a068ea28f", "value": "e137b6adb62300961fbcdb997f6fb16c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7418a172-7a4e-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642723791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642723791, "uuid": "a5e6f11a-762a-486c-a496-66993cffd6d3", "comment": "Malware payload (Heodo)", "value": "23e4a9cbfd99f07584c7993aef571710", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642723791, "uuid": "c10037f0-39fa-4b04-8cc0-52d2ed99783d", "comment": "Malware payload (Heodo)", "value": "8311ac739fc4e8d4aa4bec8714e3eef6c56609211b03d96c1310921d613fc266", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642723791, "uuid": "e248f895-e99b-4f41-ac46-ec705c225a6f", "comment": "Malware payload (Heodo)", "value": "a3145037aad723347162782d2a24c224af38cd89", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642723791, "uuid": "f922e868-f617-4cd5-a99d-e72a5a44cb85", "comment": "Malware payload (Heodo)", "value": "9975e5b2d9df74e079512493274b8c483e1d00f150dc75883e7e68c51c36c27ea8a9a5ea199f520ca26f786252f42402", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642723791, "uuid": "0176f207-4994-4f86-a437-f541c7be92b4", "value": "T193D4BF02B2D1C036C5AF11B08E76AB08A2EDFE905B7985DBD7847D5F1E31BC26635B06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642723791, "uuid": "01ba1ff9-4b56-4dc2-a58e-ce8ace4599d0", "value": "42bfc936e90bcc6f5b01541917ef37a4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642723791, "uuid": "6076ed42-7978-4580-9cea-0cc3294b128c", "value": "12288:Td0saabmsb61ZuV3ZGuyfEgXkvPLEbsWrxD8iP29pi9NiG1DjsgqXXvhhcwEPwqh:68mi61ZuRZGuyfEgXkvPLEbsODYDMVnm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642723791, "uuid": "c5314e11-5717-47ba-9dfe-8d89a1fa9ed2", "value": 638976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642723791, "uuid": "355f83bf-9e30-4515-bece-4a203c39ceb2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642723791, "uuid": "9feca2ea-8a81-4278-b176-fc2e669dd0b2", "value": "emotet_exe_e4_8311ac739fc4e8d4aa4bec8714e3eef6c56609211b03d96c1310921d613fc266_2022-01-21__000943.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e9ae336-7ad3-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642780959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642780959, "uuid": "da14304c-4177-4f98-b60c-f36be96fb895", "comment": "Malware payload", "value": "9118d57f30428defac24f0d001cb9e43", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642780959, "uuid": "b2f575ad-db8d-4c71-b6cc-69a6650cad0c", "comment": "Malware payload", "value": "8337a5a27864c1be859eb9fb775790e2be36e146af757b63a831366498c7f15b", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642780959, "uuid": "1d265f66-89b7-439a-938b-e49a7c1c2b32", "comment": "Malware payload", "value": "b43850c86dea010d5da56c1e83ade0d0df04f502", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642780959, "uuid": "c4ba8074-2da4-40eb-88e2-26b899e44c44", "comment": "Malware payload", "value": "6d7f2e59394cf312808d450f7f935d595a7ffb15b87e3f3ea8ea6f1111f346c8f18d6d17da7b92d28115d88e65d7a37f", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642780959, "uuid": "365fc2b4-a2e7-4ab5-94a9-e16ec14d2284", "value": "T15C430233D0B7083DEBC511B9194D56C8724A65E387DE0CC3CB05DDC98E79D05664AA78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642780959, "uuid": "e9836ca7-1328-45f7-9748-610b20d628f2", "value": "1536:QHVESz9r+gVYSfdCXzovqPgW4Roh49HaM2n7:e+S1VYmkXzJI9omdaM2n7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642780959, "uuid": "ecc48e20-8f4a-4597-a6ff-533d8a1cfe86", "value": 57337, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642780959, "uuid": "3efc3ae6-e20a-4285-819c-1a15867e860a", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642780959, "uuid": "b61e6e1e-e1c4-4e56-99be-2c544b6f2a7f", "value": "Invoice.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f3e595a-7ac7-11ec-9275-42010a9c0029", "comment": "Malware payload (PurpleFox)", "timestamp": 1642775806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775806, "uuid": "afc00b0e-fa38-46ef-a7e3-d3624e22a72c", "comment": "Malware payload (PurpleFox)", "value": "5337c99c3e563f8b0f0c8f71a7e852a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PurpleFox", "colour": "#FDE7BD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775806, "uuid": "c9c25bbe-53cb-4cf7-97d7-0ba8ebb4e531", "comment": "Malware payload (PurpleFox)", "value": "85267d05c5ca1a7d93370ce83bc85a93823ab60d8bb4dafd6e9fc2a8f4616ebf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PurpleFox", "colour": "#FDE7BD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775806, "uuid": "234a0a33-a256-4fd5-a5da-f5117b07fda5", "comment": "Malware payload (PurpleFox)", "value": "f954a1dd8de509b70da89f7d5f319a8d33652b3a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PurpleFox", "colour": "#FDE7BD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775806, "uuid": "2f72c584-5ff6-4c7e-8ff6-1543a655a99c", "comment": "Malware payload (PurpleFox)", "value": "1b23b6b162f277df88a313d745232d9d6a56d28988e01ff69cf2decd0fa9c261c4962c7f0dbf8bab1d0a9936cafcec67", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PurpleFox", "colour": "#FDE7BD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775806, "uuid": "6da6da82-8b7e-4479-b667-5778bdfbf259", "value": "T19484A40AE6A210E0F77AC3348552B169F8713CB84734D6CFE6547A2A1B31BD5AD3B709", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775806, "uuid": "5810c3b9-e11b-4d74-9b7b-1c3e19617b5c", "value": "9c7cdf472434e99b4d5708b7fb3ea6ab", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775806, "uuid": "6f1410cb-9dfe-459f-9721-afc7bc470907", "value": "6144:5KDggLeO+QiXhxkwN4LTZZbY/9qnkyy7uPjlpz:5KDgNO+QiXhxX4J0qn5j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642775806, "uuid": "521059f7-fd32-455a-be50-c18096fab207", "value": 402432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642775806, "uuid": "7c9e2812-b97b-411f-aed1-cfbc7d5c8d4d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775806, "uuid": "47da53ce-bb45-4e0a-8f00-d71e5619d2bf", "value": "5337c99c3e563f8b0f0c8f71a7e852a6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cbe5dfd-7a92-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642752850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642752850, "uuid": "eebe682e-c669-4b93-8949-bc792e80fb2c", "comment": "Malware payload", "value": "d7da6cf8f37c7fb358580b991eba4e61", "object_relation": "md5", "Tag": [ { "name": "pw vodafone", "colour": "#096C78", "exportable": true, "hide_tag": false }, { "name": "vodafone", "colour": "#8E01DC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642752850, "uuid": "1e8e2f57-da18-4acc-9ac4-0e74c877fd8b", "comment": "Malware payload", "value": "86c7ecf53cc410d393a9828a38fd539e2a2b9ceb19d5bcf1703866eee7301fee", "object_relation": "sha256", "Tag": [ { "name": "pw vodafone", "colour": "#096C78", "exportable": true, "hide_tag": false }, { "name": "vodafone", "colour": "#8E01DC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642752850, "uuid": "ba9b7989-7cd3-4200-a98b-c442090b6a3f", "comment": "Malware payload", "value": "26a1e163751e3f5378ff27403b25de7ca6329a62", "object_relation": "sha1", "Tag": [ { "name": "pw vodafone", "colour": "#096C78", "exportable": true, "hide_tag": false }, { "name": "vodafone", "colour": "#8E01DC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642752850, "uuid": "6878b568-2d21-43f1-9cbe-2e02de820fc7", "comment": "Malware payload", "value": "cbbdf1df963e8be5e3985fa76aa0091f2217fe80076536b46baa76956f043cedf849bd1a3b71bf2d159219b2e04d1a6b", "object_relation": "sha3-384", "Tag": [ { "name": "pw vodafone", "colour": "#096C78", "exportable": true, "hide_tag": false }, { "name": "vodafone", "colour": "#8E01DC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642752850, "uuid": "efeb7c38-f6eb-464d-8879-d66a7b4221dc", "value": "T198E0D8D2DAB0A209E0D6E638144E079467058892B0A89B8FE91DBA50694259EDAE0754", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642752850, "uuid": "5f55db4f-ea38-4245-8099-28714619da9a", "value": "6:5jfyKuTOXDvF5qiahAUVTxzyN0CsYcOEC4oZ/y+SZKEpjt+lMS:5jfpuTULq9TxzyNdsYc+4oZ/lEpjtaMS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642752850, "uuid": "f3f76ffb-9740-47c3-810e-397f982cf908", "value": 378, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642752850, "uuid": "b8df57c0-2d20-4c86-92e2-7e98f5bb41f6", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642752850, "uuid": "987ebf49-ac3e-4717-be67-b58e6f2c59ef", "value": "vodafone_8.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad57f597-7aad-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642764689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642764689, "uuid": "14569b6f-b39d-4b8d-9712-d84ba06fea7f", "comment": "Malware payload (Heodo)", "value": "914b841aeedde6116686a4869e940d09", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642764689, "uuid": "d33a9e31-2ebe-45ba-8bb3-fd9cbf886b78", "comment": "Malware payload (Heodo)", "value": "87b94bc39a24a52fea2b0a9a3fbfbbb5ce88e909265faed208a79947151ee310", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642764689, "uuid": "04a40066-48f1-433c-8680-9d21a353186a", "comment": "Malware payload (Heodo)", "value": "7eaa5e56c97462ba6ca031004bdbc123c9e36c15", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642764689, "uuid": "3afc6354-d9c1-46d3-8032-a7345232132d", "comment": "Malware payload (Heodo)", "value": "1bc0d8aed507bcaa70bde00a7b98c863c5f7dc1b5d807f7de5c7a95c897f12193e05e102d87ce3610bc9a66002b72a52", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642764689, "uuid": "c0e2862c-b9c8-4ce5-911b-031ed64e55ae", "value": "T136D4B011B2E2C07AC1AF0175595297A973F9BE90D9FDC247EFC06A4F5E315828B38722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642764689, "uuid": "cee42f1f-56b0-4a90-8ce7-90cd8c2fbe35", "value": "24b46ffcf60dc8d39e8124f411ebd08e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642764689, "uuid": "57ef58b0-3ff7-4a9d-9ec3-5d6e365c8fb9", "value": "12288:vClISqMT89ornPmGZtn5yzrDp1ywIdO3D7AfojAxOBnVV0KOFD3EPO7:vmTWornPDryzrzywIdOz7AfOAxsVZOFZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642764689, "uuid": "2621e364-b5e6-4ffc-82c3-6dfa16ad177c", "value": 634880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642764689, "uuid": "203093bb-37d9-4e1a-85c5-f3e10c23f8f2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642764689, "uuid": "325098ac-c42b-4e7a-8ba8-4cbae9c5a7c9", "value": "914b841aeedde6116686a4869e940d09", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b2e88cb-7a4d-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642723293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642723293, "uuid": "8463374a-205e-4bbb-a645-04079cc391af", "comment": "Malware payload (Heodo)", "value": "01f3dd7757424cccb97c2763d454f1a8", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642723293, "uuid": "69f74148-930d-434f-82aa-0e88cf258897", "comment": "Malware payload (Heodo)", "value": "88c13197081731462e05ef64b1c9abbdc1b85e0e573437506270137fb7b735d8", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642723293, "uuid": "9720271d-b7fb-4909-9903-3c8f052a1f35", "comment": "Malware payload (Heodo)", "value": "500c1883e28503e122908b63cd551d9219639a6b", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642723293, "uuid": "49f698fa-ffd1-4b6d-88bc-8323f0ac57a0", "comment": "Malware payload (Heodo)", "value": "b3301eed20c5d0103f945d4872f8f99741b05c63b2e16c8b834a9097f7712afd5c00b6dc4bbecba1c6598d8125d95cdd", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642723293, "uuid": "22fd1843-3ac2-48e1-93ac-5d353164a7a0", "value": "T1F5636CA7B78299EADA0483394DB643C5B717EC104F9A43C73694F7346EB49F08D9324A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642723293, "uuid": "899b83ac-02c6-46bf-befe-321f12985cfc", "value": "1536:bpEk3hbdlylKsgqopeJBWhZFGkE+cL2NdA8eXZiozeOgXVZKyaZpvyR1kZkJvU+:bCk3hbdlylKsgqopeJBWhZFGkE+cL2Nr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642723293, "uuid": "1ef1a665-0e24-4d6a-b68c-93e353d45a9a", "value": 73077, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642723293, "uuid": "9cef7496-fdc1-47ec-98af-b0132f98eb95", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642723293, "uuid": "d1bd5140-cef5-43ff-8fe1-486f48dbefb1", "value": "01f3dd7757424cccb97c2763d454f1a8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e56de448-7aa6-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1642761777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642761777, "uuid": "893a5453-4401-4d08-af3d-c6bfcd068efb", "comment": "Malware payload (SnakeKeylogger)", "value": "81fdc38a4b6cb37f8a591517b295c5b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642761777, "uuid": "a6c631d3-4c66-4cfa-a775-c632961c4d24", "comment": "Malware payload (SnakeKeylogger)", "value": "88e7aa9aa978a99787cc4cbf025e9533897176872a31401f728761520ac01705", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642761777, "uuid": "7467ee0f-6286-4101-a2a1-2eeaca61004d", "comment": "Malware payload (SnakeKeylogger)", "value": "82be36b49d2b735debcdb80b27e6b4aeee2bdfb9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642761777, "uuid": "1beeadcc-76ef-4e00-b2e0-013fc564e0ad", "comment": "Malware payload (SnakeKeylogger)", "value": "4cd72b3f24ecb17fb7b853dcdeeb09e1e8e6f8b718eb01bf4fe1133e14a8e8f7df8859aa8f27dc5ddedd0bec97a09ea0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642761777, "uuid": "a596555b-37ab-4b13-a88d-71854d7a684c", "value": "T19A54E118377577A2D0BE4BF05D21D50087BAB9EA14B3F61E1E66A0D901BBF004791FAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642761777, "uuid": "ecc8b36f-9570-471c-86b6-399a4e14c8ee", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642761777, "uuid": "249e1802-042b-4620-b04a-ed523c6294c5", "value": "6144:hT1T7tvJ/xayxQsvkIh1Z6lLAbcnam2brqOH3/WZRFxX:DT5Fxbasv1wJAAnaNqOH3e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642761777, "uuid": "9e1fa39c-4756-4e64-8e00-282d423a0d96", "value": 294400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642761777, "uuid": "b8a91394-f3d6-402c-aa22-00033d1f416e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642761777, "uuid": "621912b0-4789-4e17-b777-9fc567f6f641", "value": "SF-08984209094923.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3529742-7a77-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642741533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642741533, "uuid": "e3b551c2-47c3-45d8-997c-040855b684d3", "comment": "Malware payload (Mirai)", "value": "15ad65f8488457b473463e837b026fd0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642741533, "uuid": "e00eb543-5dc2-4178-aea5-3e29cdcca3ef", "comment": "Malware payload (Mirai)", "value": "892af17f590a25924eff377b8e84ddb6c4ed64793bb77e0946d5b59f84d06592", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642741533, "uuid": "c9b8d08a-0722-4cc3-8ef3-f63db69f1912", "comment": "Malware payload (Mirai)", "value": "6ec19fb24cf68714d3a2d262e1622721b8aa882d", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642741533, "uuid": "1e3398d0-f023-46d3-988e-3982e67b1e37", "comment": "Malware payload (Mirai)", "value": "2082f102bf353a0ade09f3c6ffd5568d2e9d5400261bac29aa3091e6e74b32277739a416ceb194f0afc3698496b8b16e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642741533, "uuid": "ca76c14a-2c47-436b-accf-8cc769f2d495", "value": "T1ED52F7C2DA42CDFFE81625B9E53B9761D732E02AB484DF47CB3895B1A956000DB1B38D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642741533, "uuid": "29bf7d30-ef87-4c68-8463-dae58526f0aa", "value": "192:fn/dsi6zBzp+N2yUyZI1b1U29Bfd9n0ynB8X/ibEJFPt3ppqi0VYzVUarHIo:fO3+NIzF179n0yBsHJFzpj0VOV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642741533, "uuid": "085c06d5-e9c2-429f-941a-a65ea13a3855", "value": 14000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642741533, "uuid": "e698c18d-b544-43b4-8358-b3040ad6cf72", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642741533, "uuid": "85bcf94b-f943-4e0f-bfd6-cdbf79124615", "value": "beamer.x86-20220121-0505", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94c9b209-7a7a-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1642742744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642742744, "uuid": "e05684f2-651a-46d6-aac9-14d5bb67f7d7", "comment": "Malware payload (Formbook)", "value": "6a5da7edb320b2ba8635683b53db2ccb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642742744, "uuid": "f4ae7fc6-7ec3-4555-8586-dc3b801ee8ef", "comment": "Malware payload (Formbook)", "value": "89c9a52351f75b5be88f745b84dbb5c16930cca9d932f33b008993167e022e70", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642742744, "uuid": "ce028fce-2e1e-49f1-8220-221360961171", "comment": "Malware payload (Formbook)", "value": "38c006c6a2dfa2c238d339151670b0e382863961", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642742744, "uuid": "386574c1-e9ab-42d3-9843-70398d191ff7", "comment": "Malware payload (Formbook)", "value": "d1d52bf39e912a16c2d1d28f181b09843dc7b26ffac712b80effd2d9bbeb3860ffcafb8c1ff63e4712d6320e80cc4e88", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642742744, "uuid": "cac7a0a0-d96e-4366-9fef-630b8e7235d8", "value": "T19DD4DF4133F88B05D97E8BF658311090177ABA0AA875E71F6DD4B2DF0DB2B819B22753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642742744, "uuid": "3ce750a0-4d19-4970-93e3-dfc9207a50dc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642742744, "uuid": "618d1d07-7ad2-48ca-b739-62b07c31f67d", "value": "12288:ovsFtBDBBuBBEBkBBuBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBA:UpQz9th3tOEtJRA9bu6+ievYF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642742744, "uuid": "53838bdc-e724-4909-a3c8-489f6be11094", "value": 647168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642742744, "uuid": "43977ee7-8a29-47c0-9d3b-ee60124cdcb3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642742744, "uuid": "1558d21e-0b1d-43aa-b924-ee026db22bc1", "value": "Drawing.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f26e4baa-7aea-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642791004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642791004, "uuid": "7e69a2a5-44b6-4606-9e82-1e9310fe02cc", "comment": "Malware payload", "value": "17d128d92df7ad648e3a29645ea90be8", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642791004, "uuid": "930974ff-bdbe-45ff-8371-1fcd64a66443", "comment": "Malware payload", "value": "8a621ab467129132da40f27f0ff75403cae0fc6deb071b38a0e062e74678d966", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642791004, "uuid": "571ab32b-59d8-4c14-a1f8-217bed22d7e6", "comment": "Malware payload", "value": "0245fb677a968270d9596b633c9a657d4130754b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642791004, "uuid": "b78de23b-ab3d-4a81-9865-01f9e12e9c41", "comment": "Malware payload", "value": "9dd9ee20a741bc6a4eaf867bece0f7e682684b533ee94784f6d9478a7f0997934c3715eaf7345b15b4c79678c9b0a2aa", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642791004, "uuid": "973bbc8e-8f98-40cb-b2a3-08ecba7b12a6", "value": "T13533F1A976E706B0F93B89760B6807C15F3189AF36C39997BA31E0724B491F039D96C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642791004, "uuid": "28d88948-f70d-4aa3-911d-573365637036", "value": "1536:EhDrrd7k5u0LA+nP5c0ExaTdEWxU+NixJzsVrY4Xr4kTtro:EhfR7kIuBIkTdEWx5NszsVrY4Xrxi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642791004, "uuid": "7153c5e0-7c0c-4fac-9eae-c84734fa61d3", "value": 52544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642791004, "uuid": "521f19e6-ab3d-4f43-9b32-5bccc7ff36b0", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642791004, "uuid": "a28e44c7-58e4-48a4-ae90-249195726773", "value": "daddyl33t.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ddf3c5d-7a9e-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642758167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642758167, "uuid": "f2eacf01-3c63-49b1-bd37-6e65522cbbb0", "comment": "Malware payload (Mirai)", "value": "47dc04b366707dd47e0026bc15349485", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642758167, "uuid": "ee2f886a-9703-4eef-ac6a-007bf6f14c5c", "comment": "Malware payload (Mirai)", "value": "8beeda8cb50580ef7f8c554e351f8c1aeeffd4d86bfca8ae451f0c8a025d577c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642758167, "uuid": "ae00522a-eaf0-4e2e-8883-d4eefe384c8f", "comment": "Malware payload (Mirai)", "value": "69f481032328fbec648e9833de458bdad2f1f4bb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642758167, "uuid": "203cd9dd-a743-463b-a242-43e67ca3ce79", "comment": "Malware payload (Mirai)", "value": "05cc334494673128d452d2c5b64b7451ec8e88f41fccdb5a4440ce11ffda4520fe0e75c6995b0258bd9da33de904517e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642758167, "uuid": "60b0fbf5-f75e-49bd-be10-ee8643175e15", "value": "T1A7234C42322C0A5BC5625AB4253F57E183FFADA020F4F684651FAB468635E3715C6FCE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642758167, "uuid": "d2d1367e-bb4d-48ef-bc04-b7911d714393", "value": "768:Y0dLMsPk12rPAuARd5YWrfI0HwAwRLFt4COSi+Ku1IoDp1:tpPk12r4Xa0HwIn/m1IyT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642758167, "uuid": "fb89410e-9d61-4df6-8b77-1a59490030f1", "value": 46168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642758167, "uuid": "c6332e8c-c44c-4349-a1d0-2c31d0e34cd0", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642758167, "uuid": "40c3b3f1-fd7a-49de-8ef8-b450612b12c0", "value": "47dc04b366707dd47e0026bc15349485", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14a457d5-7a53-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1642725778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642725778, "uuid": "862c69b1-f94f-4ecf-814e-4652d6aa9630", "comment": "Malware payload (SilentBuilder)", "value": "0099ca4f04e55ea6cf57200813bed463", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642725778, "uuid": "80cfec45-bbb0-48bf-9d63-223446ffe72a", "comment": "Malware payload (SilentBuilder)", "value": "8bf7d7d4defb13d445be8e02c114fbe19561d60aefe633018efe1627b4cf3d24", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642725778, "uuid": "fe56309f-5ef3-414d-a8c9-74934604bb45", "comment": "Malware payload (SilentBuilder)", "value": "6fb3a04552a486fc1ddabca59b1087b61ffd1b87", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642725778, "uuid": "2b9f8859-a0a7-4878-9de8-8959feb76a69", "comment": "Malware payload (SilentBuilder)", "value": "d76dc4eeb559234a0b62f23a0d5e72f91b1e670ce3d57c3f71e2523157a159e0ecfc7cfab0508fff0babe3d59ea97884", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642725778, "uuid": "b5beb61d-9d27-4d21-823f-15ae6fa898bd", "value": "T1A1636CA7B78299EADA0483394DB643C5B717EC104F9A43C73694F7346EB49F08D9324A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642725778, "uuid": "9de68596-896b-4128-b8c4-c3e1bf532fd9", "value": "1536:bpEk3hbdlylKsgqopeJBWhZFGkE+cL2NdA8eXZiozeOgXVZKyaZpvyR1kZkJvU+:bCk3hbdlylKsgqopeJBWhZFGkE+cL2Nr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642725778, "uuid": "be601a2e-64d0-458a-97dc-6554239c3c16", "value": 71955, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642725778, "uuid": "582529d4-bbfe-4f10-a52c-f5d3b49bea3f", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642725778, "uuid": "4829d5bd-88af-4bd9-8b14-39ec407dfeef", "value": "0099ca4f04e55ea6cf57200813bed463", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75d33093-7a5c-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642729807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642729807, "uuid": "f84ee9e1-40c4-4251-a0f9-edc48469f080", "comment": "Malware payload (Mirai)", "value": "b9acc2222d86deb1b6618b5b8a64b3c5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642729807, "uuid": "bc670849-bd4f-46a2-bdd9-a5bdf269a4f8", "comment": "Malware payload (Mirai)", "value": "8cf1e2705a6e46fc1e1fbdcb14d5afe13c68b373b3e02f884a8d023f91acf5ff", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642729807, "uuid": "150f3ff5-746d-47f7-b889-1971c459aeaf", "comment": "Malware payload (Mirai)", "value": "38b56fc2652cf6b5a58e9e456e74f7f17031dd42", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642729807, "uuid": "62d48354-19bc-4500-9155-a4890b83fc41", "comment": "Malware payload (Mirai)", "value": "f3f22835b34f9932c8c074ba802fc34515d639fde90b9707845d88403863795cc3c8fa9712e0c4946cd020803f3ca30a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642729807, "uuid": "dd59f83b-ad08-4116-acc0-e904d2f96aaf", "value": "T11FC32A46EA408A13C1D61777FEAF41493322DB5493DB330699285FB43F87B9E0E67A06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642729807, "uuid": "940127f6-ba9d-4d2d-ae87-119534831887", "value": "3072:1jEI2+pFLhLvEP0+bX5BtbK3+D+XtdM/9rzHM/:VEI2+tvN+bX5B9Ks+XvM/93M/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642729807, "uuid": "6a4f9ffb-13e7-40b2-8ec2-edbc9f16f0ec", "value": 128047, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642729807, "uuid": "eb22fa84-e85c-4ac0-beb7-817a5c094dfa", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642729807, "uuid": "77ac9aa1-0403-4589-b80b-92d95fbe7d16", "value": "flow.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "501de4e7-7a4d-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1642723301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642723301, "uuid": "b9d1f0f6-42ba-49a8-afb6-770d9f508213", "comment": "Malware payload (Gafgyt)", "value": "fc2062b8457d991cfa453139fe73bfbd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642723301, "uuid": "3f623b65-8559-46f0-847b-ea1ee3280ca7", "comment": "Malware payload (Gafgyt)", "value": "8d4a3886d280bf15362df7b726458b2cd8902886516b03c368653aa8d2fbc3fc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642723301, "uuid": "2941584f-bce3-4083-8c5e-595c0f0b955c", "comment": "Malware payload (Gafgyt)", "value": "f7ba05da2de9230757ee38850cdfa210b4c5f2dc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642723301, "uuid": "e2e0cfde-89a4-488a-a95b-b9dbdc6ee5ad", "comment": "Malware payload (Gafgyt)", "value": "e58da37c0fe59f5b14e4678827f5251794bc0213398e57209458d3375ee7c13ccf53a1932a33c4eec9ff25c4226e79c2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642723301, "uuid": "6f99fc04-6efa-4878-a23f-67ab773b100c", "value": "T1D8D33A4AA8A09FF7C056B5B624AB29200715D4921B2F1B9A753D5EF0078F6CE701FF78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642723301, "uuid": "f9824694-65cb-42fd-9ddb-dcc924fb3a74", "value": "3072:cgUVzBamx1nYXQXfefsGBTrdl85hUBpe/TvieaABmcYVy84GvrrFW:clVpxJeEGjl85hUmTR3BmcYVy87vrrFW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642723301, "uuid": "853995f6-22d4-4009-b729-0bde0f435636", "value": 141787, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642723301, "uuid": "acac3bf1-5b95-48a1-a66e-ad44ae019dca", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642723301, "uuid": "da43c455-4237-47bc-bab0-242986a3bdbb", "value": "fc2062b8457d991cfa453139fe73bfbd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "925f8a8e-7adc-11ec-9275-42010a9c0029", "comment": "Malware payload (JSOutProx)", "timestamp": 1642784830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642784830, "uuid": "352f8ba5-3931-4bd9-a8f2-84877c48a8d0", "comment": "Malware payload (JSOutProx)", "value": "51053542faeb4aec82c2ca055f66b7da", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "jsoutprox", "colour": "#7071E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642784830, "uuid": "3d4c513e-26ce-4cb7-b0de-2a88a31992a1", "comment": "Malware payload (JSOutProx)", "value": "8dd612b669258300f7ffa220dd855d6c302612772c9a142b963a058f43c5f96a", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "jsoutprox", "colour": "#7071E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642784830, "uuid": "7745921a-5c69-4721-9c1c-2fb735be2e66", "comment": "Malware payload (JSOutProx)", "value": "19c87ba8e53d4618abb008fccdca89102ad5a297", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "jsoutprox", "colour": "#7071E5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642784830, "uuid": "269be85c-8051-409c-ba84-8ea18c1392cb", "comment": "Malware payload (JSOutProx)", "value": "d8392a176ef268d31dfb9b2b53e68a817ffa9d3f268f48a3e4a0a8a9683b3454dd1567b9ae23429a166f718ca50ae1c1", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "jsoutprox", "colour": "#7071E5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642784830, "uuid": "4dc7eb1f-fb2a-4902-a4ae-7a5205fa2e92", "value": "T1C33512582336F77C8A8C456E2A091E4C6E8E0DA240FED2BB585FF5EF65A361804FC475", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642784830, "uuid": "f0836bac-197b-4601-bd14-9108cade1448", "value": "24576:ODB75G2dnnKw+R1BlnVloy0lINgQGXHt76SvIT5OM:eR5G2dnKw+7X/olCNgh6ScL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642784830, "uuid": "8f56eb3a-987e-4af3-a4b7-c7d5fd600adc", "value": 1114937, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642784830, "uuid": "33d6cea7-6428-4117-bfbb-b342fbfa6c2c", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642784830, "uuid": "15380b0e-b948-4a6d-8838-88cbe6d0275f", "value": "CTS_Complaints_202201120210086_details_pdf.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71a5d9b3-7acb-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642777474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642777474, "uuid": "5c177d35-bd76-40d8-88b9-5dd3f171df17", "comment": "Malware payload (Heodo)", "value": "b3675e464df8fa2c3a01f8a13edf0b11", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642777474, "uuid": "5555d52c-e803-4c0b-8687-1d76acb11de8", "comment": "Malware payload (Heodo)", "value": "8e159f41948a8430b7b77d44a6d305bdfc0055abdd1bf63ff06c26651b23fa80", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642777474, "uuid": "8ee42773-a798-4c57-aee7-a2bb4e4627ae", "comment": "Malware payload (Heodo)", "value": "bd0975f6a942f3b92b9dad146b6b686ae485a8ca", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642777474, "uuid": "4c1166c3-951f-4669-ba0a-7291e8dc6d8c", "comment": "Malware payload (Heodo)", "value": "835457e4eeeddd87d2651231111ff7361835ef5902caa4bc6513ed270e4cefc11b694c762b7f0afbe9c440ba49fa141c", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642777474, "uuid": "fbb46b54-c828-4e58-a680-5df50a87afcb", "value": "T1F0636CA7B78299EADA0483394DB643C5B717EC104F9A43C73694F7346EB49F08D9324A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642777474, "uuid": "147c64d0-3c2c-4e79-b6f4-6165d5617301", "value": "1536:bpEk3hbdlylKsgqopeJBWhZFGkE+cL2NdA8eXZiozeOgXVZKyaZpvyR1kZkJvU+:bCk3hbdlylKsgqopeJBWhZFGkE+cL2Nr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642777474, "uuid": "8c180904-0363-4a6f-8b4a-87c28aaabd40", "value": 72088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642777474, "uuid": "4fec0b7c-e581-4e63-9885-b3d4f69a8017", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642777474, "uuid": "5e8ec547-daeb-4745-8c79-6a6f239ded60", "value": "report 01 21 2022_1.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccbad539-7abb-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1642770755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642770755, "uuid": "0f709caa-369a-4544-9575-c3a4844ffee1", "comment": "Malware payload (Formbook)", "value": "e5951c540578e55f51dd0495ebcb6e61", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642770755, "uuid": "9827ea60-2b7b-4254-b57e-29206872aa28", "comment": "Malware payload (Formbook)", "value": "8e4da8766eb5ea763138244606bbdbafd4297a332988868411194d067724e24f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642770755, "uuid": "99a8aee3-88a7-4b06-8e7b-b043b68a24da", "comment": "Malware payload (Formbook)", "value": "301909d4cf5f4a4f847ccc9378dd91a5e7f69659", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642770755, "uuid": "52627a80-2900-493a-b7f7-605543cf9c35", "comment": "Malware payload (Formbook)", "value": "64bae53f7f1f347c29b184e17e31607f29356fa9a7639edf52b8aa577cc6ed46cdff20430339250dff5f2e29bdfc0834", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642770755, "uuid": "0fd1cf5e-1723-4068-acc3-6b964bd2f5cd", "value": "T130E4DF4032F88B05D4BF8BFA5831409017BEBD1AA865E75F6D91B1DF0DB2B809B62753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642770755, "uuid": "c13204e4-4214-4f03-9c89-afe228da530d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642770755, "uuid": "e69b55c4-29c8-49ea-a611-b9186d700e0b", "value": "12288:61Z3NpQbbDhhUNkxFCaoEpftUAKtk7lhjq6+ievYF:WpQbPhG+xEarfVKg+6+ievYF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642770755, "uuid": "79964d3d-75fa-4060-8f3e-4f1b830bd69e", "value": 684032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642770755, "uuid": "57575eda-a31b-4a57-8483-de1324f6225a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642770755, "uuid": "e0a2ac14-e4f7-4d4e-b32a-479959877531", "value": "aguerozx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de0e99d4-7aec-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1642791829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642791829, "uuid": "d8033073-72ea-4b55-a54b-4c9e4f91a964", "comment": "Malware payload (RedLineStealer)", "value": "e939bf700bbfae7c48f71a76bfeb0407", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642791829, "uuid": "c9306c5f-ef77-485c-9b6c-a4fda97ff75a", "comment": "Malware payload (RedLineStealer)", "value": "8e9aae404ccd79f4b2358431194563e1d7dec5bc7bf534682446a45f2a585d0b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642791829, "uuid": "3debdef5-259e-4d6a-84e7-5adfec6bd151", "comment": "Malware payload (RedLineStealer)", "value": "7344cce2be92f3ad0c71bc11c46a4a89d4ddee05", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642791829, "uuid": "ebc1408b-524c-4c73-ba05-17fc1505fd1c", "comment": "Malware payload (RedLineStealer)", "value": "77d129631ea461cc864e0908b38f9a742885ec57bb4a467724534d71f8f29c76d3b63bdca826643a12a9764810d1c359", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642791829, "uuid": "6ad8295e-9942-41f8-88e6-b943d5fc159a", "value": "T151E4E1107AA1C039F6B311F4497953B8B53E7AA1272881CB93E52AEE57346E0EC3135B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642791829, "uuid": "18a27777-524d-480a-ace5-45ecdae5eb2a", "value": "9da0e72ef0ce0c441e86840001cd2ef5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642791829, "uuid": "64982078-ec55-4a73-9372-f9890ac96362", "value": "12288:N7VhdAVvAv8XUB880SvmS33Owwbl3QJSpFuh5Fmsbw5k:JmJAv8EB8J0m03OwwbGSpFu7FmsQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642791829, "uuid": "5cb79d48-984e-42c1-aa14-44e1ddb71fba", "value": 714240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642791829, "uuid": "534227fe-bccf-4f84-a8ea-13f086365beb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642791829, "uuid": "468de630-cf9a-4d61-8cef-7f4a731e078b", "value": "e939bf700bbfae7c48f71a76bfeb0407.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "765615ab-7acb-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642777482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642777482, "uuid": "82f5000f-1aaa-489d-bad0-497ed6fef4ac", "comment": "Malware payload (Heodo)", "value": "b9247d4f7c6fd5600b9c3f0a8380acdb", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642777482, "uuid": "a9bf09d6-2444-4538-b10e-8a5922ca7761", "comment": "Malware payload (Heodo)", "value": "8f85561d2b7a899d3c3f3b80aede779451737774e74cf567acd7943246c43e2f", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642777482, "uuid": "7326c7c6-8a2d-49a4-897b-ee10e3355a1f", "comment": "Malware payload (Heodo)", "value": "05f88138ef99abce524061966208067ddfcbc20d", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642777482, "uuid": "951dc5fb-4e84-4b76-ab6e-b9f6fbe2e90b", "comment": "Malware payload (Heodo)", "value": "dfaa4af8c34edcb94fcd7f293ea0c42eda6d850b0d231e4aa4213ee1bfdd47016eaab942435c555b2f3b291a9b127a77", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642777482, "uuid": "76c7459c-7e86-40a5-a1b8-ab7e552e4dca", "value": "T167636CA7B78299EADA0483394DB643C5B717EC104F9A43C73694F7346EB49F08D9324A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642777482, "uuid": "ea36f6f4-085d-4121-af9b-00c4502afda9", "value": "1536:bpEk3hbdlylKsgqopeJBWhZFGkE+cL2NdA8eXZiozeOgXVZKyaZpvyR1kZkJvU+:bCk3hbdlylKsgqopeJBWhZFGkE+cL2Nr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642777482, "uuid": "8b1a79c9-dfed-4119-8776-84fa6cbcd948", "value": 73053, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642777482, "uuid": "2d4b17be-dff7-4731-bbee-32136e6ece70", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642777482, "uuid": "5f6dc464-821f-4270-8849-c860336841a2", "value": "YZ3254488849.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3213558-7aea-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642791006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642791006, "uuid": "5664a0e2-2adc-434c-922c-79bb83e455df", "comment": "Malware payload", "value": "fed7bc9245992524b567b9ee8483fa4a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642791006, "uuid": "15402744-9551-4606-863d-584e09b7e93d", "comment": "Malware payload", "value": "8fcbf7bbeab182103e9a5d47105f1cea95446b38a3a4ad26ce7e53731e9d0b46", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642791006, "uuid": "30e50900-7b23-4dd6-a854-766e19a83191", "comment": "Malware payload", "value": "8b0d1de334cc2ff8cf894b95c53585c3f31a6e1a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642791006, "uuid": "95ef32c4-1997-4173-add7-6b39e5173c1c", "comment": "Malware payload", "value": "29e0672e0cc9a51f3486024a6d5ca1bbdcd12232012a6a0d8a7535306e0bdb7248bccf39946e3f5c3eb9f5b71311d547", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642791006, "uuid": "3b5b7e20-3f39-4fd9-9027-3f0df0ca71ad", "value": "T11223F161E9C1E4B1CEE22D35CD3E4B4B8337C775EC4B929211295539FFC9122A8AC68D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642791006, "uuid": "ffbb71af-4364-43b0-aa29-78b4974f10a3", "value": "768:PAAtMpe/dpIL7kVyRlJqj5ggqIbHT/AtygCMIVRLKlb0x3UUhPgRmId:PRt143kQRlM1WIgtylo0Rgt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642791006, "uuid": "5238aff3-99a4-4392-8b1d-08c4402c48d4", "value": 49528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642791006, "uuid": "50a784e6-5acb-4827-8687-095c65a27a96", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642791006, "uuid": "05284f86-0b89-4314-b530-9cf2e8c71ed2", "value": "daddyl33t.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fae6d840-7add-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1642785435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642785435, "uuid": "b12486a5-53a3-42fd-9198-8a52e80f3c6a", "comment": "Malware payload (AgentTesla)", "value": "1a2cd383838da17ae8823c722be036ca", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642785435, "uuid": "ace91e06-807d-45dc-8a1b-44fec8446bea", "comment": "Malware payload (AgentTesla)", "value": "8ff3a9677131d5f17d08063f7133019c1571b41bca6ee0aad1223f1780674839", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642785435, "uuid": "5c329080-b9ea-49af-9bf0-a78db7f64c64", "comment": "Malware payload (AgentTesla)", "value": "58542805f1d57f1133201a68e437363f48207ea0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642785435, "uuid": "7edd9f09-b008-4683-9d08-ef40fdbab1ab", "comment": "Malware payload (AgentTesla)", "value": "2f626fe1f7e8e4bd127c62cf16dd20dfb0c92fad8c8b0d11000245b418ccae7501a9955ebcfac86521fba04f7693d46c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642785435, "uuid": "98194e3d-e3a8-4b5e-93de-962c2ba0c330", "value": "T1BB15189D325071DFC867C972CEA81CA4EB61747A971BC207901312ADAE0DA97DF246F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642785435, "uuid": "d18e5f11-953e-4799-8980-45a72f669c3c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642785435, "uuid": "c3625962-b07e-48bd-85a4-a4ef4cb684fc", "value": "12288:vfOEhTgfJEjFpQE0Rt1tmFI7C9//YGRomAZB8dw/IPMBpwQ2T9q6+i9vYFGmEPg2:vf0ipQEaQ3QGEZB8EIUBpwFA6+i9vYF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642785435, "uuid": "1f4dad85-dc8b-4c1b-80a7-fe26e117bc8d", "value": 888832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642785435, "uuid": "f8069b8f-3811-4e4a-9bd5-40745d111f0a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642785435, "uuid": "39e71ae9-fc87-4bfd-ac35-0f1596719d9d", "value": "Purchase Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcba694c-7a66-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642734275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642734275, "uuid": "92e12fc7-f203-4275-aacc-65506ea927d4", "comment": "Malware payload (Heodo)", "value": "efb3f62043e41427d07fedf61f4ae2f6", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642734275, "uuid": "02a1873b-3224-475d-9a38-53ebaf7f51db", "comment": "Malware payload (Heodo)", "value": "901080be2ebddd84578b1c86870709fc36d04777bb2a6baa69234b7aab046a1a", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642734275, "uuid": "3531f3ff-f3d1-4d67-a45f-2845bcc18ccf", "comment": "Malware payload (Heodo)", "value": "457bd6a05151384cd164cd92ddd6abc72e93cabc", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642734275, "uuid": "22cd6ff8-bf6d-42bd-8cfd-7eca651015ac", "comment": "Malware payload (Heodo)", "value": "4c006ec4fca4f5a3d6dc22dcde0562a241c92064ad951b228cd7cff278eeaba017ff6204b88c626b71e03a69c5f925a8", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642734275, "uuid": "4a519c86-f835-4446-9f4f-3f69506db6f4", "value": "T1D5636CA7B78299EADA0483394DB643C5B717EC104F9A43C73694F7346EB49F08D9324A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642734275, "uuid": "04ceafec-dba9-4b8a-b444-dadc561595f2", "value": "1536:bpEk3hbdlylKsgqopeJBWhZFGkE+cL2NdA8eXZiozeOgXVZKyaZpvyR1kZkJvU+:bCk3hbdlylKsgqopeJBWhZFGkE+cL2Nr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642734275, "uuid": "4fc86a37-1741-4d99-a67d-249b350cfa79", "value": 72970, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642734275, "uuid": "1cc6cdb2-3e28-48b3-8cb0-9e266c79d1ad", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642734275, "uuid": "93f603f1-8b86-4aad-b2cc-7ede2b66faa6", "value": "efb3f62043e41427d07fedf61f4ae2f6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb232e2b-7aab-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642763880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642763880, "uuid": "3f05f625-38d9-42c1-8ae2-6dfd56b08089", "comment": "Malware payload (Heodo)", "value": "18b5a1e674cc00006b766b5af9e94880", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642763880, "uuid": "e4463b8f-5fa9-4457-a8a0-89951be952a1", "comment": "Malware payload (Heodo)", "value": "901e7496b8d39a2e4ae4cc706181c2aea55e9aecb075e2d30c6ed2043ea26b04", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642763880, "uuid": "7391c94b-e946-4106-a056-cef6438c0952", "comment": "Malware payload (Heodo)", "value": "840a62911d91c3f589b646e73bfeca1482aa5135", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642763880, "uuid": "52bdd688-c917-46de-bd77-10c93b59ff76", "comment": "Malware payload (Heodo)", "value": "ec1e75ee95ceada6277b96d3dcd5f22ed3ff35b80d55acb7a9a9782cb090bcdffcdb84d816a8eca24f6ba1b4df5af4bb", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642763880, "uuid": "a68a6f38-bad9-4d61-9736-cdfef145d97d", "value": "T160D4B011B2E2C07AC1AF0175595297A973F9BE90D9FDC247EFC06A4F5E315828B38722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642763880, "uuid": "2d16a004-f02a-4abd-acf5-d1960d6c8ca0", "value": "24b46ffcf60dc8d39e8124f411ebd08e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642763880, "uuid": "05ed53ab-3bf9-45f7-abf8-bc19b6ff5744", "value": "12288:vClISqMT89ornPmGZtn5yzrD81ywIdO3D7AfojAxOBnVV0KOFD3EPO7:vmTWornPDryzrwywIdOz7AfOAxsVZOFZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642763880, "uuid": "2f76fb46-f7d6-4e26-bcbe-829b68adb0e6", "value": 634880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642763880, "uuid": "18356a79-327f-417d-9ed9-b6ea02d966cf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642763880, "uuid": "b55dbc2d-d53c-4cda-9a46-46a1d2baf1ac", "value": "emotet_exe_e5_901e7496b8d39a2e4ae4cc706181c2aea55e9aecb075e2d30c6ed2043ea26b04_2022-01-21__111754.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de81e26f-7a4f-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642724399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642724399, "uuid": "e9c222b8-d15e-4db0-a396-afcce9ce7454", "comment": "Malware payload (Heodo)", "value": "e85aa320fc84a740efaa1e2ce533bcda", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642724399, "uuid": "29252794-7b49-45ec-a439-f8a65781628a", "comment": "Malware payload (Heodo)", "value": "9296f02a362c27b1e3a3b4119ede64ea52b6c0430fc70517e5146730c23c987d", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642724399, "uuid": "04f25ba1-ada0-4558-8701-0ee9aada146c", "comment": "Malware payload (Heodo)", "value": "3967a9b469537e2d5854727020d298f37edded63", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642724399, "uuid": "568697f1-bcbf-43a9-92b2-ba8dc1008633", "comment": "Malware payload (Heodo)", "value": "ae086d33b32870f055a2495d454ee5443f85676980f5fa9be63e52fa247ef2bf89855d842dffb911aab047e792f13a45", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642724399, "uuid": "a7e004d6-c069-42bb-ac7f-3a0dab980785", "value": "T167636CA7B78299EADA0483394DB643C5B717EC104F9A43C73694F7346EB49F08D9324A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642724399, "uuid": "81b78860-fa5b-44fb-848f-05eabf78a7e4", "value": "1536:bpEk3hbdlylKsgqopeJBWhZFGkE+cL2NdA8eXZiozeOgXVZKyaZpvyR1kZkJvU+:bCk3hbdlylKsgqopeJBWhZFGkE+cL2Nr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642724399, "uuid": "d9b41d42-ba15-41ec-af0b-82c9c17c95f1", "value": 71913, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642724399, "uuid": "7731b053-c3ef-45e1-a88f-9d55d3489ca8", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642724399, "uuid": "68d26f49-3193-487d-9c4f-daeec7a341b2", "value": "e85aa320fc84a740efaa1e2ce533bcda", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45fafc8b-7aa7-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642761939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642761939, "uuid": "b877812f-0a4b-4065-8419-7b9c9bcde327", "comment": "Malware payload", "value": "95c50ab8d5083411d13f657babf8487b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642761939, "uuid": "f6148438-f9ea-4798-bbe9-8c913025a70b", "comment": "Malware payload", "value": "94f68ab4676e9f1be7aa58ea91ca86423e019928bf617082a8aca088e9a768d2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642761939, "uuid": "d9fcb5e4-2ea5-4538-b3c2-8c9b04955a2e", "comment": "Malware payload", "value": "8b0c91f39aa7ed7387590526e6293777a14afbc2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642761939, "uuid": "c226e7bf-8468-4188-8184-4665fbccca35", "comment": "Malware payload", "value": "633b9c0fcaf56a9a2427ce67b4648a87d1fdb95322106326a4d4e6c2b64eb62ee0a7ea0e4346e2f139f7c5521b174972", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642761939, "uuid": "940f09e8-ef50-4b0c-ae1a-624dcda46d12", "value": "T1F5652372B581E431C0DB5031DD2ACF54A7BFAC76A9865B4333687B16FD322606A6C12F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642761939, "uuid": "8291721f-4833-472d-bfa8-02a04ca07736", "value": "869e638a23c83656faad7512b2575ea6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642761939, "uuid": "8c36b85a-1dac-467e-bf77-c87a267609c2", "value": "24576:4d2WLug81VpXkdD/+SCbXtRGV9ogVtLA2oSZVuygNmlyS1nj4RilLAaz8dyA2wgP:4d3ug4pXMD/HCbdRGV9okt1VtJly6jge", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642761939, "uuid": "cdf6c4a9-c9ac-4c26-bcef-8557444356c1", "value": 1443840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642761939, "uuid": "f459355f-dff7-42be-9987-862c02990eb4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642761939, "uuid": "3bf0ca40-81ab-4892-9047-1b6cf46bf2fd", "value": "95c50ab8d5083411d13f657babf8487b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63c374c8-7b06-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642802791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642802791, "uuid": "a18e29f2-ea64-47ab-bff5-8bef3afd4012", "comment": "Malware payload", "value": "b3a9dd2c6ae38d01d3981e4807366d1c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642802791, "uuid": "4bcf9e17-a400-486d-9290-2bd0e6af6514", "comment": "Malware payload", "value": "9629de4c22e4c89931ded2f394eec19236c0225c913085bbeb42ac6806408b93", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642802791, "uuid": "81051d3b-c2b6-4750-991c-1470ca1ce8ce", "comment": "Malware payload", "value": "8ffcfb30ca27d171e12425d4ed193019f33d32de", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642802791, "uuid": "f3de86e2-859b-4f49-8fb4-ec81b6cbd245", "comment": "Malware payload", "value": "eedf47e3d3c857d7858fa917a7e1c784d1e4a6f23af13a6c751289c27029a7fa1dcdbc08c26a26b8dd7db75496618ce5", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642802791, "uuid": "845655e6-b72b-4daa-be68-e202c2c42806", "value": "T15BA2E0A123533555C332CB7C3BA8740EC0185547719A5E4469A0A69AED5BB3488F8EFD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642802791, "uuid": "39e8cc2b-40fd-489e-90fd-3f4c9fb4b1de", "value": "384:yb2eX3zAKuiNPZRwwqdvrrduMXbCAk6Y5VvCYxy0kQ:/kAKuobq1rduMGAXSEYEQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642802791, "uuid": "aa136539-f529-4cda-9385-80686434a6eb", "value": 22916, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642802791, "uuid": "d7a58b92-4fe6-4464-8117-b60b9dd6a219", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642802791, "uuid": "dd758cb1-a42c-4eec-b4f8-148648822424", "value": "SecuriteInfo.com.Linux.Mirai.6523.30898.8438", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abe49b5f-7af0-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642793463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642793463, "uuid": "9de89649-0774-470e-8cb3-754c886a6f7c", "comment": "Malware payload", "value": "05207166dbf39f9a2dc63f03c4aa021a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642793463, "uuid": "ed3ae81f-f144-4d1f-a690-57c1b9ccabae", "comment": "Malware payload", "value": "9864f84b53a931f244f2f9bd8fccaffbc3f2e552e50f9531ff8dd24041bb4ec2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642793463, "uuid": "be9fdbdb-8d94-46d0-971d-e04a086375a7", "comment": "Malware payload", "value": "a86fd403192895df565f3ba5d6db63269ceb33d3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642793463, "uuid": "a0ff6935-f52b-40d9-95f9-77c443af6529", "comment": "Malware payload", "value": "5be6245ce7e2258c0473c8b80f070deae75faa07670841728d0cf47f21dfea505c2dbd5740d71b155b44a9a900e338d8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642793463, "uuid": "ee211570-86cd-424a-baaa-17eb875ed9a3", "value": "T19C430234EE09C5E433B6943BB06F519A962D9DB9C5913702324ECBDD098BD07BBDB081", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642793463, "uuid": "632de414-d424-4048-b116-cd0da0947ba1", "value": "1536:eLFv8ap1mjF3ZdR8rrG9qGhvsVepw3gk/aDYeZWZAjSQ:eiyCRTR8GEGhKVCt+AjSQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642793463, "uuid": "f5914464-0998-48bd-a23b-71830c322083", "value": 57024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642793463, "uuid": "436ab3c1-65ba-48a4-96e6-e27f29b81171", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642793463, "uuid": "923d3d0d-1594-4297-b234-e3a48f964118", "value": "05207166dbf39f9a2dc63f03c4aa021a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b268702d-7a9a-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642756537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642756537, "uuid": "431c157b-3df5-494b-b521-2921131f6fa8", "comment": "Malware payload (Heodo)", "value": "63d7b15632a48aec697f8345f7bd3112", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642756537, "uuid": "d84e069f-04b3-4d05-8170-94fa1422b591", "comment": "Malware payload (Heodo)", "value": "9882e1e0f5e69867dd9c7c91aecb02792252e680de7b4c64941d0eae0e43542b", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642756537, "uuid": "b7ae1c70-e5f6-444c-a9b5-93b5ad20ddf2", "comment": "Malware payload (Heodo)", "value": "69f94306f10326cd46074dcbf7e9d6104e3c3be8", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642756537, "uuid": "575bd1e4-0018-4b9a-bfa8-87a33a1261e7", "comment": "Malware payload (Heodo)", "value": "e471b70b2d72f36742ecd0a8f5f5f975af872a6ec3d3996c72b1472e27e778c0fe33943b6fb8f32ade24358217d4f11d", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642756537, "uuid": "101c4f38-a29d-4b48-b638-60bed7f9be9a", "value": "T115636CA7B78299EADA0483394DB643C5B717EC104F9A43C73694F7346EB49F08D9324A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642756537, "uuid": "18c9c944-24aa-4924-bd0b-ce319101644a", "value": "1536:bpEk3hbdlylKsgqopeJBWhZFGkE+cL2NdA8eXZiozeOgXVZKyaZpvyR1kZkJvU+:bCk3hbdlylKsgqopeJBWhZFGkE+cL2Nr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642756537, "uuid": "831bac7d-7924-40c3-8d41-47da1495cf50", "value": 71971, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642756537, "uuid": "cb0c342c-ba90-4517-b83e-3bce9af11d19", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642756537, "uuid": "8b2d4cfc-2f50-48eb-b190-ade4c8d7009f", "value": "Scan_20222101_86654.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df6146f2-7ad7-11ec-9275-42010a9c0029", "comment": "Malware payload (CoinMiner)", "timestamp": 1642782812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642782812, "uuid": "1a97a2f7-e153-4549-a18c-90a0c61b9673", "comment": "Malware payload (CoinMiner)", "value": "814e7f7f32964cbf5ec91dbb56768da8", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642782812, "uuid": "fd228d51-566c-4787-b525-086f99f90441", "comment": "Malware payload (CoinMiner)", "value": "99296550ab836f29ab7b45f18f1a1cb17a102bb81cad83561f615f3a707887d7", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642782812, "uuid": "1cc9d72d-2a1c-4d69-8688-11359b922317", "comment": "Malware payload (CoinMiner)", "value": "be5af1cfa10cee0f20bc725f75cc05ff98278d11", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642782812, "uuid": "46e641e4-7886-4119-8a12-6092f237a06a", "comment": "Malware payload (CoinMiner)", "value": "fad7934393c0d17a9c2fee4c26e67e306e909922d349de921b05dc86f5bf6f474a80e2054d13efb5f5279e6bc7e3f627", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "linux", "colour": "#27A4F0", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642782812, "uuid": "7b969df7-fa40-430b-9d58-2ead232efa53", "value": "T15342A411B91137F6603C80F06D46219573083A5F16D83DB9B0ABF8786664BCC96FE9AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642782812, "uuid": "e5efdce9-abca-4fef-93c1-bab5aa7df3ec", "value": "384:/HebVBNfm1BjfeWBJfiL8EqQusxxlfZrDSYUip2lMeIKBIpcLGcl15D64X:fQ3O1FGWLKAEqpGrDSYfp2lMehu6Ga1B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642782812, "uuid": "5da82a31-25bc-4745-962f-a4773cc97f40", "value": 13150, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642782812, "uuid": "2b77ecc4-f23e-46ee-a637-8af9d52ec074", "value": "text/x-shellscript", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642782812, "uuid": "17b8e6da-78e4-42b3-9b37-9305a64125eb", "value": "stx.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bae6f3f3-7ad1-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1642780174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642780174, "uuid": "600c7db7-c51a-446f-bf4c-b51bcf9899f1", "comment": "Malware payload (AgentTesla)", "value": "91e4d1d1b20be93bcaaa2e693e0604fd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642780174, "uuid": "4e175223-c0e4-45d3-b9ea-de94fe710750", "comment": "Malware payload (AgentTesla)", "value": "998ee5404987706b8cf6677ada69b99cbc7ba45183d63b09ee57468e4595f869", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642780174, "uuid": "30390f13-900b-456f-94b6-69b14e612336", "comment": "Malware payload (AgentTesla)", "value": "e01531fe67b99f1e848ef41e87b00d4e13b81138", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642780174, "uuid": "73946742-ae9c-456d-ab23-2ad4dd04c98c", "comment": "Malware payload (AgentTesla)", "value": "95ff2c3df9f5b90b3fb19cd9e3f01896b5986b0099ab1792505bf7e822f6966d8414321744583093c7354d3d0bb0dada", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642780174, "uuid": "e6df3cbf-7697-4fb8-a5ae-8a9c8e376004", "value": "T11594BFB876147DE6666F576BDA96BCDC03B62B6389CB94CC80687BC30563335EE02C05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642780174, "uuid": "6c595ed4-d287-4c85-a019-516d8de206c4", "value": "12288:mN45zrtgVRUXpJLGE1tn2uwBC1voAUq0uOl63XmAf6/oB:Q45zrtgVRUXnqy92wOq0plCXmAf6/E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642780174, "uuid": "990472a4-947d-49e0-b077-eb2cd5fd6bab", "value": 446204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642780174, "uuid": "9e9d83d1-5841-4a9c-873a-754600e1b5d8", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642780174, "uuid": "1802c63b-75f0-4b59-acf5-4dc06f58635b", "value": "exclusive21 3.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28c62359-7a9a-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1642756306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642756306, "uuid": "7723e78f-5942-4f07-8ed5-52f977a55a0a", "comment": "Malware payload (AgentTesla)", "value": "2e3ac2dc06ba513e322966a8e30b92cf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642756306, "uuid": "458ba83c-5b09-43a3-83fe-9b65e284f4de", "comment": "Malware payload (AgentTesla)", "value": "99b8e100456a987815d859e3ff2e84a4ec888973ceb9ee96ae57f39fdbaf88a8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642756306, "uuid": "aeb1f757-5e9f-4b90-ab13-77226ab3e230", "comment": "Malware payload (AgentTesla)", "value": "869b73a64f89580db65cda9acd35c490062b1850", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642756306, "uuid": "db82196d-3350-4996-961e-eb1ed9fe485c", "comment": "Malware payload (AgentTesla)", "value": "4a73e202687ba24cadaf6047462c435da8edd4deb1abca5f3da7c208aa435b52b78eae84b4cf75dd07d6162dd0711f69", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642756306, "uuid": "329ae1bd-e551-45f1-a2c6-eb504003964e", "value": "T182F4330BC9AE511F3385C17DC3ACE57EEB790AE72E390A50B7E003F8D7A6989503451A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642756306, "uuid": "4375f7b9-23b9-498d-af71-f2cddda78f79", "value": "12288:DFo89nfRaaHwaXdwOMpPIbGOhvi4dJnLKHr/nLyFb2GwuME72OivZ/0lGgaeUCEd:poGfRaaHwGdwPPwG4a4ddErNE7ZAV9g+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642756306, "uuid": "66e0f844-322f-4e15-ac2c-bd065042ccfa", "value": 750298, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642756306, "uuid": "f6c78a7d-8285-483d-b761-9e45af426063", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642756306, "uuid": "52f1efdb-e085-4220-86b3-053881d3550d", "value": "Import Documents.r17", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0e3a30d-7aad-11ec-9275-42010a9c0029", "comment": "Malware payload (Smoke Loader)", "timestamp": 1642764722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642764722, "uuid": "c15decdb-32bd-42da-9abd-975c45996e14", "comment": "Malware payload (Smoke Loader)", "value": "dd7c20843584693c36f9134acb464df4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642764722, "uuid": "34fbada1-73a2-49f7-b3fd-8ed3dc956c04", "comment": "Malware payload (Smoke Loader)", "value": "9ad3050367fc8aab3996eedb6bd086731288c5401b587cce63fda64f6732fa93", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642764722, "uuid": "1ecf814e-80e7-4d93-8e43-4decad8dad67", "comment": "Malware payload (Smoke Loader)", "value": "fa8a11198d9232e58c9853fd609e956be3e0be14", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642764722, "uuid": "187f279d-8fb5-484e-a7be-70fe8fa15912", "comment": "Malware payload (Smoke Loader)", "value": "a8d4d88ba10d352c52a5d46ad76bc935b597f83a9ff5c6bda5a429bc11e8fc8a5ae78044b9181e1211dcd6182423eb7a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642764722, "uuid": "73c67e1b-37c0-41a2-9f83-1520bafa421b", "value": "T194648D00BBA0C435F9B352F44A79977CA93E7AB15B2491CB52D566ED9B352E0EC3030B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642764722, "uuid": "fab3b632-4496-4617-931c-83206bb569b1", "value": "475f7058e090be99fd15edb6d2e40c10", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642764722, "uuid": "029a275f-b2dc-4473-932e-d3e232e9eccf", "value": "6144:6l+eNN4FnCauGJJd53Ts/nScL2By2XTLOJLeDtDe/4lERw:6l/IBdJj3TanScKA2XnOJqDtC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642764722, "uuid": "38a9dcf6-b7bf-44e8-8ee4-6b1b61798a8a", "value": 336384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642764722, "uuid": "53f42e3e-02cc-40d8-8005-6cfe46b43bf0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642764722, "uuid": "5257d727-8eae-4f31-8f06-afcf025a8de7", "value": "dd7c20843584693c36f9134acb464df4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27474702-7a6b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642736118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642736118, "uuid": "5f0ec3e8-5c17-40f5-aa61-c36c87e9e516", "comment": "Malware payload (Heodo)", "value": "5a6ac3a9701c7c5323d774b4dda7cc4f", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642736118, "uuid": "cf0bdbd8-55e2-45cf-90de-257e67b90d74", "comment": "Malware payload (Heodo)", "value": "9ad38c251b929edaf974d16b81d02e8b87ca16da14c4aa4eea44df09aa210c69", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642736118, "uuid": "9bb5d1a9-c888-4e36-8edf-ed20d3f9ff33", "comment": "Malware payload (Heodo)", "value": "40e7a5e7b6aebc9d738c63e618444f70531df834", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642736118, "uuid": "e183b16e-d157-4a1f-8fec-7a25465610d5", "comment": "Malware payload (Heodo)", "value": "15f2479ad1c8fad64ad794be301ac1bfc1b039f5747d8dd0ee6f7fa166b9d856a4fd1bd3a1ad99ecc1192e5ca60926c6", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642736118, "uuid": "6d1f50a4-f3c8-4e15-9a1e-7e3838c58b8d", "value": "T12B636CA7B78299EADA0483394DB643C5B717EC104F9A43C73694F7346EB49F08D9324A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642736118, "uuid": "412a390a-c68f-425b-82f8-9b1220b8c717", "value": "1536:bpEk3hbdlylKsgqopeJBWhZFGkE+cL2NdA8eXZiozeOgXVZKyaZpvyR1kZkJvU+:bCk3hbdlylKsgqopeJBWhZFGkE+cL2Nr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642736118, "uuid": "33499616-1b7b-441a-9624-e73bb9302b5e", "value": 73093, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642736118, "uuid": "5192025d-3489-44c4-97e0-ebcc7094c954", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642736118, "uuid": "5ebcda48-e5b8-4cf7-ac97-03b3d8a99c3b", "value": "5a6ac3a9701c7c5323d774b4dda7cc4f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "982c81d9-7ade-11ec-9275-42010a9c0029", "comment": "Malware payload (njrat)", "timestamp": 1642785699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642785699, "uuid": "d6e47e1b-5e19-4505-8b43-3ce3ae1247e7", "comment": "Malware payload (njrat)", "value": "29bf474d20e0b17a36577c6e903e8afb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642785699, "uuid": "bead1d79-214c-48a1-a9bd-97e3027646a7", "comment": "Malware payload (njrat)", "value": "9ba526eaa176389b20e270129a403934a9625fdee27f1ad36ed20289f178421c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642785699, "uuid": "1ca8ccf5-ceee-450a-82ae-b9e8c9ca1502", "comment": "Malware payload (njrat)", "value": "11cf027edff4d91c634b23972c612a9998b7173f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642785699, "uuid": "6c81f28a-2600-49f8-893d-553b7dbe17f4", "comment": "Malware payload (njrat)", "value": "b8e557de450fcc34a5d4cb8b77000c79ca8b0b7e3bbfd2c4ff9deebcc5608b8d4f9baf64f028d26377c603d08cec721f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642785699, "uuid": "ecccd3b8-015a-455d-908a-f79365f74008", "value": "T14025BD7721195F99F83FA33E572154158BF8A52BE72AD2CFBD84A4C74C81F02C726826", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642785699, "uuid": "faf67445-28c0-4d17-8a9b-f6594bdca217", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642785699, "uuid": "4ccaef2b-f4db-4f21-94ef-126dee2be9c6", "value": "12288:Wy2UZBBVjAp/e8Mpgo9bMjpD0hXrWRw+5dub8Yb96XcsrzYDsZRLykgwcqih:WPU3jA5e7gAMjR4rWRnubFiekgwcqih", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642785699, "uuid": "64c5ef03-66fa-4c2f-8978-06cfa681d61c", "value": 1003008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642785699, "uuid": "42b50dde-6666-47c5-94ad-c8eb425e8101", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642785699, "uuid": "9cf4a22a-4002-4a2a-b59d-799aae870a96", "value": "#461432638.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc760dc8-7a93-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1642753601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642753601, "uuid": "888e0625-fa9b-493b-98b1-bbb3d08f2161", "comment": "Malware payload (AgentTesla)", "value": "9c9b16ca53f78a58403b5f6c65131c2e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642753601, "uuid": "a22edcbe-9dba-4978-9519-22d15667a771", "comment": "Malware payload (AgentTesla)", "value": "9c5c5f170031f9f7a92e1fadd7cf7c13097a3a189ffecd2f9576529d3211dea8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642753601, "uuid": "4a9a3386-90f4-4eee-83ab-5b8ae085af15", "comment": "Malware payload (AgentTesla)", "value": "9a1fe24b24eb0421b2137bac4d38e48a93488410", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642753601, "uuid": "d79108ec-5648-4e73-8b20-cc3bb98fc9bd", "comment": "Malware payload (AgentTesla)", "value": "185b139160b4d7296282836f779b5ae95e62a25b6a79a2f447e0012210d573cef0f0f0ac8a9d51ee2e2683f80dc6fbe2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642753601, "uuid": "55cc4e39-4827-4afd-9597-a7f365913047", "value": "T1A3A4D08CA79D5B28D6C89BB8F010BB081FA5B6E4FC1517BC0F5A39A15D073E09276B74", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642753601, "uuid": "3791c391-d4a9-46ad-a2f1-71af0535f72a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642753601, "uuid": "3a0e25b4-429f-44a6-87f5-91b8b1fbc04b", "value": "12288:kuCR+gFzBS6sTIafyV3hh/1pcpyy3eSZvO:gRDUpaVTzcpyy3eSZv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642753601, "uuid": "b7785c4f-c0be-4472-94d4-56ec450d41a4", "value": 489984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642753601, "uuid": "061f3cbf-5b7d-41c2-8f3f-01746503b18c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642753601, "uuid": "c63a8ed2-cd15-4a6c-8b95-d58d49c44c53", "value": "Order No0027776455 01212022.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fa6a472-7a5d-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642730280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642730280, "uuid": "c1f81a66-885a-4b39-b774-80b0c25d1620", "comment": "Malware payload", "value": "c1ecabb05bd61ee76f0682d4a48143f3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642730280, "uuid": "23275cc1-104d-467b-9e0f-b67baf6f55ab", "comment": "Malware payload", "value": "9c7cd86de644d67f36634e5b6df6b66d015e00b57914a094cb2341030c9bd8f1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642730280, "uuid": "25fcd32a-d33e-4c4b-8a8b-5e2ca4d55e7d", "comment": "Malware payload", "value": "8861e3332e4355ec5633558ceecba69efcfa71fd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642730280, "uuid": "6b55e27b-3eaf-481c-a441-493adcec1013", "comment": "Malware payload", "value": "488e93751167e73cb0a6bba2dafdd35613d4fec38463d35a67e9ef4b00220ea3d705dc4ce8503b18668e76bc17175c08", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642730280, "uuid": "8d1ba05d-5ddf-49e2-849c-8a4bf1716ff9", "value": "T1F144E12467B0C4B3C5B00A354DF767772FBBBC1566A19E0317D06A983C623D29E2E399", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642730280, "uuid": "dd0c007b-2f85-4461-a6ba-832722078966", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642730280, "uuid": "5fd3e0ab-b9cd-44df-8023-7b3cb2c5936d", "value": "3072:MbG7N2kDmUpKuP8em2x/cFOjZBk1if/YskPJPRl1aem2Y+S/b:MbESUl89yvkEf/YskxJlE9P+2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642730280, "uuid": "0c452413-3322-4a2c-851e-2919c7bd192d", "value": 275456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642730280, "uuid": "3e3076a1-9c42-4890-9802-9eeef076e4dc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642730280, "uuid": "1ca99d25-a2d4-41bf-a9fd-b9d3b1eaeee4", "value": "ASAPP1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abeb4b5a-7a8d-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1642750943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642750943, "uuid": "f50885d1-5d60-4e51-ac9c-cf5e395c1d71", "comment": "Malware payload (AgentTesla)", "value": "4a7d934236c86778d1ae32ade1a15df3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642750943, "uuid": "919dfc41-21c6-4f8f-a8f0-0b3464aeb41e", "comment": "Malware payload (AgentTesla)", "value": "9c8ee363307d912a2dd08c563f0d9439f1041fa086cbd4920af922dded29e68d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642750943, "uuid": "4129181e-112c-4082-b155-00e5de4bbae4", "comment": "Malware payload (AgentTesla)", "value": "a3d3e715b9d9c11cd56855337220d99088b8b0c9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642750943, "uuid": "f4f54079-6d54-4719-a10a-6385d387dea0", "comment": "Malware payload (AgentTesla)", "value": "d0ad7d3e2ce7675af750c819cf3756dd5208067b8ff56381ec3edfc038713813b053020c9b3bdb07f92ff0328182ccd7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642750943, "uuid": "f3a04978-9952-423f-9173-1edba19804ed", "value": "T13F55CF3262055FD9F53FD3758321B5268BF25A1BE735E2AA7D8124EB0C80F4A8367D12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642750943, "uuid": "bd1121e3-a90c-439b-a4d9-74c270fbdfc0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642750943, "uuid": "83a6ff8f-3eed-40f3-ab7c-4866d243f8ad", "value": "24576:9eZTjAZsU/NbmXBjgyL0CPd/kEXcDfnUF1gekgwk0rU:FCcNbmRjbJdLXcDUFq+d0r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642750943, "uuid": "37d7e3b7-07e1-4da3-915b-f0bdb87eff61", "value": 1312768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642750943, "uuid": "36eebd9e-8993-4a2a-90f3-b9320f9dd580", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642750943, "uuid": "ade8081b-cd05-4e23-a84b-69fdc692b11d", "value": "ALANTECH CO.,LTD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dfc08da-7ad0-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642779562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642779562, "uuid": "5abcfc4e-b60a-468b-bf1c-b24ef68f3b8e", "comment": "Malware payload (Heodo)", "value": "85f04048f0b9093a58a47a6ecd7de92f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642779562, "uuid": "7ae9a86a-2ec1-4bcc-aecd-0e0945736c29", "comment": "Malware payload (Heodo)", "value": "9cffa1ad709a181c1f72fb1e74b37f53b44a280388d28680eef6e9ab462c0455", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642779562, "uuid": "23c60677-2329-43a5-afad-97ee564ff0b9", "comment": "Malware payload (Heodo)", "value": "7e3de51dce1b45ae1658963b28b8d2907788c7ac", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642779562, "uuid": "64386102-53c2-447d-8699-ed918d17daae", "comment": "Malware payload (Heodo)", "value": "25772ce80d426eb125ca257174fa128a41046c6c5b1f773f0ac9f1a2c99470637861acf2fab2a3b44471fa0024bdad93", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642779562, "uuid": "dced44c9-7785-4747-af53-dd231428e49d", "value": "T13DD4BF11B2D2C07AC1AF1674556393A463F9BE90DAF9C257FFC06A4F1E315828B39712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642779562, "uuid": "75aa7a7e-3bb4-4352-a445-62e487faba5d", "value": "24b46ffcf60dc8d39e8124f411ebd08e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642779562, "uuid": "e492c1a6-b7ac-4baf-9682-bf7713b306f0", "value": "12288:kqdJaxkOWFornPmGZqnTFWbDPUYVubhesslBvQqEPO7:kOOsornPTwFWbIYVohevBoi7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642779562, "uuid": "dcb483fb-d8f8-487f-8de5-f1234f4158b0", "value": 626688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642779562, "uuid": "f8a07f13-38af-486a-bdaf-3b6757ea7cd1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642779562, "uuid": "4b058dd7-b529-463e-a476-340348111cf3", "value": "85f04048f0b9093a58a47a6ecd7de92f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4327571e-7a85-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1642747331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642747331, "uuid": "ee79df75-c1f9-484c-ac67-f008ebfc7e40", "comment": "Malware payload (Gafgyt)", "value": "4a116051dca24c00b70538976f3369ec", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642747331, "uuid": "84278f51-8ddd-45c1-a334-194891fb4de0", "comment": "Malware payload (Gafgyt)", "value": "9d82ead689856c499c096c17c7c6bc0096328a183724d4afdb1b15f51fbca681", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642747331, "uuid": "56da5bbc-0302-4480-bd66-d3c74474e20d", "comment": "Malware payload (Gafgyt)", "value": "c56295bdd3477c87858093bfdaba25877292cf2c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642747331, "uuid": "30bf366b-741b-4133-972b-7333d2bff5d7", "comment": "Malware payload (Gafgyt)", "value": "5709ee2f651524770241318fb2536d3e55cb454a7028e5ec51263ceaad19858d1b2a9779dd9a537c5e14675aec5acfcb", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642747331, "uuid": "32b9e266-250a-41c0-89b6-8d0d7e84781e", "value": "T1E8B3E857FB11CEB3C85FDD730AA68A01108DA99746D57B6BB3B4DA5CE74684B08E3C80", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642747331, "uuid": "1df73606-b2c6-427a-ac67-4293f12b60c0", "value": "1536:Tgz/qzNLW/fMiZIX98U0I/QwErQNOp5hVwbfKdwwjF9GhCPR1Ae:Tgz/5f5g8utgl5hVwjKdwwjF9GhsR1Ae", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642747331, "uuid": "2153d49b-89c1-46ce-ae25-a8c2bdf7b110", "value": 116647, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642747331, "uuid": "03354bd0-fbf7-4140-aecf-8a0453ca08f8", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642747331, "uuid": "b3ddc7ef-44c1-4548-8d22-a6223d797f48", "value": "fuckjewishpeople.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7d33a6a-7ab8-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642769404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642769404, "uuid": "5835e9bd-63fe-4898-9a1f-272766704496", "comment": "Malware payload (Mirai)", "value": "52b3561795396c519a92b003de54508f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642769404, "uuid": "3f3b60e4-f851-4c67-bf6b-116f0b426a22", "comment": "Malware payload (Mirai)", "value": "9d855c349e9c36fcebfc07e4094f39f3c8c3eb7a20e302d71071d2caef57a0e9", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642769404, "uuid": "34ef3a64-b1bb-467d-8529-62068cfcb4b3", "comment": "Malware payload (Mirai)", "value": "08af22d751c7f7c72508c57a305a2b8442900662", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642769404, "uuid": "ddcdc2b7-85b9-4a97-8a5f-21cfd1a257bc", "comment": "Malware payload (Mirai)", "value": "c465cafa0e1b71fcba779721f21b26d7815e9803561a0b83dc32493273d12e8c9ab7c491acd818337bae62630bd4945f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642769404, "uuid": "d30efed7-0578-47df-8b51-0add125df254", "value": "T190D2E13CA35E7432C5A2783EE02D8661339393F553E236552E90493CE2C81659BEDACF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642769404, "uuid": "7b187c0c-88e2-47d0-8275-47550f14ed12", "value": "768:XEtZRjTviljUxl7nn4TS9X7ZqOXphKigAs3Uoz5:0ZTvq0lzxJXWb1z5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642769404, "uuid": "99203927-03d5-4a82-bc97-1a4dd676ad97", "value": 28612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642769404, "uuid": "b03f2e1f-690f-4104-afef-596d83b83892", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642769404, "uuid": "83128220-7303-4625-80eb-42f8868c750c", "value": "Tsunami.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6549074c-7a4d-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1642723337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642723337, "uuid": "a804c4a0-b281-4677-a506-234b505100d7", "comment": "Malware payload (Gafgyt)", "value": "461aa55d233b5e946ede318d6b51123a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642723337, "uuid": "95bcb17b-0643-4b2c-ba6f-f1e351f042c1", "comment": "Malware payload (Gafgyt)", "value": "9e746fc0e92c9d003dc45fbde3f335d5783075357ef2764c147610f0b96dcf36", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642723337, "uuid": "e455353e-26a8-4716-b8f4-a13a3990babf", "comment": "Malware payload (Gafgyt)", "value": "281485600fde561e6b1e5f181e34af8c7102d109", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642723337, "uuid": "c7bc2565-6147-4002-a2f1-0257856cdafd", "comment": "Malware payload (Gafgyt)", "value": "655e5d263da5d2f420a85e8cb05b1574122e5ea0b78d798a352dbc9a9c46dde38af3fee826f90c5839ec0938acfd6c80", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642723337, "uuid": "b362b688-4c39-4c85-b970-7b3a86445fd6", "value": "T171C35E49EB43C2B3C4430BB2028BAA5F8921F5BA8A6E8F45F7592CB4AF134C57315F55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642723337, "uuid": "8df0722b-5ea1-4f91-8eb6-7c0305ef23fc", "value": "3072:2bozSBTkh35o/mVjjp4BnK9T9V4Mi/7BaVMHUJnM4mF9tMB105hkp9XMQBLmrMV+:2b3Oeg105hmXjLmrMVduyV/rG+8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642723337, "uuid": "766c522d-9938-49bd-ac1b-fb612eed03d9", "value": 127255, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642723337, "uuid": "80eb8ea4-094b-4faa-b366-7238777a379b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642723337, "uuid": "481e3342-52c6-4bb1-8330-84b17960e0d7", "value": "461aa55d233b5e946ede318d6b51123a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b2a5ddb-7ac4-11ec-9275-42010a9c0029", "comment": "Malware payload (AsyncRAT)", "timestamp": 1642774296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642774296, "uuid": "a85fc71e-7587-4c05-8b77-bf742026cd50", "comment": "Malware payload (AsyncRAT)", "value": "42aea50814ad0d8edce593ca559d142c", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642774296, "uuid": "a59fff79-bd89-4b29-9e07-839249d5bd0f", "comment": "Malware payload (AsyncRAT)", "value": "9f4d88e9eeae7ffc241646d0233acb29bedbc9bc0c124b949567a894f8af6f54", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642774296, "uuid": "47d0419c-42e7-47e8-9d93-40af6dd5f0ca", "comment": "Malware payload (AsyncRAT)", "value": "28af69152d3eac34d9dc8fec0a1ceb2c63de429a", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642774296, "uuid": "09690c3b-5250-4b0f-8830-3b43a38410ae", "comment": "Malware payload (AsyncRAT)", "value": "e5075afa1c80427088da0ce71c572d0a140113b614bbda518f09f2e4b830e965922d46071c83068cbe467769c29ae389", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642774296, "uuid": "05da9bc3-16c7-4ecc-af67-4bd60186fed3", "value": "T1B3B42B343EEA502AB273FF699AE4359BD95FBB633B03585D106103864B23A42DED143D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642774296, "uuid": "00087c43-0889-4476-b969-a9cc76d30534", "value": "12288:vvFmp0OEFNrZYgG/9SaVdUN5ZulY8hCNKDCU+ZF6JtLaxOvMl:va8r2geNL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642774296, "uuid": "76676582-2602-4409-b63a-2a3ddfa4e75a", "value": 497664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642774296, "uuid": "fda94d44-5831-4d80-8843-0703094c6e4c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642774296, "uuid": "faab93a6-78aa-4667-81f5-ca31d735672e", "value": "update_py-final-stage.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ae38563-7ad7-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1642782697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642782697, "uuid": "5485cc8e-c721-45b9-b04a-740a2c5d651b", "comment": "Malware payload (SilentBuilder)", "value": "c0e6f531fbf312ec005f0df8cc39e9e2", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642782697, "uuid": "efd56832-d02e-4f2a-9564-d01de11e01cf", "comment": "Malware payload (SilentBuilder)", "value": "9fef0e22935c3ac29516d148a9e07a033d0568550918e4b2c59bb5a357c54a8e", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642782697, "uuid": "47541cfd-07eb-4b7e-af66-f2e485451023", "comment": "Malware payload (SilentBuilder)", "value": "481536ecd95779240362bd2ac2ab0921cdc24c4e", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642782697, "uuid": "9d81d539-73f2-4586-b659-7ec03f084384", "comment": "Malware payload (SilentBuilder)", "value": "d72be371d7802df1b3f5cd6624ad23ba855e93500ddf409a0c0e65a1d348534f6fc699977d355d06cc8ce441fd82de1c", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642782697, "uuid": "a72a2a85-84db-4c93-95e7-0a2f51716773", "value": "T108636CA7B78299EADA0483394DB643C5B717EC104F9A43C73694F7346EB49F08D9324A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642782697, "uuid": "e775a6b1-b5e1-4af4-b423-b5a6374b652a", "value": "1536:bpEk3hbdlylKsgqopeJBWhZFGkE+cL2NdA8eXZiozeOgXVZKyaZpvyR1kZkJvU+:bCk3hbdlylKsgqopeJBWhZFGkE+cL2Nr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642782697, "uuid": "b84f46de-7323-4799-848f-8fb7ab61b065", "value": 72944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642782697, "uuid": "3afa56ad-1601-48b5-a760-127d7358a3e5", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642782697, "uuid": "589d9681-f1b2-4af1-817e-a0e6e73655e4", "value": "Inv CP-4337.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b2985b3-7a82-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1642746190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642746190, "uuid": "44870ba5-cb5f-4051-b7d2-f534f2329c5b", "comment": "Malware payload (SilentBuilder)", "value": "723a7a29e3968f2bb17a07d5289519ed", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642746190, "uuid": "90e3104f-4d2f-4949-aeb2-e38bba96bc17", "comment": "Malware payload (SilentBuilder)", "value": "a012d6c3ff9ac12c39dc7e32fb51008897bf8ec0ea7291f80801a2bcdf195cff", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642746190, "uuid": "86bcbe6e-4fbf-464c-9593-dd96c32c48d6", "comment": "Malware payload (SilentBuilder)", "value": "1f0601076af82bb4a8dcbd270ba53d503dcb788b", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642746190, "uuid": "f2b74fcf-650e-4495-9416-f2f5850b7c83", "comment": "Malware payload (SilentBuilder)", "value": "7f02b5ced89ac3a1fb290b920aa789ddb7ccbd2f1734b16cff99cb327db92dadd2307de604117c5a9317a0bbc8f61e65", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642746190, "uuid": "83929e14-5149-4f2a-82e4-c5ae3bd0cefa", "value": "T183636CA7B78299EADA0483394DB643C5B717EC104F9A43C73694F7346EB49F08D9324A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642746190, "uuid": "08de2a50-3ea5-46eb-9d2f-e0fbeba6ac9c", "value": "1536:bpEk3hbdlylKsgqopeJBWhZFGkE+cL2NdA8eXZiozeOgXVZKyaZpvyR1kZkJvU+:bCk3hbdlylKsgqopeJBWhZFGkE+cL2Nr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642746190, "uuid": "4ea5fcc5-f4dc-4b46-bc55-bad267990f25", "value": 73162, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642746190, "uuid": "d708fcdc-cd8e-449b-8388-a6e180f104f6", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642746190, "uuid": "149af34b-4fb4-4472-a705-09742f0270ba", "value": "723a7a29e3968f2bb17a07d5289519ed", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7024bce-7aec-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642791737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642791737, "uuid": "e6b83017-0635-4996-a1e4-824a3c299377", "comment": "Malware payload", "value": "514bfc0ec820c4d21bd44394a6174391", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642791737, "uuid": "93d2f659-3f6e-4912-b7b7-f4422bfd7e00", "comment": "Malware payload", "value": "a07221f85f3d55ac99e96891e527cdfa81e029890bdc9e90f8eefe5cdffde358", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642791737, "uuid": "e4f1e0a4-ccfe-4aff-a4db-2f0fa09f4c65", "comment": "Malware payload", "value": "4f93480ae64e0c80ae32cd6de348ef08284e0fdc", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642791737, "uuid": "ba3537dd-c7fb-442e-bd44-d0b1de1ad82d", "comment": "Malware payload", "value": "1a92a92994e209a85a01a698b18955e2402a6c377fdf026ed2301392864bbde3086f40a033461d7ce6f9dfd89c0d67ea", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642791737, "uuid": "969a060a-6409-4990-b475-1f6da3cb6a56", "value": "T113D49E2172DACA36C87F06B06D3AC79B55697D6047F2C4EB13D86D1E0DB39C15232EA2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642791737, "uuid": "3b07e63a-d41e-49df-a0ce-1ae2218ad3aa", "value": "12288:rOQhfYBowv43bqKlRH1Vq9iyXrASSON+B:rOQZYBowvitjVqoArASS5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642791737, "uuid": "4e441175-0766-4be7-b612-9e2fa0b0c8a0", "value": 599040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642791737, "uuid": "e1e3f51f-d246-43cd-9ef9-cc187d7d6900", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642791737, "uuid": "9340a2ec-ab88-4ef2-868b-107afde0fd92", "value": "NFE_7258.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b67d758a-7b13-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642808513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642808513, "uuid": "6ce2b425-e629-478f-bed6-c3243d695cab", "comment": "Malware payload (Mirai)", "value": "b516f4ad084feb26178647e1a50fe8ba", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642808513, "uuid": "0bdead3a-1175-4754-a7d8-e619fc21c22e", "comment": "Malware payload (Mirai)", "value": "a179b5f775834cc878eeba71645dec375586a69de08f64e0305d2edd0232db14", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642808513, "uuid": "a2463679-16b4-4d52-a1ab-27fff1b4a5e5", "comment": "Malware payload (Mirai)", "value": "610c1a3d30a91697cf54b43238954475ddfc5f59", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642808513, "uuid": "46571129-2590-4304-84f1-95f564b506e3", "comment": "Malware payload (Mirai)", "value": "c97e4e55a80369942fdd2a99139aecf52e94f1fe21d8a4575bd38a58a20573d7d313fd977744e7eb1b9f1ae0d8bda45f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642808513, "uuid": "398c461b-1bde-4e30-bf3c-acd3f2e649d3", "value": "T167B2E061A3ABB031CA238436F735CB0663D742B1137E3774251488F8B68F84385BE5AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642808513, "uuid": "523d3937-e238-46c7-b031-1ac47834a771", "value": "384:AGqdVAjYUz42Z1Ik1LIt/S+GmsEZdfHW0Suku1VQyV5qubH9LShymdGUop5h0:9qQjYT2L1sJDjdz7ku1VZHBdLSs3Uoza", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642808513, "uuid": "2e8d56db-307c-43c2-9c47-7605639a2049", "value": 24472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642808513, "uuid": "d8378a86-43df-41fb-a0e2-bc4435b10a1d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642808513, "uuid": "eb936c0b-91c7-4329-9c4d-e027389b638f", "value": "b516f4ad084feb26178647e1a50fe8ba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4645ee52-7a85-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1642747336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642747336, "uuid": "4d1b34fd-30e7-49c1-a281-778352d1b1d0", "comment": "Malware payload (Gafgyt)", "value": "4c80eb47213b62d743ff7287705adc48", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642747336, "uuid": "257e970f-ee45-4d59-8935-f0de2a35eaff", "comment": "Malware payload (Gafgyt)", "value": "a1d3eeb54c8498807d86b5b50b92be5fa80703d2c855b0f0fcbe2399c26d680f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642747336, "uuid": "517210a9-d0cc-4f22-9097-1a44abe7f846", "comment": "Malware payload (Gafgyt)", "value": "7ae07d5f71c05e2324996224657eadb7190b5668", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642747336, "uuid": "0d71c962-090a-443a-9e55-7a00ce1a1d5c", "comment": "Malware payload (Gafgyt)", "value": "914adc72bfc59d6957172f88ab03982c0b55745942abd9b155f4a8ac1135a25adadebd95059fb2a9e12aa20401b782d0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642747336, "uuid": "9747b060-73a7-4390-85b1-263ee3745420", "value": "T17A933B07B71C4F43C1DB59F029BB2BF15769B9E112A36181B91BAEC05B33AB81523F94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642747336, "uuid": "8aef8192-4a48-4d69-8337-a8e84eb18b00", "value": "1536:T3oCu/OcwUBvPsTbwHH3P6zMSIHsiO6aRv/lz5M5hLg6wOFO6V6qDjjofSee:T43/qUBvPs6X03IHsi2/45hL7wOFO6Vt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642747336, "uuid": "f5d3234d-c1e1-4a7b-9a63-4268816b379d", "value": 92720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642747336, "uuid": "6847f3f4-9e15-402c-bfdb-c5a00bc4fce1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642747336, "uuid": "c84cc5e3-0da6-4ef9-b04e-1d8539db57ec", "value": "fuckjewishpeople.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6669d248-7acb-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642777455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642777455, "uuid": "3348e0f8-ef41-45b3-9152-20cf4aa599ee", "comment": "Malware payload (Heodo)", "value": "d86819b35c3520d8d352bc596652dd78", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642777455, "uuid": "cead385b-cc72-4b9f-beee-6a73f53b1922", "comment": "Malware payload (Heodo)", "value": "a203728211bbed3c28d36190068db7249c40d520ec56121989e3fd4e41fced87", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642777455, "uuid": "9312d498-0b61-4897-9a59-21c6b30e114e", "comment": "Malware payload (Heodo)", "value": "4be60803a0d343285472caa91686c722be008832", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642777455, "uuid": "f940f0d0-f7d6-4994-aeb5-e208b7b3f9d8", "comment": "Malware payload (Heodo)", "value": "45cec78e4775c09e63d136143027085705a579ad52abe1205f3d261dafabcb03fef0a80d31e84613388407f3edb401e9", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642777455, "uuid": "c1e0d514-ac6e-478c-80c1-9efe1d392c71", "value": "T12D636CA7B78299EADA0483394DB643C5B717EC104F9A43C73694F7346EB49F08D9324A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642777455, "uuid": "6270cd9e-5516-4f5a-bc73-5ca53f27e31f", "value": "1536:bpEk3hbdlylKsgqopeJBWhZFGkE+cL2NdA8eXZiozeOgXVZKyaZpvyR1kZkJvU+:bCk3hbdlylKsgqopeJBWhZFGkE+cL2Nr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642777455, "uuid": "c654bff6-25a0-4579-bc34-064b87922f9d", "value": 72714, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642777455, "uuid": "91a725fd-0b8b-490f-b6a1-a307c06dd419", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642777455, "uuid": "d98be8bb-69dd-48e9-ad07-d08a73d3f8ad", "value": "Contact_1.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bce21a5a-7a9b-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642756984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642756984, "uuid": "4daf6e6e-2ff0-4f20-be65-d7107e9c9d8a", "comment": "Malware payload", "value": "4a331cab77be6ac53ad9c9fb70da04af", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642756984, "uuid": "e25330ff-16b9-4ae6-bf0c-43fa73c39316", "comment": "Malware payload", "value": "a2404d57c905b90dde56953f25ae40f7693f070e674097b50ea452bc3d435ad6", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642756984, "uuid": "917a65ab-6c4e-4f65-9600-ab7468acf642", "comment": "Malware payload", "value": "19cc38ab1db0ef7b4141f39c5411e75fa7cd4929", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642756984, "uuid": "c12f9cef-0bfe-4829-ad91-be0debd0cd53", "comment": "Malware payload", "value": "a8621e1c13b7f606f685ed6cad106866025caa70f104b7badf20615ac14172bb0e31c613a244e9dec5b7d0f58b3ba44a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642756984, "uuid": "7b6a6fe5-a4b4-4e53-a534-9c63e8a696aa", "value": "T1FA81095EF437C087C04486394D65C8A09014EC57AE3E5907B2663EFF5EB19C8C6968C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642756984, "uuid": "6b0e830d-e2b7-4c1f-a2bb-a77d1cc6a723", "value": "48:rkvcHUKlo0aEluk4cg9t7Iov6r3S/QAK:IvcU9ptcg9tkoESn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642756984, "uuid": "5d9f213c-caa3-4819-8cf5-0a03625f8ef7", "value": 4096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642756984, "uuid": "ce3b3325-548e-49a3-b3c4-db3c01396ada", "value": "application/CDFV2", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642756984, "uuid": "d0336bb4-a096-4307-8935-51744f523b80", "value": "SecuriteInfo.com.Exploit.CVE-2018-0798.4.19280.30293", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6286339-7ac6-11ec-9275-42010a9c0029", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1642775549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775549, "uuid": "14730bd8-2ec9-4d35-a4f4-c3425951c5c6", "comment": "Malware payload (RaccoonStealer)", "value": "b6bc129f5f9414bb8f4107aee41ca450", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775549, "uuid": "86c29483-4f8d-4b4e-9a6f-11562abadae8", "comment": "Malware payload (RaccoonStealer)", "value": "a25181f11132f02a3c25d574e5070686e984251c4558f0794eceef7469eba51a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775549, "uuid": "3dc37a8d-f83a-42ed-9143-6d7a05d1e7cc", "comment": "Malware payload (RaccoonStealer)", "value": "2bc9f127d2baa0269afb901f5f72c58f1828c998", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775549, "uuid": "236b851d-1687-4d4a-abed-14d422ba51ac", "comment": "Malware payload (RaccoonStealer)", "value": "655a4006e4978c6ea0474a3b9bd8af5e1733ae589b0dc3a25ea5ea2e69fbde1bd54594321ac49fad42e6cece70ce956f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775549, "uuid": "e70f6abc-df3b-418d-8859-b8e3aa14827c", "value": "T12EC401317A91FC31D88216344036CFA25ABEBD3558A0464773E9272EEF36390B62675F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775549, "uuid": "6fd6c0ef-dec0-4fad-bafa-7c2dbb403a0c", "value": "869e638a23c83656faad7512b2575ea6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775549, "uuid": "d64d8563-fb17-4fac-80d9-b79bfc3fcdf0", "value": "12288:foaAa69iFsrtBuDHCIN5Nyp9kzhrHs4IZk:ca6QFshmHCIUp9I9HlD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642775549, "uuid": "c2012bd0-90c8-44b9-b9a4-ee19d84e8971", "value": 548352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642775549, "uuid": "f3067447-72da-4284-907f-b2e2ea819d40", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775549, "uuid": "e3b39535-a6c8-4efc-8796-82bef4537f4e", "value": "b6bc129f5f9414bb8f4107aee41ca450", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c323319-7b04-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642801973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642801973, "uuid": "3fdc6835-b20d-4022-ab06-9a155eed1b25", "comment": "Malware payload (Mirai)", "value": "9ba70754a0fae4754ad3fedea935fafd", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642801973, "uuid": "254cbbac-bc88-43bc-bcbb-f9cb26825159", "comment": "Malware payload (Mirai)", "value": "a2adca2326c3cc9590d05047fed290f1ae1234cd81efeddfdf3d64c290637617", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642801973, "uuid": "f0b8ccdc-d275-4599-b609-045db4505fa5", "comment": "Malware payload (Mirai)", "value": "34963921a4bbc20b6550c803449832ee35ff914e", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642801973, "uuid": "35fd18fe-ac07-43d4-8189-688a0f083c4f", "comment": "Malware payload (Mirai)", "value": "a5c0b19022699ab74782dbf100614a28368486118eeb1812462d51a217cd9b96abcff47e734cdff6a102387fab2c0365", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642801973, "uuid": "c58858d2-79be-4e39-96e7-1340a9096803", "value": "T19FC2E013E1F9EA23FCB3C2B5BF5F22AA92519124B93D3114BBAC09D594003AF47547B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642801973, "uuid": "3e6712d9-9153-4c89-aff5-1d8a95be0095", "value": "384:PNhjOs9I1EUnfAq2hELvV18/BZLp9hk02YWiSk6gN2EM5B7hq:Pbas+mUffioVC/BZLnHGgNvMk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642801973, "uuid": "aae2662d-cd7f-4bf5-8709-65f5bcba838d", "value": 26684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642801973, "uuid": "8ac8b888-1f78-44d4-8381-b1a214a63635", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642801973, "uuid": "7469eaa0-1b78-4406-af7c-16dd2e535d69", "value": "9ba70754a0fae4754ad3fedea935fafd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f8ab3f7-7a85-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1642747298, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642747298, "uuid": "4f26bfa2-d0e3-4ccb-a85d-796c38f0352d", "comment": "Malware payload (Gafgyt)", "value": "dd5bd8e578d9fd63a4c07d7fe03c751f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642747298, "uuid": "9c6160b5-f0f7-4e7a-aab1-50e6ed7fe154", "comment": "Malware payload (Gafgyt)", "value": "a3bc1d1f071b7262fae1d20f57874bd8d2496813c7d781e0c8c912e6d5535808", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642747298, "uuid": "563ee4b8-8c12-4299-aa6e-2e156acb7912", "comment": "Malware payload (Gafgyt)", "value": "8e13ffdceb07da38209b0fd2ed7b1fb5f2733a9b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642747298, "uuid": "09f98d61-7a73-47a1-9fb9-75617e0a26ea", "comment": "Malware payload (Gafgyt)", "value": "9b32e819cfc90c5d094d019c3033d11ad631939c9f150d8e808d4e5f5e8625027fe2720a0ed0400811d188650b7272e3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642747298, "uuid": "ba9566eb-fcde-4731-9fae-6dd1bf5273dd", "value": "T10FA32A05F9118757C1C327B6F78F47493B3167B997DB33026A34BEB02BC27991A2AA50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642747298, "uuid": "36c3c417-2f76-4624-bbec-aed82a282f66", "value": "3072:7e9h9oZX5hvFfKufS2faYj0+rQ0Knm4XATe:y9wZX5hNfKfpYj0+rQ0Knm4XATe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642747298, "uuid": "031b1aa5-f19a-4995-8181-9913c10941ad", "value": 103862, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642747298, "uuid": "78579a97-025d-42b3-92dc-0b84b4215f1a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642747298, "uuid": "8fd625b5-d832-4153-9047-4665ac3dcc2c", "value": "fuckjewishpeople.arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa81c86b-7a92-11ec-9275-42010a9c0029", "comment": "Malware payload (AZORult)", "timestamp": 1642753088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642753088, "uuid": "cbae19fe-4d5b-4c29-bee1-372370591985", "comment": "Malware payload (AZORult)", "value": "92442beab168542d701d9befd9751c5b", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642753088, "uuid": "bbcb420e-519f-4bfe-8d17-82f515f1c4d7", "comment": "Malware payload (AZORult)", "value": "a4656422400c467bbcfae386ba6d18c8cd37368ce2f08b2a873675ee7ce59c40", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642753088, "uuid": "472c4652-e9e3-4ca5-9f28-2165e394be7e", "comment": "Malware payload (AZORult)", "value": "3dd5d8cbbb74e3579f2bfd492f333c15af37f57b", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642753088, "uuid": "84084c11-5d06-4f3d-8e8a-63eddff783a6", "comment": "Malware payload (AZORult)", "value": "07fbe3078da5e8974da52e275d1456ee7668b79c8554e106606643fad7e761c569823aaf85f925cc093eff70927c132d", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642753088, "uuid": "9ddf779b-366b-4352-864d-e1595dab1f2a", "value": "T19E3594AD326072DFC867C972DB681C68EF9078BB831B9207901725ADDA5D997CF140F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642753088, "uuid": "a8dc68ff-69d4-4821-95aa-2184c08451ad", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642753088, "uuid": "25775b3c-0cf2-4f2f-a007-34328b7d685f", "value": "12288:qeWGdnT5MPHa4a8M7AaU2iu7MwedKxr2wfGc1ic1ZaVzHZum0fqNYJhxtFTsE7tU:qfGhqP678MWugwUKRfGcQcb2jAY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642753088, "uuid": "a7ed91a2-fe09-4e89-94a6-12d68cf7e2a8", "value": 1076736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642753088, "uuid": "fd0a407d-0deb-44bc-9129-38e075ba481c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642753088, "uuid": "a8926735-93d8-4417-81ef-ed9fb53d5ef6", "value": "Inquiry.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0241d359-7abb-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1642770415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642770415, "uuid": "188d78c4-11b3-4a17-a6ef-a87a4b68227d", "comment": "Malware payload (Formbook)", "value": "9563bab56977f2394eb4540bf474ec4a", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642770415, "uuid": "dc39f931-fe87-488f-a0d1-d1a32f4510ec", "comment": "Malware payload (Formbook)", "value": "a49a3cf3e72aacc6fa302d0b613acb1b611fd8148618a334b5bd6c47b5bac4d5", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642770415, "uuid": "69c66f89-206b-4d95-b81b-4e58fbbc7b03", "comment": "Malware payload (Formbook)", "value": "c510463933454eb302e2188b300ee92fbed10abb", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642770415, "uuid": "f2bf2875-21d2-4a81-97e6-6e6e55de8e77", "comment": "Malware payload (Formbook)", "value": "8d5e01157680a770851f26e23d846ad33f6993e8837327191a0c10aa249e39d0f152c8d95561d2f3b4c19405507759cd", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642770415, "uuid": "6576a2c7-a37d-4208-9725-8cb7ef03bf23", "value": "T18AC49ECDDDA195E44BCEC6DA8D182FD921631BB8CA437C5A483836E90FD363F5A16C60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642770415, "uuid": "7e859956-36cd-4471-989c-e8fade94300c", "value": "12288:p+50afyOJ+pTcy/sQql4RByFh8wR2+SrdH8OYsEgbHAr+YqBR3ZJfl/:p+50aaq+pTcrQqlAByFawR2fFYsE6HA+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642770415, "uuid": "8cfcd9ed-8953-464b-ac28-8561686ddeb2", "value": 554290, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642770415, "uuid": "e127bf5a-d903-48c6-b9c2-924a21901895", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642770415, "uuid": "6f7c7a26-c22d-4224-9ebe-d118bc12091c", "value": "new_order.rtf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc95ccaa-7a61-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642732073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642732073, "uuid": "c8c0baf3-9244-4be6-95fb-aa2e4272f0f2", "comment": "Malware payload", "value": "368efb089aef810aa0ef2a306f06943c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642732073, "uuid": "1ee01b16-f10e-4e54-84ca-1ea0b3bb8b2e", "comment": "Malware payload", "value": "a6786dcd96f88cbcd30a3449fd76fd063dc6e0347903ba256f77226bf625cd51", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642732073, "uuid": "9a362d08-5aba-4b80-9220-f12bc56e6770", "comment": "Malware payload", "value": "0d3d57ac799276470dc201d63faf197db528c7ee", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642732073, "uuid": "48a1fde9-670c-4b31-9442-78a5585cc646", "comment": "Malware payload", "value": "2444c3860a55ebe951bf98a3e6e141e2b27792720b22b5fef7667c964c250e368dfc4b9524bc7af9b71ccbabb769d79a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642732073, "uuid": "74186dbb-2a32-4db2-acd9-f828a113760b", "value": "T1A513D606EF914FBBCC6FDE3346A9065631CD914712B43B2A3174D938B21E5474AE3CA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642732073, "uuid": "b06040c7-8669-4def-8387-534d0e87dc0c", "value": "768:+kR0AEGMemYen35Dcwd4YlFIZsFZXi3Iwyu9eJjryITpI6H:vRu3YcTDkZsFVu9MjryApH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642732073, "uuid": "c0bd076e-eabe-4ee2-8f78-3d06b9a953b9", "value": 43524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642732073, "uuid": "3a135cf5-5942-4877-95cb-9aacf5a205df", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642732073, "uuid": "7b43e0ba-c3b0-41d7-82ec-cc87928fe416", "value": "beamer.mpsl-20220121-0227", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7523604a-7ada-11ec-9275-42010a9c0029", "comment": "Malware payload (STRRAT)", "timestamp": 1642783922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642783922, "uuid": "c8f49525-a9a9-4672-a6b5-4b3a0e7829e2", "comment": "Malware payload (STRRAT)", "value": "ae4d8bf6b2cb97eeedc8370753a8d1fe", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642783922, "uuid": "a35f26d0-8a64-4b62-9d63-624e11321013", "comment": "Malware payload (STRRAT)", "value": "a7467e03097fb1c6f8ae8b138335b3ea412e6837ee0803d44935b571671b1aa3", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642783922, "uuid": "1d232434-e198-44a7-a2bc-e8880c8c2cd0", "comment": "Malware payload (STRRAT)", "value": "af72d0671739b2167547bd95ac18df598cd58ae2", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642783922, "uuid": "00d8e69f-755d-4d5e-bcfb-e12956e694e9", "comment": "Malware payload (STRRAT)", "value": "6a6674e81b919532394a5b60a8061162b67d46beaa68290be1ebd493f35cfa468dcd1d49fd2f028fc6669895e0c58f60", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642783922, "uuid": "140337c9-170f-4417-8472-2f8481d19fec", "value": "T11A04F10B3CD651B8E60BC232C14543776E0C22D5D64662AF26FC18A61879D9D3B26FEF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642783922, "uuid": "f2a5fd0c-5c47-4389-a55b-ed07a35916b3", "value": "3072:sQUOTOD2bSVyuNWR/J3tj+IERNKFwp13D1laPHFDDVc135vRJL:qOI2bY0RltC8sxMlH213h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642783922, "uuid": "1ca5198b-0ef1-4f69-92bd-9575de2efb64", "value": 182007, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642783922, "uuid": "71cc084b-bac5-443e-8d51-d700a54a2d5b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642783922, "uuid": "a0f129dc-32e4-44d3-96b6-1ac9180c399f", "value": "e-transfer.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f3c6ebd-7ac7-11ec-9275-42010a9c0029", "comment": "Malware payload (Smoke Loader)", "timestamp": 1642775698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775698, "uuid": "00c4acba-279b-44d4-943e-b5c1868aacaf", "comment": "Malware payload (Smoke Loader)", "value": "eedf28d96368ebfb5b9f8bbeb98191b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775698, "uuid": "772379ee-aeb9-4649-808e-d9b0b9b47b9c", "comment": "Malware payload (Smoke Loader)", "value": "a7bf19187e84d12c7fb6adb7fe37dbdfe83cf2d9a5c229f25733bb6dc7baef61", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775698, "uuid": "19572e3c-05b6-4bf3-a859-47a221d08c69", "comment": "Malware payload (Smoke Loader)", "value": "b95d846338330e3996a13531401fc1909326f805", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775698, "uuid": "82f8b2df-7c1e-4fe7-aa4a-3599db50ec7b", "comment": "Malware payload (Smoke Loader)", "value": "af93e0354e5865f50d076fa7c0eb4892292406237d2e14ea6f5fa456f19c4e0d82047daf03c2f7776cca06ea8e3b8bbf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775698, "uuid": "339ed44b-cad4-44ad-98cd-fc66b538813b", "value": "T146648D14B7A0C435F5B711F44A799378A63E7AB16B3490CB52E12AEE57386E0EC3130B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775698, "uuid": "1cf5d69d-d572-41db-8434-f7b44c2ebdfd", "value": "b4892f1130d31e71dc6b3341892a29cb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775698, "uuid": "2af52ef2-363c-4549-aa18-ba9943ca1a9a", "value": "6144:K7TZ1IYNC6zTK3T09QgWO8w3GRjrCPdoM9JCuKtQqAwvRRC:K7t1nJvwT0CgWdtpCFZJCCql", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642775698, "uuid": "fb811f4d-14eb-45dd-9512-ba2c1091e8cc", "value": 336896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642775698, "uuid": "fcb2565b-8e25-4dbb-a9fd-90773d3d337b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775698, "uuid": "7a9b38a7-af27-4b1b-bb7c-00116a5b8946", "value": "eedf28d96368ebfb5b9f8bbeb98191b8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a479ee6-7ac6-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642775314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775314, "uuid": "b28fa3a2-79dc-454e-9a6a-c38514070cf6", "comment": "Malware payload", "value": "80c4c04b1d11e0f6e84643d74ed31b1c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775314, "uuid": "b1c92f9b-b18a-4945-bc76-0827ab4dc69c", "comment": "Malware payload", "value": "a87c3901341ded9488bfa9f84856a3518fbbaec4d69a72e13c0d5e481b7e373c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775314, "uuid": "46be5824-f018-4f9b-9e3e-25287e0ea6cb", "comment": "Malware payload", "value": "1e2873e00a605858f471cca7bda13bbd36263926", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775314, "uuid": "fcc4deef-f2b2-4f5c-9695-a0583ea4b16a", "comment": "Malware payload", "value": "6742185ca887aa98c68c87094f36879a74602c881e8b12e9a430b00d6373b598aee8a9cc3704b288c727971272a1bd55", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775314, "uuid": "ab7f6a83-742f-408f-8a82-d356df13cb87", "value": "T15BA45F1C2E310772ED7E90309C720AE4BB671B436280699717DB55C68B8FC67EE4ADD8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775314, "uuid": "69e1bdfc-2e81-402b-97b3-535f769ef09c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775314, "uuid": "c6e76e45-d58f-4374-9924-493c9eb2cd3e", "value": "6144:8ajhMVOzguHumL5iXiZqFm5raRsxn85MMBh+j8c6GZQY9fxU4iYaL+J7eUd6:ZiVO5Hx55raRsB8PXFaJZibW4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642775314, "uuid": "efba16ac-34a5-48b9-a52c-d0ca53cc9172", "value": 493056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642775314, "uuid": "6cb79702-86eb-460a-8225-f86d310c4216", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775314, "uuid": "f0d4f3f1-ca10-480c-a915-79727ae23735", "value": "MV LILA TOKYO - VESSEL DETAILS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1365719-7aab-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1642763944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642763944, "uuid": "6bd6ee9c-c59a-4cb1-9b65-ee330598ccfe", "comment": "Malware payload (Loki)", "value": "b0b953855786838fd11c307d0de28a00", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642763944, "uuid": "3f5685c6-6dfa-4153-ad27-71a2fe25e998", "comment": "Malware payload (Loki)", "value": "a8f70cd281964bb0aa0e79b8ec329c46c1a1a14ce174a2398e327813af972ee4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642763944, "uuid": "dd6be1d2-ff37-48c3-99d0-73ce1b76cfb0", "comment": "Malware payload (Loki)", "value": "c5793d35fabd25a0e9cb7feececae3f5db52c55e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642763944, "uuid": "c945c284-1deb-4b32-a45e-4fad1e2bfe02", "comment": "Malware payload (Loki)", "value": "d245111cf8b09614d5f7b39e39a1c70ee4d0de7c12f67972626352457625abea0b967555bca98bf7def423429f7d8d6a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642763944, "uuid": "f4071dcd-e154-403c-95ce-f8386548fd8f", "value": "T18C64126687C4C8FBE8520BB1293B6711E3F3FB504061159B17408F6BB9290D7A52EEE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642763944, "uuid": "4c7b0ded-c8ab-40c5-9072-1e2c15bdff1c", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642763944, "uuid": "284f117e-3b53-49b2-8d59-dd85857e35e9", "value": "6144:owahEunkqvb7d0uF0Q1TLfaLHJiLymqWVbOqPIKyj0Ilr8fhgGBvLkaIpmdR:OsUN1aHJUYI9PIhyhpkaIYX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642763944, "uuid": "241233d1-6028-4d54-94ba-0604205fe18e", "value": 321749, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642763944, "uuid": "e870c044-edd0-4336-a322-260e42bec52f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642763944, "uuid": "aaa37c42-d93c-42fa-b7dc-957460a6098d", "value": "b0b953855786838fd11c307d0de28a00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1991f497-7a6d-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1642736954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642736954, "uuid": "4944a354-fe80-4aa9-aff9-1389a134af79", "comment": "Malware payload (SilentBuilder)", "value": "f1fe8e935ff0013ca48fd220e02193da", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642736954, "uuid": "bbe7c149-c01c-4f2c-8812-f3dffbb281f3", "comment": "Malware payload (SilentBuilder)", "value": "aaec559a9461b2ceb6da5a557186641e67370e83fddc9b23237f6f92c0e22fc3", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642736954, "uuid": "8232f498-f814-44c3-8251-d18d97ae5eba", "comment": "Malware payload (SilentBuilder)", "value": "c4b1cfa48e121b674b60e71aeabe12521691c6f4", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642736954, "uuid": "be8be4fe-8dad-4cd5-a952-aecc7c4071d4", "comment": "Malware payload (SilentBuilder)", "value": "2c1c1fb8f779fa0245fa78d6a1ec4bb3d824da067aad605850b48bf3d20d26d0e4f429faa9d40236e12f6a28c4244fa9", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642736954, "uuid": "99d968b7-d778-4d7e-b676-fb6b17127f3a", "value": "T1DC636CA7B78299EADA0483394DB643C5B717EC104F9A43C73694F7346EB49F08D9324A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642736954, "uuid": "03f84fe6-1586-4ad6-b322-b01c36f2d6f1", "value": "1536:bpEk3hbdlylKsgqopeJBWhZFGkE+cL2NdA8eXZiozeOgXVZKyaZpvyR1kZkJvU+:bCk3hbdlylKsgqopeJBWhZFGkE+cL2Nr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642736954, "uuid": "cedfff60-7d14-4d63-8cc5-f4c1fdde86a9", "value": 72278, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642736954, "uuid": "815baf38-5b27-4beb-9192-f83d53eb9adf", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642736954, "uuid": "7531f70e-c9f3-4e5e-96b3-d408b674f642", "value": "f1fe8e935ff0013ca48fd220e02193da", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "342c0768-7a4f-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642724113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642724113, "uuid": "6323e626-e2db-4d26-af88-82addfa69fc3", "comment": "Malware payload (Heodo)", "value": "f5c2aa58e8fb5cb6c88e8b7cd4f1e6de", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642724113, "uuid": "55c0373c-f6ec-43ca-8945-8b0fa5819d2f", "comment": "Malware payload (Heodo)", "value": "ab108122e932e721217063ab3b019509f967f5db9027711eb977131863fa965f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642724113, "uuid": "03362c02-c434-4d5d-8fec-900587070ff6", "comment": "Malware payload (Heodo)", "value": "32e1b04ac25ac680cd1c65d575b4eff98305a4ea", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642724113, "uuid": "cad91c18-634c-4c68-9d5d-f636e4dd742d", "comment": "Malware payload (Heodo)", "value": "70835a936df3cd9056ae3a1b77090cd00b36ab65563d468f7dc72eefc5d8486e38c26751ad7d0f3337935a3e97e76ce5", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642724113, "uuid": "aeece941-a37f-47f7-a5bb-e2e57fab96f4", "value": "T1E6D4C002B291C035D5BF11B44E666B18A2EDFE905B3985C7D3C87A5F2F31BC2A635B06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642724113, "uuid": "3ddc3791-cf73-4718-8220-4f79df64d26d", "value": "42bfc936e90bcc6f5b01541917ef37a4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642724113, "uuid": "45c276e1-fd12-407d-b870-857fa799dde9", "value": "12288:hF8kySLmsbWV5WlvAuyfEgXkvPLEbs2gu1D0iv+9Ne1KGBkkQxCej+6IvUDEPwqh:wMmiWV5W5AuyfEgXkvPLEbsGDIfsLQxQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642724113, "uuid": "220eaa95-0288-4fc0-aa04-e657e9f12c8e", "value": 651264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642724113, "uuid": "e933bd06-047e-44f1-8cd1-8bd04f417bdc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642724113, "uuid": "02fd18e0-2081-4607-9448-c86d33046a99", "value": "emotet_exe_e5_ab108122e932e721217063ab3b019509f967f5db9027711eb977131863fa965f_2022-01-21__001506.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fec1322-7ae3-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642787806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642787806, "uuid": "1dc1274e-7fc8-41cd-a47a-e104c0225755", "comment": "Malware payload", "value": "bb45e99a04180ced0b985f4e3daeb4ef", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642787806, "uuid": "654ea68f-e6c4-4aa2-8675-e4fed680bb0f", "comment": "Malware payload", "value": "ab3b599280a872244967bc684a3790b8366d31372c8155776fc8fef2f4730524", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642787806, "uuid": "780b5a66-0298-4fff-b6b6-01b43c7b9035", "comment": "Malware payload", "value": "a63761a12138dd9018edaed0ea85f9df92965104", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642787806, "uuid": "fd7f35c5-d0f9-4250-9dbe-91d7c41719c3", "comment": "Malware payload", "value": "cc042f3f5fcb4f861536ecb60acfb6c0694b927fe180746378723843b184fe32e7f8f3f458eefc89c86be27b3c3d31e7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642787806, "uuid": "5127432a-7df6-441e-90b7-d6ed93f86d1c", "value": "T1BE773303DAC61438F8572D784AA622767D4BFD2035F4A4FA4C74F90E93B94B12BB1789", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642787806, "uuid": "bb4209e2-986a-44ce-9b76-747844a24294", "value": "20dd26497880c05caed9305b3c8b9109", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642787806, "uuid": "43d9ad51-ef8b-45af-9396-e81896dfc7ed", "value": "786432:3u3uX1I0Q4vzQZW3GGzQPODb+D6+KhXg8+AgzjH0yrbkXPV32:NIqvzQZW3nA56+Khw8+AMnUt32", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642787806, "uuid": "b721a93b-82e9-40b6-9735-2448bc9904a6", "value": 35722600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642787806, "uuid": "798da2b0-bdf6-4a9f-98e7-8dd9ca45b12c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642787806, "uuid": "f66aa738-3e0e-4ad7-a0d6-e1edf1b705a9", "value": "bb45e99a04180ced0b985f4e3daeb4ef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7591726a-7acb-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642777481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642777481, "uuid": "e5f7e36c-4d15-47ad-9bea-1f77f438db41", "comment": "Malware payload (Heodo)", "value": "5eac124a77133f3fd6ab6a9ae8d06331", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642777481, "uuid": "d06d6840-6ee4-4baf-9ef2-9541a3b70608", "comment": "Malware payload (Heodo)", "value": "ab4456f73cd0d49bd6c2dc5553a33ff128bc765cb07cd47f8e0619d01735f966", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642777481, "uuid": "e3ff1224-5ce4-469e-baf5-487f28a0296e", "comment": "Malware payload (Heodo)", "value": "c7bde6d20c193fc30813c3641ec12f61b49e0cfc", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642777481, "uuid": "6c28bc8e-9d9f-4a5d-b8f2-1248eec36c5c", "comment": "Malware payload (Heodo)", "value": "67916f35fdcadfda7fcb216dad47564c6ad2fbcef3522e061e7350141bd2aaf586b70f86526c6b2990620d7621ddaddd", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642777481, "uuid": "b8d0f6ae-13ac-4ac0-bbe2-19679249898e", "value": "T141636CA7B78299EADA0483394DB643C5B717EC104F9A43C73694F7346EB49F08D9324A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642777481, "uuid": "67e0b309-0ee2-45c6-bdbe-6914defda824", "value": "1536:bpEk3hbdlylKsgqopeJBWhZFGkE+cL2NdA8eXZiozeOgXVZKyaZpvyR1kZkJvU+:bCk3hbdlylKsgqopeJBWhZFGkE+cL2Nr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642777481, "uuid": "731b6cb8-eb72-40f6-aa2a-51dddcc47d83", "value": 71392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642777481, "uuid": "2d3ab266-4740-4f14-bb25-2b83ea44ae8c", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642777481, "uuid": "907dbd9d-0401-4132-b731-ebf30b412441", "value": "SV5286234665414694.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93c0118b-7a5d-11ec-9275-42010a9c0029", "comment": "Malware payload (GuLoader)", "timestamp": 1642730287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642730287, "uuid": "26551bb3-967c-4edc-bc3a-0b3860bbcc8b", "comment": "Malware payload (GuLoader)", "value": "f82abfee362eb0ae62564d1d823dd255", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642730287, "uuid": "127e375b-90e6-4a77-ae2e-26f3c93ba464", "comment": "Malware payload (GuLoader)", "value": "ab980575f1abd51f4401c6785345649318444b681eb56880028046936cecc3da", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642730287, "uuid": "65e23bc8-668c-478a-acac-e16bf73e1a71", "comment": "Malware payload (GuLoader)", "value": "916a64f434ae64dce46b34fb6dd2681071fb1519", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642730287, "uuid": "1a32b70a-c95b-41a2-a96f-e2b4fe301ae4", "comment": "Malware payload (GuLoader)", "value": "2cd184f6c48897d6de9dc62c5331a658c9f0194a70487658f68fb49405bacd9d2799ca601dc69ee91fa1f8c6ca636759", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642730287, "uuid": "24314105-7f9a-42c3-a7bc-2fe2905846ca", "value": "T1FA9556F0AD01D4C1F5BE5B6AF2FD3A48A1343217EBC94A4A00E7E5551EF6A11B90ECC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642730287, "uuid": "edd7317e-5892-48fe-b058-4f5b943b6013", "value": "12288:Q5kVmRDzd/wLCcW9w19AhSjKcpBWZYtW5/vnk2gX/rF7:Q+mV2tW21ESe6BWWk/6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642730287, "uuid": "0663b9e2-3599-4176-80df-74d0ee2cd97d", "value": 1903985, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642730287, "uuid": "a8680a30-19c4-42ce-bacd-89ed928a6f7b", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642730287, "uuid": "7117ed4b-9a1d-4ccd-9610-08aa00c72a58", "value": "PO-C - 20211213-PLATE.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "310c1b17-7a74-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642739999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642739999, "uuid": "5793e1c7-268d-49af-b739-29d69305c4e0", "comment": "Malware payload (Heodo)", "value": "05de74dfc08dff10864dd24bf1372cf7", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642739999, "uuid": "5e72ef2e-c0b1-41bc-a7b9-5fc5999bf2e0", "comment": "Malware payload (Heodo)", "value": "ad583c4b877a37dbf913c275e1bce335b8e73817d61039a2a510e28f325d3e6c", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642739999, "uuid": "cdb4ef90-58d6-435c-82e3-342e3c0b956a", "comment": "Malware payload (Heodo)", "value": "dfe92a0fda7dca811c6ce5b20d7f035e2cf97a00", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642739999, "uuid": "0e0c3ec1-f859-42ef-b343-ccef84104e2b", "comment": "Malware payload (Heodo)", "value": "7b2eb9aeb3e6aa47f8f90dbfa93261e8019fb6f0e00c1931ca5c1aa73e9008894cfb6b1008edba82cf0986ba4d77ce80", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642739999, "uuid": "86a4d8d2-adb1-4f97-a679-545f535f8bcc", "value": "T12C636CA7B78299EADA0483394DB643C5B717EC104F9A43C73694F7346EB49F08D9324A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642739999, "uuid": "9a385311-f5d6-4d96-a1af-28b4a9148e4e", "value": "1536:bpEk3hbdlylKsgqopeJBWhZFGkE+cL2NdA8eXZiozeOgXVZKyaZpvyR1kZkJvU+:bCk3hbdlylKsgqopeJBWhZFGkE+cL2Nr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642739999, "uuid": "3b0356a7-ab41-48f2-92f2-e900e433fbda", "value": 72720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642739999, "uuid": "9f025197-6331-4d0d-b4a7-c3f03d92533e", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642739999, "uuid": "1ec69f52-d0b7-4449-b797-c6a98c7c6f5b", "value": "05de74dfc08dff10864dd24bf1372cf7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8dd0765-7aad-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1642764709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642764709, "uuid": "33120302-5d60-4e57-ac02-f2682683919d", "comment": "Malware payload (Formbook)", "value": "b1e0b1657595b806097a1529c2ae0620", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642764709, "uuid": "47841aa6-dfdd-49dd-84e2-8112a541ceeb", "comment": "Malware payload (Formbook)", "value": "adbb0a2d948271b626589d5e305bdda36bad62e00b58847d0a7dae3688d5c376", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642764709, "uuid": "03286c4a-208c-4860-b202-4fffd1a80705", "comment": "Malware payload (Formbook)", "value": "7cdd036a4769354e8a325c2231456187ee211cef", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642764709, "uuid": "e9949012-746f-408b-9e94-23f5beeaf583", "comment": "Malware payload (Formbook)", "value": "49a5c94cae96700fd131fdd14659fb108612578283150a12c996f67ba7996c7e124c63568173f7e68f8595ce038726ca", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642764709, "uuid": "e96d91d3-288c-4d21-98df-f5d599672bd3", "value": "T1C164126635D0A86ADD63403034FB8AE6C7FC8019ABE7055763185FF749160CFA819BDA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642764709, "uuid": "9409ce14-fdb7-4096-9e74-ae863d0a0d21", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642764709, "uuid": "4d9a33e7-0d75-424d-94f5-783939528cd4", "value": "6144:ow5G4vmmQnKvTQRK+jvtD4z/zNkpbOsZfOrku5esbY1onYU3RTuycgw:dvxm9jVDk/+qsQBTcanYU3RTsgw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642764709, "uuid": "4d0d39c2-a9c1-4d1b-ad51-036592408bc0", "value": 332563, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642764709, "uuid": "7822604d-afaa-4d62-8d26-ed08d0550084", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642764709, "uuid": "d3b352f6-bf93-4eca-b33f-e1683eae54e1", "value": "b1e0b1657595b806097a1529c2ae0620", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74078a9a-7acb-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642777478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642777478, "uuid": "168a1c8e-8249-41ce-abb9-70900464745b", "comment": "Malware payload (Heodo)", "value": "0802e1fc6e767671da9d99c92e83cc81", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642777478, "uuid": "c2b1328b-039b-441e-92d6-40e32b329cb6", "comment": "Malware payload (Heodo)", "value": "af86124d12773c861ad103419ab9f04ada33b95ff6919a1a9f9c4dfe2d49131f", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642777478, "uuid": "802b7bba-2a54-4769-8889-717d905a32f9", "comment": "Malware payload (Heodo)", "value": "63602be1ee30bf06c74b837420c8542bd9287ae8", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642777478, "uuid": "0e9aafc0-6ce6-4ddc-8862-26210ba79244", "comment": "Malware payload (Heodo)", "value": "3122fa234c5a2e4caec7c276d1fbb69407bd8181e3b00ea16517cfb16750d0744283930b7d3117e1980a73a825508a76", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642777478, "uuid": "dfbf3c66-2481-4c4f-baa4-8b61834e023b", "value": "T1E5636CA7B78299EADA0483394DB643C5B717EC104F9A43C73694F7346EB49F08D9324A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642777478, "uuid": "98e09b07-582c-48e6-937e-1879d280cd2a", "value": "1536:bpEk3hbdlylKsgqopeJBWhZFGkE+cL2NdA8eXZiozeOgXVZKyaZpvyR1kZkJvU+:bCk3hbdlylKsgqopeJBWhZFGkE+cL2Nr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642777478, "uuid": "ea615902-f30f-4fd3-9620-0a48240a3940", "value": 72008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642777478, "uuid": "23e89abc-19c9-41b1-97a9-76c971562b23", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642777478, "uuid": "b3bb65ea-9458-44bf-bf63-4e49f6a27842", "value": "report 01 21 2022_4.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2761327d-7a8c-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1642750291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642750291, "uuid": "8651bbe8-9a43-4cb8-add2-ae3744a24833", "comment": "Malware payload (AgentTesla)", "value": "cf1761deff2281160dc633007cd45ce3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642750291, "uuid": "ef7bb6f0-2862-4fed-9e40-bb9bb0407fbc", "comment": "Malware payload (AgentTesla)", "value": "afd83ada0933fc4c3dd6438ba51d78dd5e3f27fd8ce8db12d0ec4fc8fe66b28d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642750291, "uuid": "d0ebe8f9-71d5-45e7-8dcc-c3014e2db9c2", "comment": "Malware payload (AgentTesla)", "value": "3098415965519c0c86026397ea60896ef620a7fa", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642750291, "uuid": "50d6355a-36b7-4100-913f-51bc76cb415c", "comment": "Malware payload (AgentTesla)", "value": "67a37223483dd8225b8b7441d66722a24cc41151e23270db0825a0feb092485d91d3575facf8bd687d0f5b3566f4921d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642750291, "uuid": "c2d03c8e-d5a2-4760-ad52-962c2e2a50f3", "value": "T1ED152350F965674DBD6F7741C941833253419B2DDBBBC8097D826428AA3CB8AFEBB130", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642750291, "uuid": "8bf1dc0c-5d21-443e-a930-2a8648392fb9", "value": "24576:ZUw3VW8uUTpiCv8He2vRVfyeiqg1LPy/+xBsv:ZaUTV8+2GOhmxSv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642750291, "uuid": "2daaa9f8-9558-41c5-84c2-5fc516a0af18", "value": 882247, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642750291, "uuid": "d966b121-7ee2-4c8d-82eb-e20182240b88", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642750291, "uuid": "658c4c86-1a26-4195-abdc-5aa1f9e3bea2", "value": "Invoice & Packing list.r15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7b97e11-7a4e-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1642723958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642723958, "uuid": "6fce1db7-9db1-4615-a9d0-c07fe82e8d76", "comment": "Malware payload (Gafgyt)", "value": "0a18cf32463c9bdb6a26e630b7ca53be", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642723958, "uuid": "5aaa7881-9f9d-40bf-aec7-89c334edd3f8", "comment": "Malware payload (Gafgyt)", "value": "b10abf70748a9f3acdee5e47bb33c87e6ab69a5c7d30ac09954e4ffab9488e47", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642723958, "uuid": "9dc52347-77f7-45bc-b49e-4cea74092106", "comment": "Malware payload (Gafgyt)", "value": "9268066becf70f749d6bc4eea985a159fb4f7c6b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642723958, "uuid": "bfdf04b5-249d-46f8-b152-b144629b581d", "comment": "Malware payload (Gafgyt)", "value": "a6892a5cd3742a3cc67423bc428dc495d61fad62ba148205df75b5eca61d2f114ef5a92c12f74f203ffc3a8712a62780", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642723958, "uuid": "7d329728-0779-4d80-93ed-8208f3aed524", "value": "T16C148366BBA19EB7D80FCE3306D94502118CA58A46D92FAFB7B0C55CE38B94F44E3D44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642723958, "uuid": "a9cce4ab-f57c-448c-89c8-bbd0a3701606", "value": "6144:286ri409bcXDfXE5hUaHMtWmKz6FhdzHWlwq:N409bcrXE5hUastWmKz6FhdzHWlwq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642723958, "uuid": "6ce3a10e-a073-4d51-82f9-bc4b199ca616", "value": 201440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642723958, "uuid": "f78d4c56-5588-4011-9d82-bd34e79a320f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642723958, "uuid": "17cc20dc-e783-4650-a18b-fd900533ac97", "value": "0a18cf32463c9bdb6a26e630b7ca53be", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "deb19382-7a8d-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642751028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642751028, "uuid": "f191d4da-fe98-4589-8347-e142443ffe8c", "comment": "Malware payload (Mirai)", "value": "1c4f6c0eda951c30f47df1fe1901faec", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642751028, "uuid": "6cb07360-8770-4e77-928a-a4f204c82c0a", "comment": "Malware payload (Mirai)", "value": "b1deb1a0b30ce1f9d1f6407413cc1a6d1d8f7539bcb504fc7131e66f297f21cf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642751028, "uuid": "97564f35-385c-40dc-863a-d26ec4197ff4", "comment": "Malware payload (Mirai)", "value": "3c2b5eb99fa5c0fe7634d365f7b0c9922511548a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642751028, "uuid": "39031798-d87e-4fc8-9acf-e9cc2fbcb1ea", "comment": "Malware payload (Mirai)", "value": "1fbbc7f6f88bcec8975fd9984389239cd2753a071ef41f198bcd85b4ade6ff5c2c7928275390cfe766fab8f8d8ade12b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642751028, "uuid": "05c8723b-367b-4c8c-bb67-6d1ef2719d61", "value": "T12DA3184AF9816B11D8D926BEFE0E118D335357A8E3EE7112DE205B2137CAA5B0F77412", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642751028, "uuid": "b5a86841-7471-401d-8fa2-e8b7060b4659", "value": "3072:aUKVKxK6KdKaoizKrdItmP5kEZBEa5bj64LqQm7mXFpO1i:Egsx4aogtmPCGWa5bj64LXm7Ed", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642751028, "uuid": "5a780a31-e2d9-4f42-9517-7edc35d10cb3", "value": 99932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642751028, "uuid": "97e43ff1-39e6-40fc-8ee6-ac21c6fd62eb", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642751028, "uuid": "fdecd3a0-80a0-4ed4-a9ee-70bea5e593ad", "value": "1c4f6c0eda951c30f47df1fe1901faec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76cefc66-7a5c-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642729809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642729809, "uuid": "a9eb6e1a-69b7-41a1-94d2-97eeb2feef55", "comment": "Malware payload (Mirai)", "value": "8e4e648ab6d4a1920b677a15760a8e97", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642729809, "uuid": "ec390e3b-9279-4d43-b4a2-366a36aba8fe", "comment": "Malware payload (Mirai)", "value": "b1f22518650a7651f644f5d88323e73e9ca24360ccf3275e8295299339bc25af", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642729809, "uuid": "b950aefb-b836-46d5-9638-897acbb70e91", "comment": "Malware payload (Mirai)", "value": "3a25488e2bc571b6934fb13494a6320a54e9433c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642729809, "uuid": "8c741512-2fd2-4eb5-a554-34eaa4fa53fe", "comment": "Malware payload (Mirai)", "value": "3b25e4fe188ace1f5a02d9aac47ee9332d148b7eee19d788f9de07183c6aa1410bacf2db6c1cbde32284e2bfc2c2d378", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642729809, "uuid": "6adc360b-1946-4ddb-8b1e-f27d09932b9e", "value": "T11E43F7C17881A626C7D05377FA6F018D33199798E1EA33539C292FA07B8AC1F0D6774A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642729809, "uuid": "c9499b6f-abed-4bd5-8097-10cf7ddc75bc", "value": "768:tJwEKBHMOvgZxK/CEBexMwQUNnFBi9rZ0iDEGYHp8wMvTLwCVy/rCxHghW1/Kw/9:tjK2NZxCYBGYJ8jShWwF5jwGo+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642729809, "uuid": "84675da5-a0fa-4f4a-838c-1d0e28a53d1d", "value": 56632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642729809, "uuid": "e5d8c054-2b8f-4a6c-a34b-42b05cb313d5", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642729809, "uuid": "8a870b95-3a37-4d31-8830-d6386ccc5ef1", "value": "flow.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b43e89fe-7ad5-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642781881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642781881, "uuid": "c15339a1-6edb-426a-8de6-28a04aed179a", "comment": "Malware payload (Mirai)", "value": "63e15b47ea383dc20c577a3372f2357c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642781881, "uuid": "4f508777-60a1-437f-ba91-9076a2e44ed5", "comment": "Malware payload (Mirai)", "value": "b21d5c8732f4609c550aa94743f1d2a61f4ea45ae10d5b39089de8e0ecc238f4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642781881, "uuid": "d4e4095d-4462-463c-9609-ab0cf8d87c75", "comment": "Malware payload (Mirai)", "value": "dfa503b244a4695f84b93c0097a2b833d5a39461", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642781881, "uuid": "3dfc6a01-0d26-415c-bb38-12a4ad3e6f21", "comment": "Malware payload (Mirai)", "value": "3e0c0b6109c0335d0f3941efd974f57c088cbd4be653e9257bc2377a4a6a6a2d00347c4360e0c1439c633d6a9fc2dcad", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642781881, "uuid": "40d6f066-25b1-4473-bd5c-94289c5024fe", "value": "T17C63F746F8828B26C5C613BEF92D118D372353E8E3DEB2239E106B6077C646B0F66D55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642781881, "uuid": "e90cda33-bbee-4d55-bce4-4231faed632e", "value": "1536:H0nDSvcYkZbUNS6Q8fKb1duExtX+RZIZk9v0zAIyi+wcauE:TvBkGNxQ6Kb/jnmkkZwcauE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642781881, "uuid": "8b682fd9-35aa-4860-bce2-925348a4392c", "value": 71108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642781881, "uuid": "5f767baf-5974-4d9f-b182-ca2263fc0eea", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642781881, "uuid": "df82b8ac-8282-43ee-a04e-849deca9364f", "value": "63e15b47ea383dc20c577a3372f2357c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "249ec6f2-7af7-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642796243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642796243, "uuid": "3852329c-d120-44e1-9d73-1bd4295b90c1", "comment": "Malware payload", "value": "e249b3a931165c755118649e93280d38", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642796243, "uuid": "0f60fbac-9ff0-48be-95e7-a9ecac9a6329", "comment": "Malware payload", "value": "b3c72ecd2e4f1046a5716589548e7c7c572a8643ddfa291b95ca8b2d2cf50f99", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642796243, "uuid": "0b54fff8-16c3-47ce-b781-d0d9eb8ef0ad", "comment": "Malware payload", "value": "539f94ea7546e8ac0c429a753a172eea73d54eed", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642796243, "uuid": "2632b4d2-31f0-45f9-b9d5-a3445597e801", "comment": "Malware payload", "value": "5277cd38354a457d728173078c496b56992798447b7199570f01ea9dc7c8e483cd3d6bde2a4f0fc7bf3971c223392899", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642796243, "uuid": "12c1316d-1711-420f-997a-39506ce2180e", "value": "T1C8F4E04132F88B45D9BE87FA483515901BBEBE0AAC35D36F9D80B2DF1DB1B408616763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642796243, "uuid": "2fbf656c-0e8d-4c6d-b1c2-55063a795520", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642796243, "uuid": "51938d1e-e24c-4a1f-92c4-2c6734ade65c", "value": "12288:DKqoKpQjIj+LkwDqZiCcLL7HxY4I+FscgyYLq6+ievYF:LpQC+PDqZOLZI+FsoYW6+ievYF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642796243, "uuid": "451f8211-7e13-4a58-a08b-65c61906bc53", "value": 724992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642796243, "uuid": "f6df7828-43a1-4d96-9772-7cc215f1eebc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642796243, "uuid": "ae20266b-009a-403a-aee5-06ade03d08cb", "value": "MT104.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbb33d5a-7aab-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642763881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642763881, "uuid": "166390e5-c6ad-4730-bd74-9bf3467e6140", "comment": "Malware payload (Heodo)", "value": "524f5a09993a7282cebbeee1f015788f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642763881, "uuid": "4a7b8467-ab83-4af3-b64e-824df706e782", "comment": "Malware payload (Heodo)", "value": "b495360d283341f0c79931dfbf9fd115a25ce6ca519660dba0d0a33cd2196e99", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642763881, "uuid": "f837335d-7d79-4d82-8b43-8f3d8165367c", "comment": "Malware payload (Heodo)", "value": "3c46c690047f7116a2ba4bc0729c16121d609944", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642763881, "uuid": "d8936c87-5ae4-4a85-8304-dba8d76f5542", "comment": "Malware payload (Heodo)", "value": "85481eaf394fac1ffb59fdd54b37d5d927886da28c77babafb09fb7c099fd5dac59d6b526f2fc799628c8cf909d4131b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642763881, "uuid": "4fbaf633-ee6a-48b5-80c4-376a7a4d3222", "value": "T1B7D4B011B2E2C07AC1AF0175595297A973F9BE90D9FDC247EFC06A4F5E315828B38722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642763881, "uuid": "958eb595-f222-4b4e-8912-d0afc89ff148", "value": "24b46ffcf60dc8d39e8124f411ebd08e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642763881, "uuid": "fdb5cae0-85e9-48e1-a0d0-55d83083eb14", "value": "12288:vClISqMT89ornPmGZtn5yzrD+1ywIdO3D7AfojAxOBnVV0KOFD3EPO7:vmTWornPDryzraywIdOz7AfOAxsVZOFZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642763881, "uuid": "b12b77f9-6f51-45df-8c14-132233fc966a", "value": 634880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642763881, "uuid": "b20cc073-0fbf-49b7-94eb-4cd18c48de17", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642763881, "uuid": "8c20659a-6d4e-4e11-8266-639ee40e98a3", "value": "emotet_exe_e5_b495360d283341f0c79931dfbf9fd115a25ce6ca519660dba0d0a33cd2196e99_2022-01-21__111754.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5df0ab29-7a99-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1642755966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642755966, "uuid": "96b18f5d-1dc8-4f9c-bb2a-cddf235ae1aa", "comment": "Malware payload (AgentTesla)", "value": "50c771720b19cafd2aac506f1801550f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642755966, "uuid": "7677ae68-7296-4cf9-bdd8-b8da8afb2cd1", "comment": "Malware payload (AgentTesla)", "value": "b575c6747299894b60f1546924d45e720a1e0761b7dbe4498e5758ebcb786a73", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642755966, "uuid": "6b10565a-c745-4e13-95ae-d98f2299905f", "comment": "Malware payload (AgentTesla)", "value": "d6ab009d9ee2ba599b183735366313d5eb3c62c1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642755966, "uuid": "9dcef6d2-3cf5-4503-abfd-89d5f81b0ac2", "comment": "Malware payload (AgentTesla)", "value": "bc1d55bc1a7f57ad18be03e6ed18c8991b392b155d3a2b3220db7e3c3ad864de088e4052f3455de8f8a41fa76455929b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642755966, "uuid": "9a54f569-2354-4972-b280-b60b739078d6", "value": "T10DE4E04032F88B45C57E8BF64871119017BEB91AAC35D75FAED1B2EF0C72B809A26753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642755966, "uuid": "2426b809-12c3-44b7-907a-c3d83ad1e2c4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642755966, "uuid": "e2548e22-47eb-4652-8e8d-03cd05afb5f8", "value": "12288:BIu4ipQWlKGTfxidbux/CI7lGMeDOppxAq6+ievYF:7pQ8BChI7eSpR6+ievYF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642755966, "uuid": "987f98ff-9a96-4d6f-a6e5-1576c577f2b6", "value": 720896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642755966, "uuid": "0e03bedb-84ba-4685-9381-1c33fdd7c3a1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642755966, "uuid": "1fbf931f-439c-4164-b294-d2b7b4d99456", "value": "OFERTA1 ENERO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d98a38c7-7aa7-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1642762186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642762186, "uuid": "abc40fd6-a4a7-4dfa-91d0-21847585a241", "comment": "Malware payload (Loki)", "value": "d585cc340b98029f46b39e5f3f35e9a4", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642762186, "uuid": "9300f8fd-b204-4cba-833f-8f1f80931245", "comment": "Malware payload (Loki)", "value": "b8d11bab6baa04f0230db55305fe6762a62d4b687cfd91d148f9f14928057620", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642762186, "uuid": "740b98d6-260c-48aa-a83c-a3ee49a94484", "comment": "Malware payload (Loki)", "value": "f93e5a7c8ecb8760208823e65b1cf047d4651e11", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642762186, "uuid": "e696bd54-2de9-4f69-b450-46daea09428b", "comment": "Malware payload (Loki)", "value": "246d48279d2dc9a29bdd9e68a39637a79b073f134a368b06744cd6937695f0030dc0527fe661e1d64788e388ddda6add", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642762186, "uuid": "648939d2-d63d-4179-ba97-6cab2e999589", "value": "T1650412E5A6699981E1168BB1B1F190375BA0BD12A050C80BAFD5B94B9230C3BBFD05FD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642762186, "uuid": "0ae6e306-1b02-4594-961a-49c5b0fc2bde", "value": "3072:VBInNW0aaJmEVer8SkBpJvPur+Qf7E0XXTwZx++epTi+Wti4UIkMzE5SIi3DRzwt:/InNba2GgBPvPuyooscZxFepTi+Wtj9O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642762186, "uuid": "8f37e3f1-295e-46e0-932a-0eb1ee9426a6", "value": 186904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642762186, "uuid": "e9da5d75-cd5e-4914-9208-ba471639e09a", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642762186, "uuid": "572749e0-f438-46d7-b140-609c9dfd35c0", "value": "_IMPORT_IZARA _02X40_HZ152BKIPGU005.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d06a5df-7a75-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642740610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642740610, "uuid": "4d9240a4-f126-44b7-a243-782ac750e349", "comment": "Malware payload (Mirai)", "value": "c8eac6c41bd5f6ec5a65524142f340e0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642740610, "uuid": "61ae8b05-62e6-4dab-8337-8c7281471997", "comment": "Malware payload (Mirai)", "value": "b916d6f9d2756f35b510f1e89cf54a3601b3aafdba2a506cd9e5254e0dade88e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642740610, "uuid": "e0b1000b-f649-4774-a226-4d8608c791fe", "comment": "Malware payload (Mirai)", "value": "ae41cee628bdacfe7dd71dd1e4ab90e71a9d0a86", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642740610, "uuid": "c65a8d1c-3455-4f9d-9f70-dd723d7f3142", "comment": "Malware payload (Mirai)", "value": "87358d3d23aaf3a6854d0c40b530ee8b5d695d843a84b4220142dada6bcc9ff3b2d34b27070031101f1d3374bfa59002", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642740610, "uuid": "2a815eb1-8e8b-4b13-95e0-63a8e419fc4c", "value": "T19C831845BE825A16C6C147BBFB0E43CD33226398E3DD7213CD156F51778AA6B0E6B062", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642740610, "uuid": "901b7b22-7ad2-4e66-bb34-b6e2c555578a", "value": "1536:0DS1KyEi7hinozX7mgbmvKbvlTuWrYn4XqbMyHFrzLv6aevo0YwbZnFA:YZi9zLmvvKuwYNoyHFTcKwbZnFA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642740610, "uuid": "da0bac5e-7dfb-4011-83c3-78f66d17988e", "value": 83264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642740610, "uuid": "214f1581-223e-4b26-aaef-60c622fbac4e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642740610, "uuid": "38e723c0-163e-49bf-9d2f-6e55f64c109f", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0e9adf1-7b06-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642802920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642802920, "uuid": "34bb2741-7d08-4b64-895e-5f725ee3cee9", "comment": "Malware payload (Mirai)", "value": "743100488db5bdca03b536217736b957", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642802920, "uuid": "81073fdb-4c35-47ba-b539-2c1b96924571", "comment": "Malware payload (Mirai)", "value": "b96328120b29387466c5d9faafedb420decb0f7994554f706fc5c8e2f35b422c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642802920, "uuid": "2b331d0a-f55b-43ff-a651-6088a05a895c", "comment": "Malware payload (Mirai)", "value": "419b7d3b1ba17b5d1effb53cb4126181ff7fc4ef", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642802920, "uuid": "6bb313f4-25ba-4590-a7ac-547319d861a8", "comment": "Malware payload (Mirai)", "value": "d148f3b111a83d269a7fd331824c09583dd2469286fd0a9ed43f95d8dc9d4a40c78c963f831634aa2d70c0671b30e6f5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642802920, "uuid": "2c24f7ab-9587-4d65-9d8c-809c50b0dd89", "value": "T179D2D1BC5B0047BAD9AE40B927A503D93DB58F14E4C3FE6A59C0BB92CE804F539975C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642802920, "uuid": "02d9d0eb-d097-4689-a765-4891d01b487f", "value": "768:tyvYLznDEB2iC+sDqC6NtxsLLd9AtQVdX4JgGlzDpbuR1J1:oYnnDEBI+smAd9AtQVWVJur", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642802920, "uuid": "a2eadd8a-27e2-4cc4-81d0-df1bce1d2692", "value": 30848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642802920, "uuid": "a31f7a53-472f-4ae9-b547-bc9fb0c47b00", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642802920, "uuid": "f269d147-9f17-4bdc-a1e3-969e8ac556d6", "value": "743100488db5bdca03b536217736b957", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b05416f4-7a62-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1642732482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642732482, "uuid": "bb951718-20d8-4961-96bd-9e450982f24c", "comment": "Malware payload (SilentBuilder)", "value": "fd8d3013f09baf45a5bd13b25d7485cd", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642732482, "uuid": "0cee620e-04c1-4215-bdb2-33c46de5dc51", "comment": "Malware payload (SilentBuilder)", "value": "baa950d432aeb1593d886ae1afff9dbc40b6be9828af26c7d3c72431f4fdafff", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642732482, "uuid": "06b9611a-47e1-4fa0-b21c-7922fc95c888", "comment": "Malware payload (SilentBuilder)", "value": "beaf62271beedcc7a2f94756cd96c526eda7059f", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642732482, "uuid": "562fab5b-98ac-4c6a-b6f3-fda47a003db9", "comment": "Malware payload (SilentBuilder)", "value": "690aadaa95308f93ce467daa3c2208ba89ae59ceca3ed924a4d15ac7c4cbdc39d2e239dc2d2c973af9f90b95caedac38", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642732482, "uuid": "075661cb-7ea6-4a2f-b642-d06db032882b", "value": "T1A1636CA7B78299EADA0483394DB643C5B717EC104F9A43C73694F7346EB49F08D9324A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642732482, "uuid": "89b84db9-5a6e-4630-9b5e-4502b4ce05d6", "value": "1536:bpEk3hbdlylKsgqopeJBWhZFGkE+cL2NdA8eXZiozeOgXVZKyaZpvyR1kZkJvU+:bCk3hbdlylKsgqopeJBWhZFGkE+cL2Nr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642732482, "uuid": "0030f3c1-cca9-4293-a619-f501b43a952d", "value": 72135, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642732482, "uuid": "45d2eb95-5316-4bf4-93c9-4e43e6ecb445", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642732482, "uuid": "ef6e9609-a7b5-42a3-8662-e10438324a3e", "value": "fd8d3013f09baf45a5bd13b25d7485cd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84de9b6d-7b00-11ec-9275-42010a9c0029", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1642800270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642800270, "uuid": "44ccb688-a402-48b9-af55-f857bcc12877", "comment": "Malware payload (RaccoonStealer)", "value": "a5e1bd071692b98eb33ce95509259e18", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642800270, "uuid": "fba08b55-4c50-4311-80a0-a90adbfab53c", "comment": "Malware payload (RaccoonStealer)", "value": "bab55804afef5da34492f5decf8cd52733055b4101e95bed62f3680c715e241d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642800270, "uuid": "12975fc6-63ca-488a-a906-0892089880e8", "comment": "Malware payload (RaccoonStealer)", "value": "cc50cacdc1a130e02079009ca2650cf4088dd3bc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642800270, "uuid": "f4725b25-3d07-4208-ab55-884d5a89aeaf", "comment": "Malware payload (RaccoonStealer)", "value": "5d3ee095f43f36655b7ace082e7ed79a29c206e001de5951c7502d6bd96a12fc8c833973d891a511018615bc74e9a662", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642800270, "uuid": "9bfa8cde-0dc4-41eb-8a3d-0eac0aa69de6", "value": "T181E4E010B7E1C439E2B712F8597A837CA13EBAA11B2451CB53D526ED9B38AE0DC30757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642800270, "uuid": "2c6772c5-d6be-45be-a716-ce46318a1f7e", "value": "475f7058e090be99fd15edb6d2e40c10", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642800270, "uuid": "e95a64fb-f86c-439e-8543-ab1eead53ff5", "value": "12288:z59I5NJxvn2jRME7FLOr4TMYz5+J44AXKJ7z5wtrZweVQ+/EtMPPs5pXMsE:l2Zn2jCE7lO0TMYz5+AUf5J+/EtAm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642800270, "uuid": "92a4e947-b526-47e6-b874-9c14ef94036d", "value": 693760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642800270, "uuid": "fa7f25da-881a-4649-ba1e-e59eda4981ee", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642800270, "uuid": "27eba4d9-12df-45da-8db2-a879587d1416", "value": "a5e1bd071692b98eb33ce95509259e18", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1c2b094-7aea-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1642791003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642791003, "uuid": "b1ac2554-b371-4f13-8f62-189de4d0f9de", "comment": "Malware payload (Gafgyt)", "value": "b57a722bc86401b87997656c60cdc1d7", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642791003, "uuid": "791ceffb-97ad-448e-82fe-b20ad1ce2ac8", "comment": "Malware payload (Gafgyt)", "value": "bb286e5462f3245f07919ef82b7ee8a99ccb9efbbff890786d8275005966f842", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642791003, "uuid": "2b0b356e-a2ff-4141-be03-e645717c7198", "comment": "Malware payload (Gafgyt)", "value": "db299336f7951671d32fe57db8fab08d76d77779", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642791003, "uuid": "a77a0d3a-3da4-42eb-b234-f983a29e4463", "comment": "Malware payload (Gafgyt)", "value": "8e4026a52d03e0368bce197a8b8e7a676d8ea955fcf71d02bc80e73a932db22857e14b3b22ae406c9ccb3bc003c7a60d", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642791003, "uuid": "88137d37-a4d0-45a2-9c9d-9aaea7576ed4", "value": "T1E823F113D5CE9EFBE33A51789C8BBD060910220F5188D5E7E38CF2D79910F60A658B96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642791003, "uuid": "c7fba299-0395-4c62-ad77-bb45af71140a", "value": "768:Jcg5dbBGPVu1JqBgc09pjHio0UhBVmqbK5yiRtmH7yXnbcuyD7UWyqBaQrBb:JN5dMPQ1TcwRHuMXgyiRtmOXnouy8Nqf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642791003, "uuid": "cedcdb8f-09ec-48d0-adec-353b1278fe00", "value": 47408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642791003, "uuid": "c078b81f-a611-4a5c-a1de-0be598e6a409", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642791003, "uuid": "62d08317-d8ad-4c54-8f6a-aea951332c78", "value": "daddyl33t.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "953fe80f-7aeb-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642791278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642791278, "uuid": "6f4d5527-fefb-4bbf-aa76-ef6668e93613", "comment": "Malware payload", "value": "6fd7a75e4a31a4d0391cde2eafa6d5e2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642791278, "uuid": "b21967b3-4047-4b54-9d73-42d18b4fc7dc", "comment": "Malware payload", "value": "bbe645c9580d37f74350e17d80b68b6fa73fbeaee7c574320ff758d9c3cb7552", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642791278, "uuid": "7d4ca4a6-eeb7-49ff-9069-706c64288066", "comment": "Malware payload", "value": "fc35d234556eae92624d47d90ee4cddf030b52ff", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642791278, "uuid": "739f21f6-fed5-4fdd-92dd-b2def655e07b", "comment": "Malware payload", "value": "3e9650446fa8b3c18aa0cef272ca3fe185e44febf5a758b219fae4be602305924fa50e21be07825b1ac008e12a356db2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642791278, "uuid": "8fbf541b-1409-4d5a-a724-9d94bbb2500b", "value": "T1DB04C325EAF7DDB0CA52093BA12CFA2D0D1D2D791D67F8492458FD23EEB6ACC9840171", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642791278, "uuid": "94f3db0d-9d84-4ad2-bc0a-0afe9a4b1f53", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642791278, "uuid": "e8c9f4c2-0220-42a9-85ee-3e4e6814a429", "value": "768:GCSHTplbpdedgaYVtSHPWclhVm13jtJXtg5k4ZaDBo+CO8nYOj0h:2plbpdyp5k4ZaDBo+CO8nPj0h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642791278, "uuid": "258095d5-b295-45cc-b5c9-d27dc54f1c56", "value": 177152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642791278, "uuid": "bd958504-8749-45d3-a3c7-eb4ee507b788", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642791278, "uuid": "f2fbe107-6def-4eae-a76f-f3b864091a46", "value": "6fd7a75e4a31a4d0391cde2eafa6d5e2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8c49bce-7a66-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642734268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642734268, "uuid": "56b455bd-a67b-4b7c-9c8f-9e48cd8772f8", "comment": "Malware payload (Mirai)", "value": "ddba92dcf5c5fd7b791f6278a3e20fb8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642734268, "uuid": "33f19adb-154f-4a30-8a8d-f3692ee59ec7", "comment": "Malware payload (Mirai)", "value": "bc08d8a3541834634fa5fd606805ee6e24cd07575af27bbcbb8ad02247cccd38", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642734268, "uuid": "83f9cd61-b32b-46df-9b26-58a318acfb58", "comment": "Malware payload (Mirai)", "value": "635075a22cd4e3ade3583d4e9787a09b06e50b76", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642734268, "uuid": "54fd3751-3ab1-4d64-bda8-1d7a8b2b009b", "comment": "Malware payload (Mirai)", "value": "4698bcef4d714ae3ad686471cad154b48e0b9064ac067cc8592340eefefe403f53e31fe346ae32dec7e2c247fb4a3272", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642734268, "uuid": "81d05491-e5fb-4f6c-bca4-11e2082ef29d", "value": "T1EC643A8AFD81AE25D5C523BBFA2F4289331317B8D2EB71029D145F2876CA94F0F7A541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642734268, "uuid": "f55933a4-daa4-4855-82c0-b30211e66d05", "value": "6144:T2s/gAWuboqsJ9xcJxspJBqQgTuaJZRhVabE5wKSDP99zBa77oNsKqqKPqO4:T2s/bW+UmJqBxAuaPRhVabEDSDP99zB5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642734268, "uuid": "cfe3f5a2-cdb3-4f55-94ba-02b36b61cfd9", "value": 307960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642734268, "uuid": "92b75ac1-fac2-429a-86e8-cddb67506f41", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642734268, "uuid": "d84c9668-6bf3-495a-99ce-aa5814e32f48", "value": "ddba92dcf5c5fd7b791f6278a3e20fb8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5935fd34-7a91-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1642752522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642752522, "uuid": "b601fff5-57c3-4eb6-a2e6-a338a3641777", "comment": "Malware payload (AgentTesla)", "value": "9dc2d8a0e5fa8e6d78b82e0ee2151650", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642752522, "uuid": "f8629e67-0809-4f75-868a-53d700750d6b", "comment": "Malware payload (AgentTesla)", "value": "bc32f632482633366b588b4e2278c4252eba9fdc30d4560a8a50f2fc91229d85", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642752522, "uuid": "1826ae34-28f1-4b1c-8f33-6f29065ca570", "comment": "Malware payload (AgentTesla)", "value": "a79e4d413915aa9ab09d6ecb2eee03f89c5453a6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642752522, "uuid": "16d9dd13-d18b-42c3-9d5c-5fe97fa3fe16", "comment": "Malware payload (AgentTesla)", "value": "bab3ee1163da4c036a9291e2a471cc485f996f8c3984803933cae4f364fe4febcaf01b4e2538697e25a0fb015f1a948e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642752522, "uuid": "5f787b3d-9c0e-4919-b957-0f3ef2624f64", "value": "T1D725CFA87B40B59FC50BCE758E682C60E760B4AB170BD60790571AED9A0D7DBCF112F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642752522, "uuid": "82c04434-4b7f-41b3-a142-55afe04a1765", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642752522, "uuid": "1b3f5e76-f41a-402b-b3e1-7c454b1ab3c1", "value": "12288:uEjqjFJiiiE9WfXGd333Y6fENXbHxehDHj0L2TmivpfSpEh5DdqpA57dWkHIv1vU:zj7fXk333Y6aXr0hkCTtRZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642752522, "uuid": "acfa329c-a8c0-4900-a69b-0abd29851b25", "value": 963584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642752522, "uuid": "492d56df-8388-4de2-bd22-7215a49d9d64", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642752522, "uuid": "69b90cae-ff7a-4dff-a989-4cf3f6fe943e", "value": "DHL Delivery Invoice AWB 2774038374.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d8ec52c-7ac6-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642775266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775266, "uuid": "a72bdb8c-5cf4-48be-a67b-09be9e7403d8", "comment": "Malware payload (Heodo)", "value": "1b2471823df460a058782aaf1177bb77", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775266, "uuid": "3290d2a0-c3bb-4007-b70d-1fa977c57668", "comment": "Malware payload (Heodo)", "value": "bcebf33c0812a0eb18e5261449f212582882eb706df65f5d2f2dd9d3b2c05da1", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775266, "uuid": "bced632e-b89b-4d09-aa2a-866d2cd26377", "comment": "Malware payload (Heodo)", "value": "d9a66d02064556aa4dfe44c09a6d979dbc63baf4", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775266, "uuid": "8400dbb1-6959-45fe-8031-73107f67419b", "comment": "Malware payload (Heodo)", "value": "7a864f504b18af7da935685175fa0ddfdb6bbebf348a8bb59f3adf9430866fc7d1fb23088c10144197084854aa12582a", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775266, "uuid": "549484fe-2923-4f05-bc0c-f4c8157d292f", "value": "T1A5636CA7B78299EADA0483394DB643C5B717EC104F9A43C73694F7346EB49F08D9324A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775266, "uuid": "2f24d377-60a1-476d-9b79-ab7f1e60f380", "value": "1536:bpEk3hbdlylKsgqopeJBWhZFGkE+cL2NdA8eXZiozeOgXVZKyaZpvyR1kZkJvU+:bCk3hbdlylKsgqopeJBWhZFGkE+cL2Nr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642775266, "uuid": "be2f9242-3f4a-4a5a-9c27-48af91866e91", "value": 72298, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642775266, "uuid": "3348974e-9d21-46d9-b339-f3e6373a8b28", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775266, "uuid": "d6b178b7-4f73-4d77-9cf4-5de49dc28ee0", "value": "SCAN8643_0006.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8d7e035-7ac6-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1642775527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775527, "uuid": "c5ca3511-9fca-4f07-9129-e15abce95ce2", "comment": "Malware payload (RedLineStealer)", "value": "aad9bcd99eb0d570d829a9bf0810ff99", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775527, "uuid": "bc1c8b85-6759-4c5f-affe-72bd4ef8dc2f", "comment": "Malware payload (RedLineStealer)", "value": "bcec9d5bf1c3652cf5d200ff652c71c56cc17e59c99b320f7ae77c1e4f5b15db", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775527, "uuid": "8f9c0c28-8fc5-4d0a-a81c-0a879da16f37", "comment": "Malware payload (RedLineStealer)", "value": "3ad0439a4645603a2fd4297a56a4d97a0148bbc2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775527, "uuid": "2ee9d3c4-01e4-4087-858b-2c47aa2ba40f", "comment": "Malware payload (RedLineStealer)", "value": "b5c1cf78cc6a6b22bc5726bf6502b01e93c7b854939a66608efdc74d124d30f2a8523b79231c06871558e8787d2d7087", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775527, "uuid": "f7030c5d-8a99-460f-80ef-3c27e00aa9cb", "value": "T1ACF533DE8B15FD83E10B163132D0359966F1AE516AA63C03836ADB19DA87BE7C30315F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775527, "uuid": "5ffb795b-90f4-434b-937a-ff73b9ea4047", "value": "c284fa365c4442728ac859c0f9ed4dc5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775527, "uuid": "8e5ba9d3-d400-4a3e-99b3-2847efac2553", "value": "98304:WXmEJgouVsH7g0EzhsqYQ5zXUW5bOJ0qcgzkF32S:REJgoNH7KhTgkj9gzkFmS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642775527, "uuid": "e4cf5bac-85a8-4bc9-91a4-c59fe2c941d8", "value": 3594544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642775527, "uuid": "833af15a-767b-4610-9a5e-1ae15ebe0bda", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775527, "uuid": "69d6d941-810a-40e2-ad9a-5fed3f985131", "value": "aad9bcd99eb0d570d829a9bf0810ff99", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5a1865d-7aad-11ec-9275-42010a9c0029", "comment": "Malware payload (Smoke Loader)", "timestamp": 1642764676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642764676, "uuid": "39f8ffb1-6ee8-41b6-957f-f9d6f5937d6f", "comment": "Malware payload (Smoke Loader)", "value": "ba83e12f8426ce41f50304dfb874ebd4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642764676, "uuid": "d1e4104a-9b66-4ec8-8b7a-e220822844dd", "comment": "Malware payload (Smoke Loader)", "value": "bd77b945024898d5ade268a5b1d932026ba3acc6bc9e05d6040c7fb57d94d01b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642764676, "uuid": "6f6878db-3c9f-4a0b-a6ff-41bca3074248", "comment": "Malware payload (Smoke Loader)", "value": "bff945f2bffbaa2b80648ca9485fab26420e0e0f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642764676, "uuid": "fb29e98c-04b3-4b25-9405-d368edf08025", "comment": "Malware payload (Smoke Loader)", "value": "2ad0fbb6673368b1df9c6799df4550f4976f49341f2a7a6d4c60722c4e405f77c2cc2f25df44d463a54517f2b138de41", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642764676, "uuid": "91b94570-9084-4d34-a932-b6e3e97e327d", "value": "T1A6648D00BBA0C035E5B326F45A79937CB53E7AB15B2491CB52D56AED9B356E0EC3030B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642764676, "uuid": "7fefe952-fc51-4d6e-b7e8-615dc65e235e", "value": "475f7058e090be99fd15edb6d2e40c10", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642764676, "uuid": "ec492ec6-d44d-40c4-ac0d-d0b8cde52ae6", "value": "6144:7cAZ64h4CiXJJ2fTv3/OoDirheR3SQKM2SInhe:7cuKNZJITvPOoDyUR3d1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642764676, "uuid": "b3cc5c67-5858-4f14-bfca-31b56d0ee057", "value": 336896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642764676, "uuid": "1639a2ea-55f3-4d1e-b823-0661367aedfe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642764676, "uuid": "ed759580-49b8-4ab2-b7e4-2bb512ded03c", "value": "ba83e12f8426ce41f50304dfb874ebd4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69905e74-7ac6-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1642775313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775313, "uuid": "a97a8e21-2c21-4b40-a8cc-62d6f281111e", "comment": "Malware payload (Loki)", "value": "c891cee708b7b9a95b5165e0d2be0f6a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775313, "uuid": "8a5e80b6-dea3-40d1-8804-e67025993bc4", "comment": "Malware payload (Loki)", "value": "bde19e5d6dd3a25d4e9000047abd15c5cde7245d6e0f1a7da2c327395e94cf8a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775313, "uuid": "02adca2c-98be-4209-8e94-b7fa6a3b2024", "comment": "Malware payload (Loki)", "value": "2ae8e47f5dc14753425dd89c9b9fe28d0e78fc99", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775313, "uuid": "3ff20e26-7a28-4118-a85a-acc49e4d2b7b", "comment": "Malware payload (Loki)", "value": "fcbc649fc111ab4cbcf5d910276d5b9212692a4e1ec6c4a7ffae8550b07a088bfbe1f95b0fb0ba8a87c9c60a7b77bc75", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775313, "uuid": "00f7eab9-f20c-49ae-a231-ee65de741cd1", "value": "T14CC4CE4033F88B45C4BEC7FA587101A0177ABA1AA838E75FADD1B1DF09B1B419B26753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775313, "uuid": "e246bb81-4093-49f2-b385-28727d20e2e5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775313, "uuid": "022ef1cd-895b-421e-b76d-62341cb73f79", "value": "12288:xOkzGpQmOn7CC8xUDnKbN867DOq6+ievYF:MpQmLIDKbH7h6+ievYF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642775313, "uuid": "52e353e4-749b-4111-a325-5e62717412ef", "value": 577536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642775313, "uuid": "9816aa07-df3c-4cdc-99bf-ab854c3f84aa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775313, "uuid": "a1fcd4b2-302b-4293-b1a1-73e6279a44cf", "value": "c891cee708b7b9a95b5165e0d2be0f6a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f145f977-7aea-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1642791003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642791003, "uuid": "c526c28c-e1ef-46e0-b41b-a0a183caf85f", "comment": "Malware payload (Gafgyt)", "value": "a3bfe16550496dbf27e58543f602c221", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642791003, "uuid": "b9d138cb-5805-4835-81f9-28fc73417094", "comment": "Malware payload (Gafgyt)", "value": "be032575b736bd2076194a328db46cfde4470482f09741070d8e38083a1a8159", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642791003, "uuid": "704f28d2-46d4-48a8-9157-1e57fd162e11", "comment": "Malware payload (Gafgyt)", "value": "caae175be5b6642919e60d19eefc4fe573004075", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642791003, "uuid": "1ab47c1c-f6ba-49d6-a3cd-1ec0da6e2f92", "comment": "Malware payload (Gafgyt)", "value": "d86a6f395cc6411994ea18b75ccb8864d20ea598c0bde5a743877466b733045e1f2fa2d3c4055abc7c73cbde491730b2", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642791003, "uuid": "4f4520ed-2400-4285-9d3d-72021daaac87", "value": "T1EA23F144703DFD12DC1B84BF693E755411D0E71ED0A90B98BFE82839AD69B532EE01A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642791003, "uuid": "b12fab71-68ff-4a78-8858-342846b8dd8e", "value": "768:oDV7xLhFGdMpXadg/NqUZLQ5ZxeKocEJnsKxVbrQCDuELanbcuyD7UWyqtkGCnds:oDVRjacNqn5qmEJnoCVmnouy8NqzCchp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642791003, "uuid": "8e4e6a3e-89f4-45d2-9602-dec665d49393", "value": 48212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642791003, "uuid": "daefc9fd-ff43-4519-a207-95c605faa60f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642791003, "uuid": "3a4d58e5-e583-4c3e-9cdc-12edb8198345", "value": "daddyl33t.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d443f034-7ac6-11ec-9275-42010a9c0029", "comment": "Malware payload (Smoke Loader)", "timestamp": 1642775492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775492, "uuid": "aa39c39d-a2e4-4bb3-a4d2-9ca079f39487", "comment": "Malware payload (Smoke Loader)", "value": "0d15a75fc279a0ad6f905a573de511a4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775492, "uuid": "58e90410-c1e1-45a8-aecc-e2218d3e71cd", "comment": "Malware payload (Smoke Loader)", "value": "beefc504a33cac82813bd5372c4276d1a2b3d9141cfad907dbc41c7fdbdf7598", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775492, "uuid": "e277ed45-b930-4869-814b-87557caf0cc0", "comment": "Malware payload (Smoke Loader)", "value": "38a0ff438fa05ccc89cea3e96db1d8f063659bcc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775492, "uuid": "b363fce4-e36f-4bde-a98e-e8eaaad2386f", "comment": "Malware payload (Smoke Loader)", "value": "071dba63573f7250263ef53f44b8d21a2e9a45c7e3fd830a26c114a4cff63b6a0bd9822e4f2231d8704a2c1c0449c7a9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775492, "uuid": "fc0095aa-03cf-4567-9b18-bd7cdd82fd49", "value": "T1E3648D10BBA0D435F5B312F44AB993BCA53E7AA1572491CB53E51AED9B386E0DC3031B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775492, "uuid": "d79784d8-e2fb-4db6-822b-ab344a5654cc", "value": "b4892f1130d31e71dc6b3341892a29cb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775492, "uuid": "85558e6c-fbd2-4ce7-8aa2-f7998b70eefb", "value": "6144:6/BwHjwAnECqHTEt4kIJQ8YaYCT8IRvUucbzmpGa/Txd:6/+HjOlzE4kIm8Y55cUuGKprT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642775492, "uuid": "9d45816a-f443-420e-b46e-88d058e78b41", "value": 336384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642775492, "uuid": "f0381c89-125a-4712-80c7-c5747e06421f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775492, "uuid": "2960b3bc-2884-465d-a296-d5a213ae8044", "value": "0d15a75fc279a0ad6f905a573de511a4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e2fed1d-7a9e-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642758114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642758114, "uuid": "e38757e6-2a4f-40c5-9bbe-6a1f84d7c1f5", "comment": "Malware payload (Mirai)", "value": "6f61b575329ee4996e45467a817d6a39", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642758114, "uuid": "37523c92-b447-4eaf-b258-2dd2d52b75d3", "comment": "Malware payload (Mirai)", "value": "bf666436bc3e0201d65a6b5b5fd8bedb6beec3c88aef9e6edefac6c304a5c297", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642758114, "uuid": "601ad4df-04ac-454d-86c3-326c59ce7297", "comment": "Malware payload (Mirai)", "value": "bc4eaffbde6c11c7ea24b57bb764be56c0e81d37", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642758114, "uuid": "872bc157-7e69-4da9-b5b9-c78ad605d3f3", "comment": "Malware payload (Mirai)", "value": "5d713204326353dc4d25a5dd1e8804368c1480c20993f46549e4625ec133a895727c3c30ddaa4c6eaccea79329bc50bf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642758114, "uuid": "61802c1d-d1d2-4b4a-9b25-db1589f324e9", "value": "T1A343F852BC818A12C5E4137AFE2E118E3313676CE2DF73239D106F54778A96B0E7B916", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642758114, "uuid": "ed918ee6-50a5-47ef-bf25-cc95d6de7285", "value": "1536:9xnYYiFi+OVxb+irR6ZCqMINczIkizqvz4pHr:RiiB3+kR6bqvz4pH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642758114, "uuid": "b5f2c931-4180-4931-845c-eb09d77d9a1b", "value": 58668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642758114, "uuid": "97cf943c-a77b-4b42-8e9f-47c8df5a9547", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642758114, "uuid": "d8f53d64-3371-4c15-a936-a38323056aca", "value": "6f61b575329ee4996e45467a817d6a39", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0dcaaf7-7b06-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642802974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642802974, "uuid": "941c7f06-7282-4e5f-aaf9-88c9515acc40", "comment": "Malware payload (Mirai)", "value": "e36164dde84121262f408aa8f31e5fa2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642802974, "uuid": "ee9ba338-a437-4f61-b14f-7fc3d3d58192", "comment": "Malware payload (Mirai)", "value": "bfdd13a393a79e52642921a798a999810ff60b46731308eca6fd2b5b73b1d69f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642802974, "uuid": "7e49c36b-2116-4e88-afc4-a7088dca5c2b", "comment": "Malware payload (Mirai)", "value": "d32802e2658db9b4f5fbcfa4f241fa738d6efe24", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642802974, "uuid": "ed30c921-c5c2-49b9-810f-7023770c842d", "comment": "Malware payload (Mirai)", "value": "afb062cd2019b3a82c06838f7fd70954f96624025e960e6e8d0577b1a95698351ad3ed587fcc5ca269bc97ea5b551c86", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642802974, "uuid": "98131978-dce3-4421-b47c-55c3b189f559", "value": "T165F2E063285ACD61CFF0353AE6E172057FA91E78C568787211646F18BB8FD8F70A018B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642802974, "uuid": "2001377f-0755-47bf-89e4-b83cecfe0eba", "value": "768:9b+GsIbn0XpiTAPB4bT9bOs26GIa+UqaXS9q3UELQq:9b+GsLidbT4s26dVUqaXLb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642802974, "uuid": "30e3f534-025e-47b0-aa97-75a14c0090d9", "value": 34488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642802974, "uuid": "6ebd5dc8-3c80-4908-bce0-68323c5f9fd5", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642802974, "uuid": "c5807296-9c52-4042-b7fa-d3e28beeefb8", "value": "e36164dde84121262f408aa8f31e5fa2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb97e14a-7aab-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1642763962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642763962, "uuid": "ac42a46b-64a7-495f-837f-25255e06fc64", "comment": "Malware payload (Loki)", "value": "cedca83dd808936727659e5227386839", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642763962, "uuid": "60dd33ee-16eb-49ce-b8e6-434d55540fea", "comment": "Malware payload (Loki)", "value": "c038069e737cb2c74934c0e86449fb4e37d7bbeaef092cfe06e925431bcb4806", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642763962, "uuid": "4141eff9-0da8-4831-b241-a4a6c3674d1b", "comment": "Malware payload (Loki)", "value": "29383bfc7324f909a2dc2dd795c23534858fa443", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642763962, "uuid": "165ea556-ff09-44aa-bcc6-5ce86c8dfb2e", "comment": "Malware payload (Loki)", "value": "33b981f8bdc523d3e3b19395cb00288e3ef473b9b25298be2836e5119011c52054ec5cf585a42421eb042e0bf8c45cc7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642763962, "uuid": "3aa33b1c-0f86-4142-9a3c-4dc4dfeae571", "value": "T19FC4DF4032F88F05D9BECBFA58750090177EB94AA865E31F5DD1B1EF0DB2B819A22753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642763962, "uuid": "4ed673d8-21d5-4e69-a91e-678f958a852f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642763962, "uuid": "8bf2fa78-9f0b-48aa-becb-e8392aa881c6", "value": "12288:PCGTP6pQhONLTP67ojF6u1WnafyKqxq6+ievYF:NipQhmTPi8l8/I6+ievYF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642763962, "uuid": "560fa8e9-7fc8-4711-aa41-dfda7971ef03", "value": 581632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642763962, "uuid": "fbe61e1a-5490-4639-86cc-938ce230234d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642763962, "uuid": "a950c928-3d62-4929-a8d3-f80a4cb8ad06", "value": "cedca83dd808936727659e5227386839", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "293f4bcf-7a9c-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642757166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642757166, "uuid": "3587298f-f8fd-40b6-8896-d0ae10be1745", "comment": "Malware payload (Heodo)", "value": "832e664a4889855375c5243c8e57c184", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642757166, "uuid": "d079943c-a1c1-4cac-9af7-b4f3ee1aebf1", "comment": "Malware payload (Heodo)", "value": "c1254259ee85998dfb96c19c1f01fc892603bdd55a11368e10938bdd4e972255", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642757166, "uuid": "73cc2f86-5c26-4e4e-b004-b3520c7b89ac", "comment": "Malware payload (Heodo)", "value": "49b9153bf82e043c5e2bf510a3fe1fef568b44b6", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642757166, "uuid": "ff07a612-c638-4390-9e8e-f117e007f7d5", "comment": "Malware payload (Heodo)", "value": "3d39e9374097e8af17b1649ee29b7c4cd0bb688931539cdc8945bc7f4b86bd378bfe23f2cb56ff53241c5bfba1b59b96", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642757166, "uuid": "ba2494e6-b193-4e6c-b0dd-8c87f96b0d91", "value": "T155D4BF02B2D1C036C5AF11B08E76AB08A2EDFE905B7985DBD7847D5F1E31BC26635B06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642757166, "uuid": "25727e2d-bf80-4666-b74d-1a0451c40801", "value": "42bfc936e90bcc6f5b01541917ef37a4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642757166, "uuid": "d4dc6d71-16f5-4239-8f4e-8e2c324ccd3a", "value": "12288:Td0saabmsb61ZuV3ZGuyfEgXkvPLEbsWrxD8iP29pi9NSG1DjsgqXXvhhcwEPwqh:68mi61ZuRZGuyfEgXkvPLEbsODYDcVnm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642757166, "uuid": "ca35cf6d-9c7e-479c-94fc-a6a5a2f46e6e", "value": 638976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642757166, "uuid": "14c611eb-4736-4f41-b720-1ee3ebd53b0c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642757166, "uuid": "fa046566-a6cb-485b-9f66-e9e76af52fb8", "value": "IT8GHjQ.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c08a387b-7ad5-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642781901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642781901, "uuid": "5bb22ad0-7c3d-4b6a-9f64-4541c42e6b75", "comment": "Malware payload (Mirai)", "value": "83ce50bb7a5bcb60dfabe87cdf2b9899", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642781901, "uuid": "d906a053-fe95-47d1-82e8-678e0f339477", "comment": "Malware payload (Mirai)", "value": "c2f39ba068cfc59c2d953425624a6d59228e98e12a6b0cec62154b8b72936a12", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642781901, "uuid": "12800d56-f055-41a1-ae3f-d21306c0d835", "comment": "Malware payload (Mirai)", "value": "6233e59f3263333d00435f9b0c77fec0d6df2fcc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642781901, "uuid": "cae4014d-040c-4e05-8b98-2a9273a23172", "comment": "Malware payload (Mirai)", "value": "4d9ff273b022737eadf55f8ef5614f8de86276e0672f67ea6939f8ab8c00587e551448fc4139b55d27b310588eaa9ef0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642781901, "uuid": "e73aac94-adc4-4eb7-801a-b905505756f4", "value": "T127336B65E8294D64C14E01B4B82C8D3E1FE3E4C5A6823DB26ADEC271144FADCB904FF6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642781901, "uuid": "1e0139a8-6958-470e-885b-d4c85f775e6b", "value": "1536:3a+BiFCYXjD2/FuhFMKbwBx/CURAYEYCF:3pioYXOt4yyyAYEY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642781901, "uuid": "93087824-d061-4e42-93ab-37670d220a3a", "value": 54668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642781901, "uuid": "81202aa9-300e-42c0-93cc-23d9404c1995", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642781901, "uuid": "f6ca7757-77bc-4753-bbaf-7ca203f0a7ea", "value": "83ce50bb7a5bcb60dfabe87cdf2b9899", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4392e15-7aa7-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1642762231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642762231, "uuid": "7da6815b-12ec-44c8-b5f0-9c5088894645", "comment": "Malware payload (Formbook)", "value": "1fdb2a2a15b8829222905938c0399b70", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642762231, "uuid": "19495156-c94a-4c88-ac3b-2d7d5c2748a3", "comment": "Malware payload (Formbook)", "value": "c40cb8e662b4cf175209d5475dbbe0066fb6d10403e82f9befb337ca08d194ef", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642762231, "uuid": "4f34aeac-d71a-4187-b2ad-72bbf34806f5", "comment": "Malware payload (Formbook)", "value": "5bdee5447dba708f9faf25be79491ea82a63f0a9", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642762231, "uuid": "72f32468-4e16-499e-864a-60f95c0e0edb", "comment": "Malware payload (Formbook)", "value": "c23afa9671603766caecbd22bcaf420ab4275d1063a9c981123611eb415ef384153443f450ab16c0ec00abe37f0be6b3", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642762231, "uuid": "ff40c5c9-515f-4a94-895f-118238597c9f", "value": "T12714126073A6A032CB3226B67B1661944635FCC8E801A283F56177F411B1BED4EB57BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642762231, "uuid": "2e525298-9b23-43c7-a83d-3e9e068f4e8d", "value": "3072:HG98tF4SI0ZI/RAP9Q5PdRwQYUF42sYOqKuEjStWLT0pAGJuJUPygETLOOURHL3r:gS/GpOWPdRwUF42sDz/jNT0pAGJuUKLs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642762231, "uuid": "2fc533a4-4df4-4ff2-a8e2-1c557e6b2834", "value": 192424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642762231, "uuid": "d387e752-4cca-4288-8892-72625ab1c3b3", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642762231, "uuid": "174a229d-44ce-4ac9-b35f-0a42c3589844", "value": "scan097890_Mega Benefir.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fcd43ea-7a92-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642752882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642752882, "uuid": "7689b050-0ffd-4ae0-9c7e-5d8629dd1f81", "comment": "Malware payload", "value": "a10b56157a3a2176117414949c968c39", "object_relation": "md5", "Tag": [ { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false }, { "name": "vodafone", "colour": "#8E01DC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642752882, "uuid": "e14e5cd8-bc00-48ad-8f01-8b9fa811602a", "comment": "Malware payload", "value": "c57d9e1d6782411cfe4dd53e8cdcd5cd0c53abac6565860f790d674940995dfb", "object_relation": "sha256", "Tag": [ { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false }, { "name": "vodafone", "colour": "#8E01DC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642752882, "uuid": "097b1437-1d87-4f77-b31d-b86894136e53", "comment": "Malware payload", "value": "e1a76f16ab5149913084e0237a74e3dea034f166", "object_relation": "sha1", "Tag": [ { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false }, { "name": "vodafone", "colour": "#8E01DC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642752882, "uuid": "53c7e58e-a878-4836-bd27-edd01d0f00e8", "comment": "Malware payload", "value": "d46bf0b2686f22b6c6bc8a2ca58434310153c1c52a42850d173d6334d2df60fc25a2ae30969bc79dea5ed233412d0b24", "object_relation": "sha3-384", "Tag": [ { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false }, { "name": "vodafone", "colour": "#8E01DC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642752882, "uuid": "a7a9a69b-f673-4c61-92c9-2f533b238d8b", "value": "T1BBD022EA3887C0D8E9AB30051A80BF68A81AFA10F85A9B0C38860059C0A035FC14AB62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642752882, "uuid": "00d75a34-b16d-46ff-8edf-3e938ebe9d69", "value": "6:G43vUrkgZrsxROM2iT9hnOXELq8Iwn/12XKDPXbCn:G4fUrptsX5wYqLwn/1UKDvWn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642752882, "uuid": "2abe1996-0e6e-4454-b6da-60394cbc22a2", "value": 212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642752882, "uuid": "d16a1f04-c61e-489e-a669-f67af113155a", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642752882, "uuid": "4d9ad05e-1747-4dc3-8c78-2853bed57794", "value": "vodafone_17.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee6de32e-7ac5-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1642775106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775106, "uuid": "7661c40c-cf79-48e6-8954-9dda8dac6ae1", "comment": "Malware payload (Formbook)", "value": "96f1bd6a162b8802877dc41452a43ccf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775106, "uuid": "89ad809d-e78e-4fcf-b785-9d04f5a9d5f2", "comment": "Malware payload (Formbook)", "value": "c6cbe14f336bc97cc4bf2db682cc36efc1b371f6cc45509ee347c29348903676", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775106, "uuid": "39150b0a-75ed-4094-a5b1-77f99c72e1c2", "comment": "Malware payload (Formbook)", "value": "a9205fa768cc55a34c22329b9e0199b23604d5a3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775106, "uuid": "c172ebff-70d0-446f-bf6f-ad19aa2068a5", "comment": "Malware payload (Formbook)", "value": "8521eb36b2b19616dcbcf15f3903dff2c528a225a5e81ec5a57198eba685607dfbb0d2e85d8bce04d80399a9d07507c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775106, "uuid": "301b4e43-0902-413c-b03a-34bf307dea4f", "value": "T16854238D23C8E9B7E1994975681343BEF7F565221FA2032B53A40FFEA64214393167B1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775106, "uuid": "5ca8de3d-c330-4a98-a2fe-1a75f91dd46e", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775106, "uuid": "29203f14-16f1-416c-98ce-734df883e89c", "value": "6144:ow6aMaknBzPxzp1DmUmJep+6nhohxHiiU+w4ELaa:mNbBTxzpUedhL/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642775106, "uuid": "f9b23a53-8d70-49fd-868d-2d7469f35c9c", "value": 284881, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642775106, "uuid": "30dc8921-9074-444f-bf20-005113f3091b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775106, "uuid": "43a09f32-2bd7-4384-b133-51f53f66f5a7", "value": "Ziraat Bankasi Swift Mesaji.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd959de2-7a61-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642732075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642732075, "uuid": "a18bd38f-7d74-4d36-ac28-f2f89e12805d", "comment": "Malware payload (Mirai)", "value": "59ae74a22e6e62826a8c8577446aa8b1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642732075, "uuid": "2e08c839-edd7-4412-ab57-d9d15520bf24", "comment": "Malware payload (Mirai)", "value": "c7d234d7348b704e643557b88b5582ce06048a6964a53c64cac006a5b0f8252c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642732075, "uuid": "388ac6ae-9b63-4ff4-8153-8e6ff790aa14", "comment": "Malware payload (Mirai)", "value": "84931b2eba0641e151267c522d8b18fb60d86ae6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642732075, "uuid": "23664110-d23e-468e-be0c-6bee0aa1c485", "comment": "Malware payload (Mirai)", "value": "e512fb7cf5e244fc03cd8791883e6165cf471d9d8054f9e100211a5629192edb4c96439cb9974029a63e18e65dca56f6", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642732075, "uuid": "905dea0d-8a36-40c1-b61e-6a7c3872079d", "value": "T105C25D43DA82ECBAEC5705F75537A3A28733E52A2006DB45C3386734ED52520AB3B78D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642732075, "uuid": "ba5a7ae1-9487-4232-80a2-1c13a6eebbaa", "value": "768:lcmT4xdQ3H9YcE0FThkHvutOsH8C1VTSsCIZ:imT4xqX7VkHvps3vST", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642732075, "uuid": "aa976483-9fb8-46b6-a02b-e6ac85354126", "value": 27444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642732075, "uuid": "274d1e52-fa97-404e-8cdf-f8e50f94658a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642732075, "uuid": "f1485f98-aa62-42ad-93ca-9c9052f517ba", "value": "beamer.x86-20220121-0227", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f00c3fb-7ac7-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1642775752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775752, "uuid": "6e4a75b4-7445-487d-b13f-3b67bce7bf4b", "comment": "Malware payload (Formbook)", "value": "c0b3e89e6ae15becdebd353a165b61ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775752, "uuid": "e26f4c27-89ff-4609-aecb-09fdf22d5f8b", "comment": "Malware payload (Formbook)", "value": "c7eeea84c68c73b96a2bc816b9738ca8c9c2abe93f7705ec07f8d1205422d86e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775752, "uuid": "948bd5b8-6afd-40dc-b813-bc9754139074", "comment": "Malware payload (Formbook)", "value": "276eead9497fdfddd51259240b69008cca8ce7a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775752, "uuid": "cda53054-696a-42ce-b9b9-3da92d833b34", "comment": "Malware payload (Formbook)", "value": "5015ea7f296cbcc24140e270533aac56d828eb22dcd06f38394bd223749bbc03511367997bfb3dd49e5c92c19523385e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775752, "uuid": "3dfd719f-abe0-40fa-8a9e-eacb8864f1c9", "value": "T1F45412AE34D0890BEC1B40314AB39A1987FBE65E0266030F9B56DF2F69651DB64373C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775752, "uuid": "5b9430fc-f0b8-47b5-9c58-c9de84d24f31", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775752, "uuid": "75c2f66d-a05a-430c-b89f-c9156f8a0bcb", "value": "6144:owVNM8/uuiTGQvUztyAGGGv1r1e1cGvQxmCmjv:X/CyQMzrXumFjv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642775752, "uuid": "bb797424-b3ae-4ff6-8b21-b55fba7543c3", "value": 285961, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642775752, "uuid": "9a414343-6e18-4236-888b-45fcbf4662fc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775752, "uuid": "67afa362-0178-45f4-9db8-1588fce69646", "value": "c0b3e89e6ae15becdebd353a165b61ac.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "270b4710-7a81-11ec-9275-42010a9c0029", "comment": "Malware payload (CoinMiner.XMRig)", "timestamp": 1642745566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642745566, "uuid": "2f1f4db5-a0b9-4306-a4d7-c468bafa76c9", "comment": "Malware payload (CoinMiner.XMRig)", "value": "ad3dcb298d9b41b47e9ddb3b5ddcb55b", "object_relation": "md5", "Tag": [ { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642745566, "uuid": "2cf03421-2c38-4fae-9301-b9dd2ab885a9", "comment": "Malware payload (CoinMiner.XMRig)", "value": "c8b8445f2852e90f152f6f469e61af5562850ae1814d8b93f7d7f3df0cb0b114", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642745566, "uuid": "75861a9d-79f4-47aa-b43c-913b46be6589", "comment": "Malware payload (CoinMiner.XMRig)", "value": "914556ef9cb7604f630e15eae909cf50ad1bd714", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642745566, "uuid": "5f9e9f51-735b-44a8-8ae2-9e5e4cb100f6", "comment": "Malware payload (CoinMiner.XMRig)", "value": "77b814ca168472ecf75efd6424b021bb74d0c06249f6d3c36069ac7fafaf94de62ca8429640ff52cb035df15091ba0be", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642745566, "uuid": "b77873bf-0e5f-47c6-9639-ad3fad108b31", "value": "T1AFA533F1EF9B68BFC79A613E9EBC0B5976D162145804ED07100D9A180F788A3CDB52DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642745566, "uuid": "2961f897-4000-4359-99f0-6536b359e214", "value": "02549ff92b49cce693542fc9afb10102", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642745566, "uuid": "07cad8bc-1c10-43fe-9129-bd681405cbc4", "value": "49152:jqLJ1V1Ou1OYVsUYWO17CFV30+xRBmGxdIBLgj9Qxey3NJn0h40L:wV1oYVIW0+xR0GwZeyJn0h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642745566, "uuid": "8bf0fc99-e9d6-4775-9596-1b9bab422928", "value": 2236416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642745566, "uuid": "de3fa13b-e3a7-48b8-8059-64420eb4a79f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642745566, "uuid": "d2e5acff-f01c-4e37-993c-d2ae82c5535c", "value": "svchost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a2798f5-7a92-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642752873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642752873, "uuid": "010dbb49-7a2b-4e5f-bb61-c2d3bae815e1", "comment": "Malware payload", "value": "9b865d75df2e634100ef456b11bf6a08", "object_relation": "md5", "Tag": [ { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false }, { "name": "vodafone", "colour": "#8E01DC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642752873, "uuid": "c31ed5ac-cd77-4cc3-9f8a-d7f9b7242ad1", "comment": "Malware payload", "value": "ca7a79fa1cc037b633778bbecefc12eccd8873a5f3e1e8fbbbf400af0fbd9f5e", "object_relation": "sha256", "Tag": [ { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false }, { "name": "vodafone", "colour": "#8E01DC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642752873, "uuid": "b02a4fa3-a521-4002-8ad6-c2c21f284cb6", "comment": "Malware payload", "value": "fd3b65e8b31395d95d6c3eb72c5d9908e7ec0252", "object_relation": "sha1", "Tag": [ { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false }, { "name": "vodafone", "colour": "#8E01DC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642752873, "uuid": "725c405a-36d6-4ca1-9cc1-525415ddb8e5", "comment": "Malware payload", "value": "d47e07153d45d82fc69d0843519ec064fd09d7e5f531ef4140aaaf06d3b00e43b1efd362d43dbadf4d71e6f392da151c", "object_relation": "sha3-384", "Tag": [ { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false }, { "name": "vodafone", "colour": "#8E01DC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642752873, "uuid": "7d34e8a2-8790-40d2-86b3-7c122e8709d1", "value": "T1EDD022E8B843C0D8F89F30092B8AF22ED58EAB20E85F090C788591A9005037FC408F73", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642752873, "uuid": "f63218ca-9866-4b9c-806c-491b77236ed5", "value": "6:G8H6LarsxROM2a567ScKnOXELq8Iwn/12XKDPXbrIn:G8H6esXilTYqLwn/1UKDv4n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642752873, "uuid": "2b1e3a44-33ef-4897-be2f-449a5fecc1ba", "value": 212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642752873, "uuid": "49457b0e-0f22-4b6e-96ca-7d09eb986e16", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642752873, "uuid": "745043d5-a06a-4964-880a-34a03aaf987d", "value": "vodafone_8.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73778495-7a4e-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642723790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642723790, "uuid": "32c1736a-68b7-47e4-bdc9-08434da1c75d", "comment": "Malware payload (Heodo)", "value": "158dbb2ffb2b136470c288ebaba13317", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642723790, "uuid": "8a0fb15e-4567-4cdf-95c9-7a531f166b37", "comment": "Malware payload (Heodo)", "value": "cad7905fcf7bffb73e65f5112df0d62332efdd358266178c4f24ea76b2601f16", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642723790, "uuid": "dd6526ba-7571-45dd-836f-debc0051fa8f", "comment": "Malware payload (Heodo)", "value": "b5f7d3c711a1dae3316cef96cc476cd38595e49d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642723790, "uuid": "f000ba06-342f-49d7-906a-6bd1da0cf012", "comment": "Malware payload (Heodo)", "value": "413910da83fe9b1f4b8966b129eb7c2fb3299d5f93767d2b684ea1db1801c4d21a18041a2457f8f9e20ac44a6160b589", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642723790, "uuid": "8f9624ea-7c26-43a7-826c-724d095ea2a5", "value": "T17AD4BF02B2D1C036C5AF11B08E76AB08A2EDFE905B7985DBD7847D5F1E31BC26635B06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642723790, "uuid": "275da57d-e988-4d13-a832-6263e03a3f94", "value": "42bfc936e90bcc6f5b01541917ef37a4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642723790, "uuid": "a25d2456-01d7-473c-96a0-5875852e6aae", "value": "12288:Td0saabmsb61ZuV3ZGuyfEgXkvPLEbsWrxD8iP29pi9N3G1DjsgqXXvhhcwEPwqh:68mi61ZuRZGuyfEgXkvPLEbsODYDxVnm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642723790, "uuid": "6a9db281-ae73-493b-a7d8-d5217530b0b5", "value": 638976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642723790, "uuid": "911dee06-398c-4c95-a7b1-646aaa82461a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642723790, "uuid": "3847fe2f-1577-4acb-a055-e83b03283e12", "value": "emotet_exe_e4_cad7905fcf7bffb73e65f5112df0d62332efdd358266178c4f24ea76b2601f16_2022-01-21__000943.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e2caad6-7acb-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1642777468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642777468, "uuid": "c612b3f4-1786-418e-ab5b-964165566444", "comment": "Malware payload (Formbook)", "value": "63fa230a35159e6ade271833711da9df", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642777468, "uuid": "115f36a3-9530-4e4c-ae47-99530ec940d7", "comment": "Malware payload (Formbook)", "value": "caf4d979c0c8b74dfcc6978be14adf4007f62ec3c7a8dfeaaf3b2b39d18bb09c", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642777468, "uuid": "03383b28-4c8b-4e0d-b01b-afc3a7617778", "comment": "Malware payload (Formbook)", "value": "82764ce074f8fd623faf65eb0ad602766b7c9a54", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642777468, "uuid": "1ac1c128-b6a6-42d4-907d-07c889605013", "comment": "Malware payload (Formbook)", "value": "7c5dea1467123c86ce17e3c38fb4d2bbc68b018502d8e3cf0b3f6dffff974cd946d6241ed99b5c282d3f793d1949c01f", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642777468, "uuid": "49333b33-ce8e-48cf-8e5f-b639e0f27398", "value": "T1A69423DD2543DD433FC4C2B70C48C30C7A15552AD9EBD86FA44CA6B48A5D8FA8EA87B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642777468, "uuid": "1b6b5d8f-bc64-43f9-a0b5-ff6ef02f8a28", "value": "6144:Va6auYTzdyOhGTKoRSy1lqzLo8ONcVr+326jMeDtcAIUadGy4Fd5DFGFSyFkk8pP:UdTTQT0y6Ho80m8EdGy4DDokzpS1DE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642777468, "uuid": "1e939c38-0fa5-4ae8-b792-e24960e1ef17", "value": 438976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642777468, "uuid": "21e6ec9a-54be-49ce-bcaa-1b7f2d9e9808", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642777468, "uuid": "837006a4-2ae0-4bbc-8e08-01a728eba4ee", "value": "LISTA NABAVKE U PRILOGU_1.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1c8e29d-7aa7-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1642762227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642762227, "uuid": "e049a9c4-a125-45fb-884d-23be03101421", "comment": "Malware payload (Loki)", "value": "46b0c7c8d303fcc1f629a97cd11de8b7", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642762227, "uuid": "4568ba11-ebcc-43bf-9193-7417152bcfa0", "comment": "Malware payload (Loki)", "value": "cb2afb32110d80e1f25f82160c4d4330c887efed720eb72982bd9462112fd50f", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642762227, "uuid": "71c2d34b-7600-4caa-8438-b5462500b28f", "comment": "Malware payload (Loki)", "value": "6ed85c0ed687ea6aa82fc938472d7de7dd4572c8", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642762227, "uuid": "bef58020-0321-461d-8255-c1c3d7be00d7", "comment": "Malware payload (Loki)", "value": "d1766638fba8469a96f7a2a26da31939a0de1365232252c92ed8106b7e2031299b618b73ce139d01bfb70528420f3bc5", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642762227, "uuid": "8630b32d-8f01-48a7-b795-cada8de6e21b", "value": "T148140224B7E2C266E96CF4FFBDF949849789FE9904019A4B10DCF21B123EE661CD18D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642762227, "uuid": "6f1c23f1-a108-417d-89ec-099a3d80024a", "value": "3072:+/83zaslj9wYOSlNz5GO7D4Zge3I55XGuoYASjj5dRrCdcXr8QMnIULt:28GslDHAO7cZge3uXGtYnJCUrHMnIe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642762227, "uuid": "d9cc3088-9387-4025-b8c0-6815999c431a", "value": 191576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642762227, "uuid": "3202625c-01bf-4cc0-b176-c4e989faa8a3", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642762227, "uuid": "38f8bcf0-aad8-4fa0-87e3-41fc9821c594", "value": "COAU7229898130.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00d6b206-7acf-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642779003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642779003, "uuid": "61971ea7-239e-47a1-b812-9cc44dff2daf", "comment": "Malware payload (Heodo)", "value": "83a6e296c76cce64ecd52173c905c2c3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642779003, "uuid": "fc082cf7-20de-42a7-833a-03ec7260c8aa", "comment": "Malware payload (Heodo)", "value": "cb897010a33eef9d8a42b82987299f5a5ae0fe359efa38cf724701877334c161", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642779003, "uuid": "8226dd1b-5e0e-4f07-99d9-44a7831beb3d", "comment": "Malware payload (Heodo)", "value": "c223a2f327e16c20460f7062c5e2aeafb0d1fefc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642779003, "uuid": "d8f8bdf0-cbb6-49ef-a56b-d74b452b2777", "comment": "Malware payload (Heodo)", "value": "88913e25f1c4f6cb312135b300d0b7333c0690d36103edc8072abf1578b43e4a98a30a6b7e4e10de9eb118a19ebe5631", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642779003, "uuid": "5800f8e0-9902-41bd-88ef-88c494dab83e", "value": "T127D4BF11B2D2C07AC1AF1674596393A463F9BE90DAF9C257FFC06A4F1E315828B39712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642779003, "uuid": "54af1e05-7193-41dd-8654-f282f4fd2d9b", "value": "24b46ffcf60dc8d39e8124f411ebd08e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642779003, "uuid": "7a0fee30-8054-4fc5-ad34-373d88486e63", "value": "12288:kqdJaxkOWFornPmGZqnTFWbDTUYVubhesslBvQqEPO7:kOOsornPTwFWbMYVohevBoi7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642779003, "uuid": "457b31fa-edab-4ed2-a0d2-1f911ea56c49", "value": 626688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642779003, "uuid": "ebf89636-75b5-4117-a029-ab8a558fab27", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642779003, "uuid": "7d18942f-2841-4732-9979-590962ca4f9e", "value": "83a6e296c76cce64ecd52173c905c2c3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "609e0bf2-7a79-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1642742227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642742227, "uuid": "6ee862f9-6b45-483f-8adc-57c68b4209db", "comment": "Malware payload (AgentTesla)", "value": "d55ab234c37f68197a93383f9dad47f1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642742227, "uuid": "9b113345-b3fc-43ab-9c68-02aa1a268ef3", "comment": "Malware payload (AgentTesla)", "value": "cbbbe050961a250cf380309380aa374ba678aa573252704383a52ca6d1ad9768", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642742227, "uuid": "6ab27510-80ef-48ce-a036-49b0d231de5f", "comment": "Malware payload (AgentTesla)", "value": "303ccc273c388929d5d39a1dff9be1a7eaddc2ab", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642742227, "uuid": "cc706627-1c69-48c0-8ca1-41bd8e2f3c1d", "comment": "Malware payload (AgentTesla)", "value": "e779fe4935618e0eb0b8557b2ecdf69f34a5553d3645d20b27c0f47f40a10cb4a6c7469701e6b4bb2bae4e6ff9879eab", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642742227, "uuid": "80bd8650-b596-440e-9e9b-0378ea0d8d39", "value": "T16F65DF7231041F86F03FC37A276D40A58BF4E92AE325D58F7EC0A89BC852B518B5A57D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642742227, "uuid": "0818408d-f1a0-4254-a5eb-9ed51b01dbb8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642742227, "uuid": "ece4633a-7458-4cfe-a36a-bf8353c29b5c", "value": "24576:MPUkjAXebubfEkrpfGyYGwqzAEr3m58boZ6eiekgwmqhgfGw2:VObubxklqzvboZ67+Tqhgj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642742227, "uuid": "b6ec867e-cca4-48f0-a353-fc9016ac7622", "value": 1508352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642742227, "uuid": "d05d9f2b-9736-4128-b84e-d969ceb33276", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642742227, "uuid": "fddda57e-3f99-4fec-9afe-6954f59312c4", "value": "TT COPY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1c9d3e5-7ac6-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1642775515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775515, "uuid": "932450b8-f49c-41a2-8692-9873a5603c63", "comment": "Malware payload (RedLineStealer)", "value": "fecab531b653442d76d432cc922fec44", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775515, "uuid": "4db58c21-8bb2-49eb-bbc4-2f6c50a99c58", "comment": "Malware payload (RedLineStealer)", "value": "cc023c690dd6423feb4187fe06693e15d46698b208568d6ce5a387bfcd893401", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775515, "uuid": "c1335282-d449-4282-9ec4-16b3645851c5", "comment": "Malware payload (RedLineStealer)", "value": "9591e48795676a6d478b798a302e93b8ac26c09d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775515, "uuid": "64c3fcf9-cba1-4440-9400-cf47956866cd", "comment": "Malware payload (RedLineStealer)", "value": "cd12baaab9c9759a195dcacfe1d2516407429b852ae72afe9865ce2dd1eb5e24293dadc137cf567a359e577c33803504", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775515, "uuid": "8dae935a-da1e-440c-95b0-2ba7548940a7", "value": "T1D3151ADD51C15848CFEF07F00DFBE62E857296C213478BEA732E95F06B6209EA56D4A0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775515, "uuid": "4f83a8f0-48c3-416c-8d80-8a52f48827c3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775515, "uuid": "8d9b3be7-41fd-4777-98a7-67453ddf7fa3", "value": "12288:/js9lJbLiC++e/2M5WZAryHlUQqvfskJNjkNYHRkQCxpU+ykk5Xo1mcv:IhixR/hSAryqFv4p8aAc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642775515, "uuid": "8d981116-e5dc-494c-909d-e7adeb4ad458", "value": 916480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642775515, "uuid": "800ea3e6-bc1c-46f7-a97e-8b0119af6fa9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775515, "uuid": "f9f5cab7-ca56-44dc-8d68-84da3d66a483", "value": "fecab531b653442d76d432cc922fec44", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a0c14b2-7a9a-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1642756309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642756309, "uuid": "1e76783d-f6bb-47c1-be1a-aada902b1efd", "comment": "Malware payload (AgentTesla)", "value": "97baba22e1d2ee29f943a9b90508809f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642756309, "uuid": "0736809e-8d83-41ae-b2bd-22b372e6fcda", "comment": "Malware payload (AgentTesla)", "value": "cd2506c19dc6dc34e292877776227ac61f57bce1fc80d412a318b4c67e907d54", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642756309, "uuid": "08231a19-8764-4450-ba2a-9438ce226f63", "comment": "Malware payload (AgentTesla)", "value": "d264ba7c91378abec89a74b7dac1ca9c584c32aa", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642756309, "uuid": "24cf1ebf-a84e-4725-8226-3e300a6ff9a7", "comment": "Malware payload (AgentTesla)", "value": "27788efe4a60fbbb43fe9245e9730918e330d64fcd51202fc448b17df2f25691bbc520b854329a2a257e1a2db1ba3129", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642756309, "uuid": "6cd2c1ba-ab17-407c-9f2a-7aeba2391e56", "value": "T1A4A423602CE2645C307FA92E326D60E3713350DEEFF6726AB702023A05EECE575A9475", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642756309, "uuid": "9d483aad-0329-481b-9892-e09338ad3bba", "value": "12288:t7HNqYuTQuDAyFQXi5RnA9ykxxpwe1+gO+ijgVZJJpcMcoSNr4we686f:t7tqhTQuDAyFQ2nA9/xfjo9+PZxcMcoQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642756309, "uuid": "86638660-4c04-484f-b749-3a0632f7c1cb", "value": 488880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642756309, "uuid": "1c5b9325-427d-4948-a028-9f64668933b3", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642756309, "uuid": "09d5d700-8fb8-4153-bc88-6dc23584ab77", "value": "Invoice.tgz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e62e790a-7ac5-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1642775093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775093, "uuid": "ef78597e-82cf-4ce5-8aab-c05ef9c5f873", "comment": "Malware payload (Formbook)", "value": "3edc90c97169a3e3518f1dd41418cc0e", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775093, "uuid": "0aaf9249-e59c-4a3d-ba88-0a50f1a6bfaf", "comment": "Malware payload (Formbook)", "value": "cdd5fd48f46fd97ca375305008e09d2f6ef61be714c292f22a676ed827ede804", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775093, "uuid": "3879b3bb-18e9-46af-9a74-0244ff2bf67a", "comment": "Malware payload (Formbook)", "value": "cf236ba1a9c8a594d591a777f431a68bd120872f", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775093, "uuid": "94ac6166-a959-44bf-a845-f44bb49f0ce6", "comment": "Malware payload (Formbook)", "value": "eb84b2ace81e909d86287f96cff91fd7e59ded358a3b1a1a9a95d470b694a442d5ac6c8e418bdad2b2924946cca47a23", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775093, "uuid": "6233efb0-5533-4427-aec1-6ac75a4389db", "value": "T1B66422BF03D4D4E7F40442B45AB5D79AF1FBA2062368111F23501F7AF061AC66E2E6A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775093, "uuid": "fafa019e-67b5-4586-b936-364a50188272", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775093, "uuid": "f11b47b4-3cd3-4f4f-94d5-45f1b2b42d77", "value": "6144:owxrmu7vn7vY/aQ4qjKEJuz1ba/qzJibB3CdOquJQGWUrqlHN:drmuzjKXjBJuNzQF/Jnmlt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642775093, "uuid": "feb44a2f-7846-4675-9afe-1bf5126ed08e", "value": 333209, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642775093, "uuid": "1d03ce5a-c3ed-4681-8950-37b9919a3205", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775093, "uuid": "d1e0c97f-3926-42ee-8c74-c80d662ae20d", "value": "DHL EXpress.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f5e3a64-7a82-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1642746197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642746197, "uuid": "d68cec87-6c82-4341-980c-ff66ad76a80c", "comment": "Malware payload (SilentBuilder)", "value": "7dc4bec2754fc93fdfb3ec9e4364e118", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642746197, "uuid": "2b4ec7b1-cf37-43db-8533-6383fbc98b68", "comment": "Malware payload (SilentBuilder)", "value": "ce8ed57f03c2c3733b81f29e38332753051c9d5917d62760190dbc6b9dcebf45", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642746197, "uuid": "d6150237-c610-4bc8-ad83-223df112cdb4", "comment": "Malware payload (SilentBuilder)", "value": "b7b66db7b3f387292a82d4b701eb3a9a60799b3d", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642746197, "uuid": "7462071f-258b-463b-a395-74d341a199da", "comment": "Malware payload (SilentBuilder)", "value": "55af2b29d26c7e221216d4219d250f823ec510ec194afae1a1065d8d1cfd24ae29303cebc0c14e9b359b386491335dc7", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642746197, "uuid": "ed437e86-55d7-4127-a700-b338ae628884", "value": "T16C636CA7B78299EADA0483394DB643C5B717EC104F9A43C73694F7346EB49F08D9324A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642746197, "uuid": "098dcd6f-5769-4a40-88de-bc1cdc4bb200", "value": "1536:bpEk3hbdlylKsgqopeJBWhZFGkE+cL2NdA8eXZiozeOgXVZKyaZpvyR1kZkJvU+:bCk3hbdlylKsgqopeJBWhZFGkE+cL2Nr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642746197, "uuid": "8aaf122b-1fb8-4460-be8e-72a89937dd97", "value": 72552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642746197, "uuid": "bf37c8b1-50bf-4a83-b8fd-614e16c65b6b", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642746197, "uuid": "511bac79-6e64-4f8d-821c-4f2bfd29ab64", "value": "7dc4bec2754fc93fdfb3ec9e4364e118", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2532cbf3-7af8-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1642796673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642796673, "uuid": "2b55fb31-385b-479f-9e65-793177b0a4b2", "comment": "Malware payload (Formbook)", "value": "56e8ed33ded34d6608b58be999149426", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642796673, "uuid": "6c535172-715d-4977-aba2-0c5cf2a9dd54", "comment": "Malware payload (Formbook)", "value": "ceff3e5d81586ce81d6e93178e30d16239827b4aefbe09a382e9f9fbf8635ebc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642796673, "uuid": "00cf06d0-ad5d-477d-bc65-2353f84876a9", "comment": "Malware payload (Formbook)", "value": "da7d617c45b46e9f34bce882f45bdd4f09758851", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642796673, "uuid": "0aac47aa-047c-4fde-a5a8-08f47d5d2a77", "comment": "Malware payload (Formbook)", "value": "f49bc1804e6e504b48ad780147b8c37211d9dd5c86cc981c4a27bdc0dfbd889eb964610ed58603ffea29e480512f2943", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642796673, "uuid": "fe845d78-0ea5-4f2a-a08f-1ff6a8dcc3c7", "value": "T1900508AD325071EFC867C572CEA81C64EB61747A971B8207A01311ADEE4DA97DF242F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642796673, "uuid": "aa79eca3-b2ed-4fb1-88f0-99b65b086a9b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642796673, "uuid": "1a3787de-ef17-4769-8eba-76a246e710cf", "value": "12288:YfLpR8nTFBpQas/tYotYl0zjayvxrgSH/jD5q6+i9vYFHQpEnhT6qy41AtpNSF6D:GOBpQawJC0339pHA6+i9vYFw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642796673, "uuid": "00f00036-28db-4006-87ae-9bfe9d479da1", "value": 851968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642796673, "uuid": "8d6cff7a-864a-4e23-831c-dd649e83e8f3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642796673, "uuid": "6aa799c8-2548-4c99-8fc7-a44f6a025625", "value": "Payment Slip-pdf-scan-copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b7bbe37-7b0b-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642805032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642805032, "uuid": "b45c1939-aaaf-46a8-ad5b-9e7d12d444f0", "comment": "Malware payload (Mirai)", "value": "f39ea66266ac3060e11d4dc98b8944c3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642805032, "uuid": "e488136f-621f-490e-a98d-92ee778c3ea5", "comment": "Malware payload (Mirai)", "value": "cf1fbe3bb72fe9437b6afcc777b7ea677667a777ac0d3041c8f552fff31fde15", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642805032, "uuid": "8459d277-a9cf-441e-87a1-18aa356aa01d", "comment": "Malware payload (Mirai)", "value": "6a282a1dfca4e89fd320e600eeb442e955bb8511", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642805032, "uuid": "877bb98d-74b9-4875-b2ec-fb2a1cad19f0", "comment": "Malware payload (Mirai)", "value": "a1f5e57b5c53abdad74f6b9f47ed91b5d7837118314ca8e3439a3e27af0ac16e29c93b9157ccb7ff9fa9b74f91d2c038", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642805032, "uuid": "8b240f66-d346-4f5d-8193-c94283242f84", "value": "T1AB735B24A9792E27C1D4A17E62FBC321F1E6230E25B4961C3CB60F8FFF2465464562B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642805032, "uuid": "5e795305-b689-41ea-81a2-5198f442da65", "value": "1536:SbHmkTSo3BOIqS5aq+Dc035R9QuEk6vNNTKjfVFRo:omcjaq+Dcc5J+vNwjflo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642805032, "uuid": "b80f9aac-8a39-4a45-899d-fb80c75b9bc8", "value": 74572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642805032, "uuid": "f9b3f210-1d8e-425b-b880-fb1696ecef29", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642805032, "uuid": "41ba0599-a53f-4e4b-8448-0772aa338600", "value": "f39ea66266ac3060e11d4dc98b8944c3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "908c954a-7a5d-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642730281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642730281, "uuid": "d37e2e1b-81f9-4f83-9d2e-f670fc805ea1", "comment": "Malware payload", "value": "2e88a04b7f63a704c74e9ddf1e79cb2b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642730281, "uuid": "e93de107-0aa8-429e-884a-ada1513244d4", "comment": "Malware payload", "value": "cf7daf882b7643be6a603b6fa957c1a3d286fecd2f862a1acf5674454595d625", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642730281, "uuid": "cfa8af36-c13e-4d4b-8309-f7cc85f0cd4d", "comment": "Malware payload", "value": "65613a7ec023743f946034f188a1a914527cad15", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642730281, "uuid": "abb542ae-da2d-4acf-8c85-7eb7f77d5528", "comment": "Malware payload", "value": "065dfa9c91dbaacfeeb7bb0eee43078a476275996096782caa24a085d129c60ea0af0a7e8ee9680e26e347e09c85786f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642730281, "uuid": "645720b9-7815-43cf-9dd7-815c69fd69fb", "value": "T19944E12467B0C4B3C5B00A354DF767772FBBBC1566A19E0317D06A983C623D29E2E399", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642730281, "uuid": "ab71dc69-d223-47e6-88e0-e9de1f2066c1", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642730281, "uuid": "4f08e278-4ecc-4df6-b5a8-32f563bde4cb", "value": "3072:MbG7N2kDmUpKuP8em2x/cFOjZBk1if/YskPJPRl1aem2Y+a/b:MbESUl89yvkEf/YskxJlE9P++", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642730281, "uuid": "bbbf7574-0d7d-47a8-b6ae-aa060d739be0", "value": 275456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642730281, "uuid": "69f6ce57-7b76-4aa3-90d9-ddccb2f41a86", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642730281, "uuid": "88b2b1e5-06d9-4818-84e8-cd5b58205f8e", "value": "ASAPP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efdd7154-7ad1-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1642780263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642780263, "uuid": "0cb4e37f-098e-4e3b-b604-59c230af09ff", "comment": "Malware payload (Formbook)", "value": "bd9aec0a34faff8128695a9779bad787", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642780263, "uuid": "150826b7-b8b3-4c9a-81f8-f4c36e34779f", "comment": "Malware payload (Formbook)", "value": "cfd1a77378decd68cd7a59307b77b93247bdd91e00de5111ecae6b5658c8665f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642780263, "uuid": "92e26587-01df-40cf-a72c-1859cc4b96f7", "comment": "Malware payload (Formbook)", "value": "15197544651c445b167332cd667440ba11607161", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642780263, "uuid": "d5e7398c-a874-4083-8248-4e87d148aaa6", "comment": "Malware payload (Formbook)", "value": "ddf0cef1cb089254c0007e44f19e47deb9f9da89e731c847ace66e8403646f7723b521d82c3d4fb7911c4fdfc20f2dde", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642780263, "uuid": "cbb9efe0-1edc-4bfb-909d-662718ab25dc", "value": "T1BC54126934E941BDEA8614F46B73E723A7BEDA012573090B0FD08EBDBD263835716193", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642780263, "uuid": "7f4afcaa-dbd0-411a-ac2c-299e0c31ab2f", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642780263, "uuid": "aeb473db-3843-49cd-9cbd-632bc83e26b4", "value": "6144:owk4lsah+QP8Ao+fF1pKrqBj4+lAbuJz1SoOiFnf:jsaVNoM+rAxGifSiFf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642780263, "uuid": "e6b4a5dd-d6ac-4b7d-ad54-c0655dd8b6af", "value": 285948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642780263, "uuid": "421717b9-bd2c-4ae3-9915-1d2dfc1807f1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642780263, "uuid": "cf562cab-5682-4589-b6c2-c26310b62a75", "value": "bd9aec0a34faff8128695a9779bad787.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0efb924c-7a7a-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1642742519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642742519, "uuid": "2c3b29f6-2d29-43d5-973e-9d44a92ad149", "comment": "Malware payload (SnakeKeylogger)", "value": "181d48810bf9b958d81c73dcb26ee059", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642742519, "uuid": "eb0e7bdb-57fd-4c9b-849c-5114439d3d96", "comment": "Malware payload (SnakeKeylogger)", "value": "cfda08d0d131008a1773c627f0508e861101d642bb66ce531a165452bf57a115", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642742519, "uuid": "c71931f6-a260-462b-a5ef-e5799da780b5", "comment": "Malware payload (SnakeKeylogger)", "value": "3825ffe205a2b0b9962f545e387a0daa98a9bce3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642742519, "uuid": "22ca6a9e-935c-4225-95c8-caca4419f783", "comment": "Malware payload (SnakeKeylogger)", "value": "de2bd029f0f31e87d03462e0b1f2df5b57c3ea38681be52a8c265ecc9493dadb08c97cbb2815bfe79ac99fc2b4b75aeb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642742519, "uuid": "e1e82f5d-4e05-49b2-b3d3-1a70ac54030a", "value": "T15ED4CF4033F98B01D57E8BFA8875009017BEBA0AA875E71F5DD1B1DF0DB2B819A26753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642742519, "uuid": "a8d7cc0e-f9f0-4f76-a606-c9d51e6ee62d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642742519, "uuid": "67fe5184-1437-4283-9990-af3bfdba9e6d", "value": "12288:axbuzVpQhqwIpq+KNIchtLSjq6+ievYF:tpQ5I8XIe6+ievYF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642742519, "uuid": "f50a6f28-0321-45d0-a3a3-089f02874d66", "value": 618496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642742519, "uuid": "d1e6ccf9-8201-4edd-8e54-cc2a7088e352", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642742519, "uuid": "cd849931-6805-4800-bcd8-70ebfb4dd066", "value": "PROFORMA.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1b65af6-7aad-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1642764750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642764750, "uuid": "3317d467-6c0c-43b0-bce9-fb4c2a34c3c5", "comment": "Malware payload (Formbook)", "value": "e652e263f71c1c50220920a46c9b420e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642764750, "uuid": "dc856ee5-a8ec-4bfb-a336-42d461492722", "comment": "Malware payload (Formbook)", "value": "cfdf477d386cab73129ac775a953d693466176d4d4854d06d580125a8f20f9e6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642764750, "uuid": "c06f4e2a-f25f-4f0d-b323-490bbd185558", "comment": "Malware payload (Formbook)", "value": "08379f562329d48fe67b0f4e7ee4ad37a0b97924", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642764750, "uuid": "fe277c96-42ae-4aa4-bc16-db479a65face", "comment": "Malware payload (Formbook)", "value": "265a2fc143ec9dac446e030195675c2b2f0908e652406f5ba1a75d0b6b7d02ad71e7f05208132881bf1ef5e3c8499750", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642764750, "uuid": "d597862b-fd76-45ae-bb33-5287535a5581", "value": "T12AC4ADD567248D8BC08026789FC2EB396B784FF15F008119B6E12E7FB9BE756AC06711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642764750, "uuid": "98e23c6f-aa4a-4c1e-a779-9c63af0446c8", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642764750, "uuid": "e1e16abc-dbff-49ce-ba28-721c453e8108", "value": "12288:Sjeq+8mXGcYtor3VqBSQpJoxr4NwxdHVF:Sjeq+8mX5q6lqBppJodiE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642764750, "uuid": "cbed4c4b-549b-41d8-939a-5f655d2960d8", "value": 568619, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642764750, "uuid": "eb826e83-f481-4eb9-9cd9-de5eccd2ab95", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642764750, "uuid": "5010c476-8dda-41a3-b05a-d4089ac21c9a", "value": "e652e263f71c1c50220920a46c9b420e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3406e1f4-7ad4-11ec-9275-42010a9c0029", "comment": "Malware payload (Vjw0rm)", "timestamp": 1642781236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642781236, "uuid": "f5c44fc8-8eff-4947-87b1-47378d4c8d97", "comment": "Malware payload (Vjw0rm)", "value": "6547a7437933b39ef6cdc9658a6a9ef5", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642781236, "uuid": "a8a988c0-02ac-494e-a405-1cfed3777476", "comment": "Malware payload (Vjw0rm)", "value": "d024f46242a5642188fe8680d38f3d0ac0daa354288daa92946ca072d5c54f01", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642781236, "uuid": "eb5d5076-cb6e-4b6b-ae7e-2131186e1fcf", "comment": "Malware payload (Vjw0rm)", "value": "1a779d83880ca05511429e64588547d3c9940fee", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642781236, "uuid": "66220975-ec80-441f-9fdc-fd28c7ca0c84", "comment": "Malware payload (Vjw0rm)", "value": "e44cbf6b75be70282930754a33043ab1bfcd83ceb7f6dcb3d3681128aad85c459fbfecf982afa4d223e4e5f6874d05d5", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642781236, "uuid": "fc1f4231-4346-48ce-bb70-51e5ab6e5df6", "value": "T16D4355C46FD0F89602576BB77F16B0F0DB5A1D9471C4496AE000B8A0F4DD99EFADA2B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642781236, "uuid": "a77cf90d-5459-450a-b929-d246951487fd", "value": "1536:gn8AUXhBJqbdCc0G22GnKUBQ5JDkVeCQCLdc+lU4stS:g8l/sbdCcF22GnKv5WVe8dc+lU4sc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642781236, "uuid": "27e9f1dd-f00f-48aa-b830-9fffcdf7fbd2", "value": 58735, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642781236, "uuid": "c161f140-8510-4196-9f0b-89e438599208", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642781236, "uuid": "0eec0f69-23a3-4438-8469-63c9c53a3538", "value": "ROPSQ90P.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba1bfe9a-7ae2-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642787474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642787474, "uuid": "d581bc3e-214d-4ca1-870a-b2771cf94d1d", "comment": "Malware payload (Heodo)", "value": "e6a5b0ae7ad7aff42014a7cc028abce1", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642787474, "uuid": "04d4edbc-c629-459a-8397-3161547cf282", "comment": "Malware payload (Heodo)", "value": "d05a2d694202c458038b2c5e1f682f0d0c4f546f7909aae2886111bc9cee921e", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642787474, "uuid": "6ca2b7f1-9367-48bc-a35a-75c842ca66d6", "comment": "Malware payload (Heodo)", "value": "7e15fe4967face044784acb0eb494a8497b086d0", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642787474, "uuid": "c772082b-c2c3-4b65-bfc6-54b4c042e22b", "comment": "Malware payload (Heodo)", "value": "a386fe14a3da6c287f0ce7472ead1734ec6a7f8ce4743199faf3f1f3f2c223681b80f5fd2a399358e284708e07d35493", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642787474, "uuid": "6a2f9b24-f16b-4be2-b5a0-80c254b12a34", "value": "T102A3B0527BC6CA59EA4547710DBB024AA723FC105B7A63473285F3783FB89E08D13A1B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642787474, "uuid": "70e2027b-6912-47b7-b4d8-9edec3d94431", "value": "3072:n/k3hbdlylKsgqopeJBWhZFGkE+cL2NdAFxe53lGvFTQ3IzxgdrvxpU0OKvMB:/k3hbdlylKsgqopeJBWhZFVE+W2NdAOK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642787474, "uuid": "730848ef-ae71-4639-aa73-3968eea93ded", "value": 104457, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642787474, "uuid": "7bd9a83e-5bf5-42f5-846f-ecd0fae1c015", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642787474, "uuid": "a2e29195-2076-45f2-ae09-03a5b4701629", "value": "Inv VQ-8347.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5018f174-7ab3-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1642767110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642767110, "uuid": "8b0d0bb6-513f-4fc5-a291-6a526a0d5661", "comment": "Malware payload (RedLineStealer)", "value": "a92393ed590a3d90bf8ec8f1dfa4433f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642767110, "uuid": "79d604c9-f6bd-4819-a965-7450d03ba9fc", "comment": "Malware payload (RedLineStealer)", "value": "d0fef87fd7e5a7214773deef4c445970147c88d5335867b552f9d4d22ef0231b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642767110, "uuid": "da048438-524d-4b25-b9f3-dbcf14afbf01", "comment": "Malware payload (RedLineStealer)", "value": "f345aa40fe883cf3eee8626d43542e815a4aacf7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642767110, "uuid": "7c8b64a9-ffb0-4d56-95ed-33e7d323bfc9", "comment": "Malware payload (RedLineStealer)", "value": "9b9c88ce0ce483a07120b2b90073c5e36aa5709cf7246b67bd65443ac3efae7af43eb6dfc7d657b5a0e44cb2cd6d6472", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642767110, "uuid": "0e626496-ccf8-4678-ae67-bd24fcb5c0b7", "value": "T141E3AE3A73E59A96C15A8B3425438281B730F4587E12BB4365D4067DEF2A3F62DBF1C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642767110, "uuid": "667fed0f-af32-476e-a5e4-597f65f5db2f", "value": "3072:I5jNwwLRpG5pXRzTb5p2klOkVKZwcpMRKXBwLs/U1eTpnOr:C6QY5f2klOCKZzgKXAs/U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642767110, "uuid": "3fdb17f0-3645-4b69-9bc9-68313c3e4b70", "value": 152576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642767110, "uuid": "14a5b74c-999f-426e-91a7-81fd406958a5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642767110, "uuid": "571ba841-9776-4c1c-aa47-b7bdcc9da107", "value": "a92393ed590a3d90bf8ec8f1dfa4433f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b00a3d64-7a8c-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1642750520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642750520, "uuid": "3de86563-1a3c-4988-961b-c198393258bc", "comment": "Malware payload (AgentTesla)", "value": "92920eb92894819a7339d46f515e3e30", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642750520, "uuid": "91b7be2b-f7b3-4254-bbb1-e1029a73063c", "comment": "Malware payload (AgentTesla)", "value": "d15e4755e829edfb779395eabab3441b67a598275b3dc6f730734d9754ef365a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642750520, "uuid": "fdac069e-f1ca-4cbf-ab6c-2599bb0a7612", "comment": "Malware payload (AgentTesla)", "value": "b4bccf55fb2d5d572820f63321534e285c064ce8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642750520, "uuid": "da021d38-aeda-4cab-bba7-981341a6c5af", "comment": "Malware payload (AgentTesla)", "value": "24c4f63c8ee0c0e2db7dab3d4c95a05ba0b4b0d5fa08532f23988b1ac17d930bfd0695d67ad5939ba2dc5f9703f805e4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642750520, "uuid": "2c20fdd2-07d6-4855-9cda-e509f4e54cb5", "value": "T184B4231F91C4C3D7C88BAD891767E18283AA3D6D875D6772095F3CEBD58384A6026F83", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642750520, "uuid": "2aa21583-becf-4f3c-8fdd-9da6994c4681", "value": "12288:Qq9JrGEYad4cA/g535g1IVkwhtt9lrZDL2yS:z9JrhYq4cA/+JxVkYPPDL4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642750520, "uuid": "5ad99dea-0ebc-4f55-ab28-0514d25e3797", "value": 500205, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642750520, "uuid": "27e49d9c-fafe-484f-8035-3cf8d3184e8c", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642750520, "uuid": "18bd5101-b5fd-489b-b240-4d079c314ca5", "value": "Purchase Order.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "747ae865-7aa7-11ec-9275-42010a9c0029", "comment": "Malware payload (OskiStealer)", "timestamp": 1642762017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642762017, "uuid": "f1252a29-ea78-483b-925a-69927939fc0f", "comment": "Malware payload (OskiStealer)", "value": "f3d86061648bd24723aa42ff54b6740a", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642762017, "uuid": "de6b23e1-6f20-4cb7-853f-c134d3e62f01", "comment": "Malware payload (OskiStealer)", "value": "d19d642c87ad85c6eefcd2a940e303b3f390f1d93c25e56a22ecc55fcfc53726", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642762017, "uuid": "0b585350-0d67-471b-bb8d-73d83a3f7dd8", "comment": "Malware payload (OskiStealer)", "value": "e4fb714b00c135caa75bc939a328f3b2b59205a2", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642762017, "uuid": "37438f71-17f2-41bf-8f46-2a744155e333", "comment": "Malware payload (OskiStealer)", "value": "dd11aa12617fabdaab083cbbf95d011d3b0557162ac026d8e3ac0b257397b93b80b258a83a31856e6c4076d53c213b86", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642762017, "uuid": "425ea93b-04dc-49cf-ad55-46e70ccfc422", "value": "T1E294BFF876147DE6666F576BDA96BCEC03B62B2389CB94CD80647BC30563335EE02805", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642762017, "uuid": "ef17d65d-2f8a-4fda-9942-d14e256a2575", "value": "12288:LN45zrtgVRUXpJLGE1tn2uwBC1voAUq0uOl63XmAf6/o4:p45zrtgVRUXnqy92wOq0plCXmAf6/F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642762017, "uuid": "befac200-4757-4603-b89c-40d299b2ecdf", "value": 445526, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642762017, "uuid": "7a25d9f6-e920-4e2e-bf97-d861b0fe6a1f", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642762017, "uuid": "90bb1130-5ce2-48b9-aebe-4e691762bee9", "value": "RFQ8086A22.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06eb402c-7ac7-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1642775577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775577, "uuid": "398efb1b-4df3-4444-8fd6-df0196a909f1", "comment": "Malware payload (Formbook)", "value": "298784459640f0bf3880efd713609bdf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775577, "uuid": "d9b44680-29aa-4393-ac4f-90852710b906", "comment": "Malware payload (Formbook)", "value": "d1edc3c0253606f0816f85d7eafe573813deb260842945ac31c376cb28d7504b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775577, "uuid": "3cf2a205-741a-4491-8f09-2fc90242326d", "comment": "Malware payload (Formbook)", "value": "17e907b100b7fee5eb453eeb30d62684e8e6f01e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775577, "uuid": "79b38484-bd2f-4d99-b801-ef4584689ae5", "comment": "Malware payload (Formbook)", "value": "1557217ea03bd62e2de83058bdf307d4275642cf77d13d6d4815d6e85d56f6bae41ebccb661113140277cfa5a06cc3dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775577, "uuid": "89e736c8-cfcd-4b83-9727-7d68485b63c5", "value": "T177D4F1185258C827C57946F4D18AE2F44BB86D6BE142F34B9FD17CB73AF33A1A805287", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775577, "uuid": "6dfeb180-1f53-4dc5-a108-45c4847e6593", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775577, "uuid": "e1359804-8fb2-4d8b-bc12-64ae526db239", "value": "12288:BtVv7psn84RGoJGF3KY5BCT4FLNsVy9gGwtDTmilHq1QcU9tXacUyJotFSWETCHO:CtDTmitq1QcEoc5oeHvnR//8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642775577, "uuid": "8a4502c3-72cc-45f7-8061-d86527512ffc", "value": 632320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642775577, "uuid": "3839f178-6961-4777-8b1c-f26eea452895", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775577, "uuid": "82786135-d17d-4971-b1d2-371bd226f3c9", "value": "DRAFT BILL OF LADING S2105860598.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5a90c6c-7a75-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642740732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642740732, "uuid": "6828195a-63f7-4c61-a30a-e96716434d91", "comment": "Malware payload (Heodo)", "value": "733927264a79f82824c4c2951537bad5", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642740732, "uuid": "809bf800-51c9-4cfc-9044-7f33c8163a9f", "comment": "Malware payload (Heodo)", "value": "d29a010434dc30a0ba23e4041968ab4a7af4a0aa9e949f0dde7f70566db9f607", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642740732, "uuid": "854c762d-0187-434d-9320-127e28b8b8c0", "comment": "Malware payload (Heodo)", "value": "ff35c7ca28871ed3ca080e3bf3b42f624dd1274c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642740732, "uuid": "53cbe2e5-814d-4102-9192-78641033f37c", "comment": "Malware payload (Heodo)", "value": "c92e78835abaa9ebfc826aedfde9bf589c742bb9a4ed35513daff20efe988545e4ea4e8ff5130fdbff6db363f50a5838", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642740732, "uuid": "c21c3428-d3c9-461c-84f4-7638f0cdee4d", "value": "T1C1D4BF127BC2C076C26E31B0459BE7B966F996308F34A6C7BBD10F3E5E741D15A3821A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642740732, "uuid": "d1dc6b6a-cce4-451a-a9dc-0f5c47e73d81", "value": "d986dd84d593c1266f1531c47644f308", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642740732, "uuid": "7eb49ff3-9996-4b29-9929-986551e28f3c", "value": "12288:agvTeqrCeX329Soy/O+TCJJU2QyDqXkkpldzR6TqKCKc:tviEdX3Y7GTCRhukkpwqd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642740732, "uuid": "c980930f-08a9-4f9b-b3fd-da3c1b382c0c", "value": 627837, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642740732, "uuid": "16ef79ac-ca61-4b53-b98f-6f5b42ff585e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642740732, "uuid": "ca1baa42-4a7c-4279-ad2b-7a4d2d67e79c", "value": "emotet_exe_e4_d29a010434dc30a0ba23e4041968ab4a7af4a0aa9e949f0dde7f70566db9f607_2022-01-21__045207.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb309e24-7aab-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642763880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642763880, "uuid": "c24ce7d6-b967-47c7-b42d-7223b773e583", "comment": "Malware payload (Heodo)", "value": "1fa90ddf7038b41ce7c2b99c9b2d45d0", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642763880, "uuid": "fe15afcf-5bfc-4524-b8e4-1a00ab5ccd15", "comment": "Malware payload (Heodo)", "value": "d2f54f8e93cad03c7533e5e195f0a0ff6541722c1487d2e12bfea9de88d148b1", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642763880, "uuid": "1a135f13-74b5-4849-bc7a-ac1d86d7489f", "comment": "Malware payload (Heodo)", "value": "08993ccd55cd1ecf9daa99a0ea9a7705d4b8ae02", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642763880, "uuid": "1c13cf4c-0fb9-44ee-9741-ec7075299d39", "comment": "Malware payload (Heodo)", "value": "74c0b2395a7377e6c459fa733315e9bd960de88520d9ec8b82c47202ad23072291c41277b9de219d7f0f305bbe2d6053", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642763880, "uuid": "dd34c717-64a8-4641-8d2f-a6177f1c4f58", "value": "T186D4B011B2E2C07AC1AF0175595297A973F9BE90D9FDC247EFC06A4F5E315828B38722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642763880, "uuid": "e929e0cb-4eb7-4955-812f-ab865690dc3d", "value": "24b46ffcf60dc8d39e8124f411ebd08e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642763880, "uuid": "937526a9-92e0-40c8-aafc-5650509f22fa", "value": "12288:vClISqMT89ornPmGZtn5yzrDI1ywIdO3D7AfojAxOBnVV0KOFD3EPO7:vmTWornPDryzrEywIdOz7AfOAxsVZOFZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642763880, "uuid": "ff90b6ce-4e70-4a0c-bb0e-46d9f01b0f97", "value": 634880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642763880, "uuid": "f4f9e6a8-ca7a-4e48-a853-9ee2e219bc44", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642763880, "uuid": "358ba6be-dd52-47bb-82b1-97520b849bd2", "value": "emotet_exe_e5_d2f54f8e93cad03c7533e5e195f0a0ff6541722c1487d2e12bfea9de88d148b1_2022-01-21__111754.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb62e348-7aab-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642763881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642763881, "uuid": "a5d5f797-8164-4ce5-b920-749156231734", "comment": "Malware payload (Heodo)", "value": "e72c38a97db59f327faade80e7adb673", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642763881, "uuid": "3d506ba1-9c01-4e70-80b8-ba190a628606", "comment": "Malware payload (Heodo)", "value": "d3927b8febe36ac80cb07ed959aaf32f6c7d6e90a0826dfd2b0b3e28f878baaa", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642763881, "uuid": "fa1fb315-c060-42e4-a4f8-13da888c5cf9", "comment": "Malware payload (Heodo)", "value": "c66f7f7262e4b7b59776cce224b851623f5c27f6", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642763881, "uuid": "d3c81c63-3f2e-416a-b23b-ea295635a6f1", "comment": "Malware payload (Heodo)", "value": "876cb51d9e861468ca96dc063f6dd7ad3f0df93c18f21b401cb47164c0288b1175e6bc22dc86af09f8b74ae9be4e6906", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642763881, "uuid": "2c5653ad-0915-402b-b847-3bf2264f9371", "value": "T12CD4B011B2E2C07AC1AF0175595297A973F9BE90D9FDC247EFC06A4F5E315828B38722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642763881, "uuid": "bfac4332-df7c-46d1-bd54-c178a16af3ed", "value": "24b46ffcf60dc8d39e8124f411ebd08e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642763881, "uuid": "d08c834a-67d0-419a-bf9f-236b309c843a", "value": "12288:vClISqMT89ornPmGZtn5yzrD31ywIdO3D7AfojAxOBnVV0KOFD3EPO7:vmTWornPDryzrBywIdOz7AfOAxsVZOFZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642763881, "uuid": "16ba3a12-8dff-4d3a-b22f-3975f6acd0ce", "value": 634880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642763881, "uuid": "13dc98aa-c2c6-4f60-ba7b-521455d7e646", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642763881, "uuid": "6f82228b-aa35-4d62-8a62-deeeb782aef8", "value": "emotet_exe_e5_d3927b8febe36ac80cb07ed959aaf32f6c7d6e90a0826dfd2b0b3e28f878baaa_2022-01-21__111756.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d57f9a79-7aa7-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1642762180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642762180, "uuid": "42acfc0e-0017-44bf-b70b-f4c97c53fb29", "comment": "Malware payload (Loki)", "value": "e04ee21d8a0f55e842022bf192fa4b0f", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642762180, "uuid": "90715c8b-5c80-4427-afb0-22d99de14926", "comment": "Malware payload (Loki)", "value": "d40bb931175884e2639cac09b5e915055b1a6e2bcaea474481309242c04e8c5f", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642762180, "uuid": "1781d41e-740b-41d5-b56c-610ebffc65a0", "comment": "Malware payload (Loki)", "value": "d4d3e42e3b0c39b6d06ed9f84a327a810538df74", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642762180, "uuid": "35d8fd40-a52e-4f94-985a-647d0f5f4f64", "comment": "Malware payload (Loki)", "value": "8a2e147651549550ed0dc7b444b8c71655480046e9e98f4de7945536d0568768be63c2d9dda4e67e382ed8347ed1e509", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642762180, "uuid": "85bb01a5-54c1-46c3-b18e-4b7bbc88cced", "value": "T11A0412BEDC7EA302FCA34B70459930125382EC7DAD669412ECB17D99E134E7722B5189", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642762180, "uuid": "1440ea83-f3bd-4e27-aec3-fa9f49d87e1c", "value": "3072:3hSi1KfC9w/ZgmSk6iXFzJYouKOgNq4zm+lwBRL3kYsiPD53o5E:ci1io2Z799vbzmOwjnsoDJsE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642762180, "uuid": "df1548ed-a1c4-407b-a658-e03e350a33b2", "value": 186872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642762180, "uuid": "8713856c-59ed-4e4c-af43-063bf5b14e43", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642762180, "uuid": "af80a5ed-1a27-4bdb-86ee-da45c7e64c83", "value": "New Order.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcf1f60b-7aad-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1642764715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642764715, "uuid": "4d2ec66e-8f9b-4f42-be6e-7cd2a69be906", "comment": "Malware payload (Loki)", "value": "bc0b8dec02baa89dbdd3282bc3c94fc9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642764715, "uuid": "375c700f-840a-4eaf-8b60-d274b8574b84", "comment": "Malware payload (Loki)", "value": "d4a0c7bd8bc85ac8da21ec59e5459fe4e4bc7805fda57ad6c1c589d7cfa38379", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642764715, "uuid": "e456289f-15e7-4401-a4a1-225a00ab4ac1", "comment": "Malware payload (Loki)", "value": "60dd46463f326a6f392eaeac27134ec26f928589", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642764715, "uuid": "0a90a428-37e4-42fc-96a8-447dca78be98", "comment": "Malware payload (Loki)", "value": "5a17e6acd4d5412c07a9689b8134f0c1c65211e012f0f9b7ddd69f1b5b7de8b54372bd3d5d64d7146cea03877e3dc4e3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642764715, "uuid": "796361bf-34ac-4097-be1b-bb492edf712d", "value": "T1AC64239A39C0540BC2674B3B189FD50AA379E30A5F71016B93FE0EE71AD70E7835952B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642764715, "uuid": "59ffe9ef-d945-484c-931d-bec4d7576bd8", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642764715, "uuid": "3d5576e0-7689-4d40-94b8-d9df2b2d103d", "value": "6144:ow4ax5irsYEkYdqbcfKXQ1xF56kibOlXvgckz6HCuKFZSl48:v5iYKYEbcfKA1HbiYwFQW8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642764715, "uuid": "757fe1d0-d893-442d-95d1-75dd45d0b78a", "value": 326696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642764715, "uuid": "f90eac5c-3d85-4555-b2a5-5eec5f58168a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642764715, "uuid": "6412c19c-3dce-4454-83d0-f1dd5bd710c4", "value": "bc0b8dec02baa89dbdd3282bc3c94fc9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "696236f1-7acb-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1642777460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642777460, "uuid": "9696c75a-49bd-430d-9da7-03e979b97595", "comment": "Malware payload (SilentBuilder)", "value": "313491518180167de888f7e9d46e8f57", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642777460, "uuid": "f30f6a7d-e882-4544-a59f-25e782a80e4b", "comment": "Malware payload (SilentBuilder)", "value": "d6d3329f2794e99a35585c8bf32eca703399d502908697277dcc09269588e916", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642777460, "uuid": "5320346b-9362-4e29-b39f-f64fcc4cde52", "comment": "Malware payload (SilentBuilder)", "value": "27e39a368ac5a26fd1172b05372fa9db2ed4ed08", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642777460, "uuid": "4d5f2b67-da32-4eda-90d9-acb6217b6136", "comment": "Malware payload (SilentBuilder)", "value": "4274c7e45f7650c569eacc1db69f71c609dfea6c791c28ac8a5657284a899c718b3b7e9b194d5c470cb223029a17b5f2", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642777460, "uuid": "c173ce50-31af-4bc7-96ee-a7ad59db973d", "value": "T1DC636CA7B78299EADA0483394DB643C5B717EC104F9A43C73694F7346EB49F08D9324A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642777460, "uuid": "36186201-726c-4d9b-99a7-9bb9b47223c8", "value": "1536:bpEk3hbdlylKsgqopeJBWhZFGkE+cL2NdA8eXZiozeOgXVZKyaZpvyR1kZkJvU+:bCk3hbdlylKsgqopeJBWhZFGkE+cL2Nr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642777460, "uuid": "6dd37295-b18f-4564-9510-3efc3ac5a8ed", "value": 73058, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642777460, "uuid": "8e7fa7d0-b0fb-430a-8ff0-1a6db05bd353", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642777460, "uuid": "b8cfe29f-4cc7-4a88-b6fe-14adacb61a43", "value": "DD5573872337573877255_1.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37854ab6-7a61-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642731850, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642731850, "uuid": "cb99e538-75f0-4d90-81ad-5ec25be14dcc", "comment": "Malware payload (Mirai)", "value": "0dbe787e1b8ab7f004a55b418e3141c4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642731850, "uuid": "00b7fcf9-6648-4ad2-91b3-ac7c143b2aa9", "comment": "Malware payload (Mirai)", "value": "d7d2cab6f55b5b9b2bbd12911c450981eb6d84da22ef13ae1cf9b2d31a336b2d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642731850, "uuid": "33a51fb8-8c01-4836-b78f-1c1c6d264872", "comment": "Malware payload (Mirai)", "value": "0506160d345965ffb7ffa6edb155ddfab10d1ae4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642731850, "uuid": "fc10cbe7-7c18-4c38-bb65-fd2a19a4a3d1", "comment": "Malware payload (Mirai)", "value": "c950fbf51caafd5081365770db4faefcd13eabd59f1799ac0cc76929cdd47966b103dc03f9af8b2d0903da251b1a0343", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642731850, "uuid": "b904afd7-3c42-4f6d-aeaf-c600d7d5e65d", "value": "T176639506BF214FF7DCAFDC3749A91B09259C641A21E97B397E34D818F64A24F19E3860", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642731850, "uuid": "3180fd12-4d7d-4162-8e72-bfde34cde2fe", "value": "768:JxNCJ0EYlDYhxD9ZbsFywLX3U6nFW9N6PNo0se15DSeue2qeNncoNjpkGUrXivM0:JxNCJBYld4ww/9wPqe1IT/qSnMhA5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642731850, "uuid": "1f1ff329-eeae-4882-a72a-6c998f5c6b3d", "value": 71528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642731850, "uuid": "2ffb297c-bf9c-4930-90fd-4ec9e9cfb93e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642731850, "uuid": "809512bb-8774-4780-a752-7cea29967218", "value": "0dbe787e1b8ab7f004a55b418e3141c4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a82937e-7a86-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642747666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642747666, "uuid": "88a7eb3e-c201-4a13-bc1c-bc1a25f21ab8", "comment": "Malware payload", "value": "ffbdfdf1901e04614359c104de756385", "object_relation": "md5", "Tag": [ { "name": "pw vodafone", "colour": "#096C78", "exportable": true, "hide_tag": false }, { "name": "vodafone", "colour": "#8E01DC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642747666, "uuid": "68abec47-9953-4349-90ac-04f7ed5fb19a", "comment": "Malware payload", "value": "d818948d23b082e1ab06e2f46f3d3b37f6462396c0975a4943893c31abf5060c", "object_relation": "sha256", "Tag": [ { "name": "pw vodafone", "colour": "#096C78", "exportable": true, "hide_tag": false }, { "name": "vodafone", "colour": "#8E01DC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642747666, "uuid": "aa3b095e-e0d0-402a-8e90-ef07325177fc", "comment": "Malware payload", "value": "280e25f45559ecd568376f454a166d8eafd518b9", "object_relation": "sha1", "Tag": [ { "name": "pw vodafone", "colour": "#096C78", "exportable": true, "hide_tag": false }, { "name": "vodafone", "colour": "#8E01DC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642747666, "uuid": "a45b51fb-79fe-413c-90e6-75417feaf5a0", "comment": "Malware payload", "value": "28db9ab1041f6f9044e8a72bdac5b207fe62642544e468d2174e1c865e3e2c60b3cbec19725108fda700d84c6e6586a8", "object_relation": "sha3-384", "Tag": [ { "name": "pw vodafone", "colour": "#096C78", "exportable": true, "hide_tag": false }, { "name": "vodafone", "colour": "#8E01DC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642747666, "uuid": "982f87cd-9196-4f4b-a726-1da127f629af", "value": "T141E0680856A39D87E43594BAFA020791B704C22FDE140ACFC4C55A911C432A08767A34", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642747666, "uuid": "7a8bbf1d-f9cf-4f76-bc61-bac4dbc5b233", "value": "6:5jdljxbKypQ1Py7ltm4nJ2A2dTIgw6gloqqLK25oGi4lDSOljlDN/jGc+t+l2kXn:5jdRBP21slUEJ2A8TtCqK22LSvRyTtaz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642747666, "uuid": "4bea8aef-6f1f-4a86-89af-b9f249ef14a4", "value": 378, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642747666, "uuid": "cf5db7e7-3628-4295-8156-5c919bed0d1d", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642747666, "uuid": "2c030397-447b-4440-9abf-85847b36834a", "value": "vodafone_21.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7ef3912-7ac5-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1642775069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775069, "uuid": "9a43aeda-ac6a-4cdf-9054-188a5eaee2c3", "comment": "Malware payload (Formbook)", "value": "6ec72b5985f230c48ef3762cfa20a0a5", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775069, "uuid": "96179954-132a-44fc-b834-f9cc924896c0", "comment": "Malware payload (Formbook)", "value": "d8b05baee601302f22a561d0686689994296a4fa6ce256bcedb9bfa899553c07", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775069, "uuid": "ce4bb231-2db2-4037-a37f-96a696005710", "comment": "Malware payload (Formbook)", "value": "7925b9ddaea9409aa3a73e0ede5027038f50db60", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775069, "uuid": "1d324260-3816-4e73-acb1-6a043a3dddb8", "comment": "Malware payload (Formbook)", "value": "67d26fe2c5df15c28da430d8baebffb21586c41e53fc9c46de55dad4bdfb8f0cfa0758a03191659b2dfcae69f2771218", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775069, "uuid": "90699d10-71dc-4204-9282-dcd6ace09211", "value": "T1DF64239D23C248A3C4AF1F32567E1E0BD37EF1D13560484F97A53FA662244E2523AAD7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775069, "uuid": "f8bfb577-9d04-4dee-bcea-ec32ba26f8d5", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775069, "uuid": "7defa4ba-a290-459d-9d63-7bb92a6bd818", "value": "6144:ow0Cj2X44PlVeJVcIlbGpnj0elctuWvey34h4kz5R7ina1V7d0aotuVH:unXmScswtvey3k4kzfingB0ToH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642775069, "uuid": "69083f81-d241-4069-88fd-80e8a40e696b", "value": 332509, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642775069, "uuid": "b83e53cb-d914-4b76-a03e-3e4ab743c5a4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775069, "uuid": "d7d312a9-2b65-4f5f-8b96-f6ebfef2bf7b", "value": "DHL AWB TRACKING DETAILS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1ac7080-7aab-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1642763918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642763918, "uuid": "20a2c3cc-124d-4e9b-8e35-67393909d629", "comment": "Malware payload (RedLineStealer)", "value": "135fd3efc41853640e313a10b8e74d45", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642763918, "uuid": "636b73c3-762a-4ffd-8868-f8a40a5d7d15", "comment": "Malware payload (RedLineStealer)", "value": "d94f3234d04100462d76b93d93c9cebbdabc61e4da8e68e0e6e7e56ff2deb2f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642763918, "uuid": "66d35e06-299a-49ab-9c47-d04a063ea4a1", "comment": "Malware payload (RedLineStealer)", "value": "6ef38cccfc95d6e859a447267acbd9823f88f352", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642763918, "uuid": "613a61b8-2670-4c95-8273-8ca4b66e824c", "comment": "Malware payload (RedLineStealer)", "value": "72188164a518a2a2ab666f540808facf8f903974db4d85b811b6550e10d5d77cf638b7798d0b1927d1710ce5fe860905", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642763918, "uuid": "04c9b9de-9523-42da-b789-cf442ac85143", "value": "T1CA3512D3975A798BF8090A7B4152C0767FF27C635E2BA6C46BD9F42F5F20F811682A10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642763918, "uuid": "895908a8-63d3-481c-a92a-0273ab0f78c7", "value": "fab0c0dacb99fe3f34f597008db5e7ee", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642763918, "uuid": "10423457-b06f-47b9-9503-b237148e7823", "value": "24576:Za+SUbO10O54tgkC6GjV+gMTu6PclRKpRcTonOAFf:Za+ZVUr6yOYRcTnrFf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642763918, "uuid": "b8ad6130-a692-4915-9f81-0e1784762e93", "value": 1129280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642763918, "uuid": "408b3e44-14ca-41c3-9753-55f137287609", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642763918, "uuid": "4b6b55e8-df93-4d9e-bee7-cfd021c5230d", "value": "135fd3efc41853640e313a10b8e74d45", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19d2aea0-7ae5-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1642788494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642788494, "uuid": "590f36b8-7792-4c1b-af3a-cff11933db61", "comment": "Malware payload (Formbook)", "value": "695ce44856e02eff7fcb34067f8c1df3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642788494, "uuid": "0ddf7e2c-09cd-4b90-ae51-874cd8bea895", "comment": "Malware payload (Formbook)", "value": "d9d9a78770bcd89cf5a0875a3c099bd2be2f6460878aa6db722f3fcd2319f322", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642788494, "uuid": "bb718a50-c50e-4fe4-baea-314307c081dc", "comment": "Malware payload (Formbook)", "value": "4604cef04122023bf3a35083b2e7ab8edfa5b329", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642788494, "uuid": "3359cca0-5924-485a-abd9-af1a48872574", "comment": "Malware payload (Formbook)", "value": "b097a30e8eff5927c71a067810ad2a33b5191cfaf282dd2bd0a4b22bfb33977b08744b586492bba5e7879c5b00388036", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642788494, "uuid": "206ba200-65a8-4eb9-b7be-fee3a57a79a7", "value": "T14604C335EAF7DDB0CA52093BA12CFA2D0D1D2D791D67F8492458FD23AEB6ACC9840171", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642788494, "uuid": "6995d197-b2f3-4b0b-97fc-91c74b8f69d7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642788494, "uuid": "c48eb0dc-f342-4d66-9375-0a33ed334ada", "value": "768:vZ/Bcb9W1aYVtSHPWclhVm13jtJXtg5k4ZaDBo+CO8nYOj0B:h/Bcb9Wi5k4ZaDBo+CO8nPj0B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642788494, "uuid": "16e5ce6f-fa6c-443d-979a-37f90ee10656", "value": 177152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642788494, "uuid": "32270c66-4c7e-4892-80e8-382cd7f94641", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642788494, "uuid": "4d1d3a22-b0b1-4154-b558-e6a9b608b4cf", "value": "695ce44856e02eff7fcb34067f8c1df3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11e1f1b2-7acf-11ec-9275-42010a9c0029", "comment": "Malware payload (Smoke Loader)", "timestamp": 1642779031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642779031, "uuid": "230ca62f-4276-44cc-9e00-77eb15de2234", "comment": "Malware payload (Smoke Loader)", "value": "0eaae2d7a6ea20e4e92fd814978bfb74", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642779031, "uuid": "bebe8e22-915a-4677-ba53-a4953cc57350", "comment": "Malware payload (Smoke Loader)", "value": "d9ed3534cb5dcce6c3b4bb3fead65823acac0cec681e17a4715ed774939c9d71", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642779031, "uuid": "efdccff9-e6f1-440e-a905-cd06d3198ffa", "comment": "Malware payload (Smoke Loader)", "value": "8ca3b2e7e1c868495c1444874a5ffc20f85798a8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642779031, "uuid": "8892e0c2-cc75-4f13-b958-9812d53a30a0", "comment": "Malware payload (Smoke Loader)", "value": "0c38c146b5625225f23b4a8fe321f27cac07aae3b139ee4c42bf4ba5d8e4f12d81005640a58bcc3f8597277a58da9bc6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642779031, "uuid": "2d625563-524c-4a0f-926d-2e125fb3cbe7", "value": "T1B8747C00B7A0D035F6B711F44A7992BDA53E7AF15B2451CB52D16AEE9B386E0EC3130B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642779031, "uuid": "00bde65d-9ff6-4d32-b910-4afd6bb10bd9", "value": "b4892f1130d31e71dc6b3341892a29cb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642779031, "uuid": "05a1a45c-8cad-401e-bd8c-11321d28d973", "value": "6144:j7twDFa+Cd/TDxqs7QGLw4uLRaeG+L/O+WLbOO7C:j7KDbyb9qscGLHAg+LmnO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642779031, "uuid": "f4479e27-9c26-4712-8f98-29971aee7f72", "value": 337408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642779031, "uuid": "047f41bf-e12b-457b-b06e-1b597feaf0b7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642779031, "uuid": "763ac843-3e3a-4c12-ae5c-cb96fecb57fe", "value": "0eaae2d7a6ea20e4e92fd814978bfb74", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d21a8a1-7aec-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1642791640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642791640, "uuid": "bdd28c9b-a739-41f5-9d75-00cc3c7bd319", "comment": "Malware payload (SnakeKeylogger)", "value": "108a413d5adedec5c2f0b7acd6e182dc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642791640, "uuid": "88e29daa-ba42-4d61-a887-3e4366870a13", "comment": "Malware payload (SnakeKeylogger)", "value": "da0a6977ce308a11a13e8efa0968404fa6e13dad07ea337734957748934e20c8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642791640, "uuid": "d3312fe7-3796-4901-a6e6-8d256d58e9ea", "comment": "Malware payload (SnakeKeylogger)", "value": "483ef421cd5f18549281b038e6a70c9e3211e8a2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642791640, "uuid": "894b0046-07e8-4dc2-ba00-895b24d5aae1", "comment": "Malware payload (SnakeKeylogger)", "value": "b9a30c7f99271a1ee5d9e45fb593638bdf48e7224098274ac9b8d291e24ecc94f8a025c6dcdec15de226e3eaf9f308ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642791640, "uuid": "6bc97029-f733-47a4-947b-386810d65821", "value": "T17B641216E7FDA735C6A547FC9872262027BE5B097853EB4E2DC6A0C2169BB014B44F33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642791640, "uuid": "fbdd1e6f-9a67-42f6-893c-38e4c5ae221c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642791640, "uuid": "02c948a2-96ef-4aa0-a6cd-146f9bed6b00", "value": "6144:Lv7RKZAlwd9W1XFvA0cLO9yYWs/Iu5kMIiTGp8ZcldgXZsxapecApZkjHOhpRRRY:Lv7RKKwd9AFvbuE7CiqeZsELsZkjHkRU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642791640, "uuid": "f1e5e86d-05e5-423a-bbbb-5df9346a8364", "value": 325632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642791640, "uuid": "53926421-6c22-4460-92e1-d270191b10ae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642791640, "uuid": "b78409ff-01bc-4674-a7af-3a1da8736e6b", "value": "108a413d5adedec5c2f0b7acd6e182dc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e51893c3-7ac5-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1642775091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775091, "uuid": "d38160ee-cd0f-40fb-ab7f-89ac8767ef35", "comment": "Malware payload (Formbook)", "value": "7e8543c4b89504e2cf047e05618b38ff", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775091, "uuid": "15e979b2-a78e-4cbd-ad02-429fd05764e2", "comment": "Malware payload (Formbook)", "value": "dab25e8c1516ece436f339c556e488ead016d9e7ba2c3a9d8a78f47ab19bfaec", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775091, "uuid": "3209685f-e0ce-4de9-8b4c-63288cdf3ee0", "comment": "Malware payload (Formbook)", "value": "9efdd11a63c066818dbebb45fa113cc34ca29e52", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775091, "uuid": "bd6306fc-7cb5-41fd-8791-b8300f695083", "comment": "Malware payload (Formbook)", "value": "b9a859293beb30af66cf69d1e45475b32de9e4b161a0fa21d13184fc2cd6b1bf6a3298ad1b2a60c59cbaa61f3001b704", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775091, "uuid": "c7f2f89c-6a5d-4195-b4d6-37de887914df", "value": "T12F84021077FD2B69EBFAC7F4A622010063797A5A2072E31C1DD7A0DE2576F819A41B37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775091, "uuid": "c7a6a6af-d8d4-4b7c-91c2-2f0bcfa268df", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775091, "uuid": "6fba8002-61da-4fac-a13a-36c9a1445db7", "value": "6144:ug/3LF3RmMjv4SvuTzH4Hw5SISdg3rvD2nRlowE2EoHlRbemx:vTLmSNvuImlPGozaXC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642775091, "uuid": "b09d9ca1-436d-48e4-afb2-6ebad1918cf7", "value": 389120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642775091, "uuid": "354c03a9-e320-440d-a377-5ff9cbcd216e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775091, "uuid": "071e2be1-2013-4133-930a-70d8dad32a9b", "value": "DHL Shipment doc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6658f702-7a4f-11ec-9275-42010a9c0029", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1642724197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642724197, "uuid": "9e9eaa70-e81e-4fb5-9f69-59fb3ae75f5a", "comment": "Malware payload (AveMariaRAT)", "value": "b0eef8bb016b4b5056b339806c6c7303", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642724197, "uuid": "ba1261fd-d827-48db-80d8-6a5c52daf58c", "comment": "Malware payload (AveMariaRAT)", "value": "dac73426d140d7313a723372e61e443d574b63ef921207f199bd76ca480fb84e", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642724197, "uuid": "8b81e5e4-27d9-4c2c-9287-2b8406fcaed8", "comment": "Malware payload (AveMariaRAT)", "value": "a7e327e92c8301598be2dcb5f34d52fed2838e28", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642724197, "uuid": "65c1e26b-bff9-4978-add5-866c26d3cf81", "comment": "Malware payload (AveMariaRAT)", "value": "cc9a0db895a20ed85e4cba9d4a5a8a8c0a088b0f1ff55db056f0ef8667cd04db66370af74f34fe90511272a76b78fbe9", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642724197, "uuid": "1bcc37a3-a09f-4afc-93d7-f7652b45da2c", "value": "T13C05BF683AC0B5DEC50BCE318D683C60E760B4A7170BDA5794571AAC9A0DBD78F205FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642724197, "uuid": "c3fbdef6-160c-4144-b282-a77cbabd06d5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642724197, "uuid": "49ae8e19-b62d-46b4-920c-dcabdb3e8a5d", "value": "12288:fuc7mKEiiiE9WfXGd333YVfY99/E1qTlHrO/ys+5uALS9t1n:flmyfXk333YCX/E1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642724197, "uuid": "50ae7a39-d2a0-468d-8da2-278ad1a8fe95", "value": 846336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642724197, "uuid": "7faffb18-a04d-422a-854b-7df8a12dbc43", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642724197, "uuid": "eb3ebed7-57da-4b48-9728-2cd84d6ba3bb", "value": "New Order REQUIREMENTS 01_21_2022.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69231a6c-7aad-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642764575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642764575, "uuid": "a66e8e64-2c8a-4341-be4e-35fe0c530495", "comment": "Malware payload (Heodo)", "value": "8bf87be890189c237136df32f5d8869a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642764575, "uuid": "756b02f7-8cdf-4612-aab6-01223202fa34", "comment": "Malware payload (Heodo)", "value": "db1c52e275e10e6037342270bc8e49155eb537116abd6a79833c9dc652448a64", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642764575, "uuid": "17ceaaad-844f-4a00-8d10-cc96dc573f24", "comment": "Malware payload (Heodo)", "value": "235a0bd73bfb0256fd9ed12684cf5b26b3b6f6c2", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642764575, "uuid": "9d028d99-370e-4817-98fc-5c20f5fdee67", "comment": "Malware payload (Heodo)", "value": "0520098ecfe7f6117a7d6c83348b9571062d744081f97979ef1d7169829c8ace55584958440e0ec71fa4e76263ef44c9", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642764575, "uuid": "310a3405-7240-428c-923b-9859e48865c8", "value": "T1D4D4BF11B2D2C07AC1AF1674596393A463F9BE90DAF9C257FFC06A4F1E315828B39712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642764575, "uuid": "0483f391-1db3-4f4d-8400-72ba13627904", "value": "24b46ffcf60dc8d39e8124f411ebd08e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642764575, "uuid": "b0df6dd5-ec5d-46ef-ab0b-4bde6573b79a", "value": "12288:kqdJaxkOWFornPmGZqnTFWbD7UYVubhesslBvQqEPO7:kOOsornPTwFWbcYVohevBoi7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642764575, "uuid": "95e7dfa7-1fac-47a7-ad40-eb5d8d09126b", "value": 626688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642764575, "uuid": "dff0e259-585a-4b61-9e5f-c77159788233", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642764575, "uuid": "a720aa6f-d768-4827-b849-5253fed6075d", "value": "emotet_exe_e4_db1c52e275e10e6037342270bc8e49155eb537116abd6a79833c9dc652448a64_2022-01-21__112930.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adef6147-7a76-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642741068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642741068, "uuid": "a4b67f6c-d2af-4ac1-9dda-b65a3db096dc", "comment": "Malware payload (Heodo)", "value": "1df4b2482edd9d2789352b664d3e71cf", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642741068, "uuid": "697bed15-e5ae-4ff8-a8f7-17492b59ed9f", "comment": "Malware payload (Heodo)", "value": "db8baab6295830de9d3d9a59dc3b8c88a5de601deeaffaaa83bb6aa941e29b6c", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642741068, "uuid": "3f313d7f-f063-48f3-a3d4-69ebcf6ac1d7", "comment": "Malware payload (Heodo)", "value": "005e320d99445f449c892af452ac2ae012434e1c", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642741068, "uuid": "0489f240-a009-490d-a03e-abf68ef30eb0", "comment": "Malware payload (Heodo)", "value": "bd6948fdb77788032f90ab95c1a19a86a995a1f78b70df87174552ca8715193df35aacd617c52d53538c62a0133ebbb5", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642741068, "uuid": "178ad655-c91f-4060-be62-036d3f1027cf", "value": "T12D636CA7B78299EADA0483394DB643C5B717EC104F9A43C73694F7346EB49F08D9324A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642741068, "uuid": "82b227d4-78be-4108-ba50-1f60e1c2180b", "value": "1536:bpEk3hbdlylKsgqopeJBWhZFGkE+cL2NdA8eXZiozeOgXVZKyaZpvyR1kZkJvU+:bCk3hbdlylKsgqopeJBWhZFGkE+cL2Nr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642741068, "uuid": "817ee8ba-cabd-4f79-8d60-25294c1beea6", "value": 72894, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642741068, "uuid": "5ad2e3bb-ef87-4ea3-b73b-787a7127fe1c", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642741068, "uuid": "e6979e7d-6b71-43b1-9efb-5c5f09b42463", "value": "1df4b2482edd9d2789352b664d3e71cf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8241974-7aa8-11ec-9275-42010a9c0029", "comment": "Malware payload (AsyncRAT)", "timestamp": 1642762614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642762614, "uuid": "366f8506-4349-421b-b410-f03cd0872f55", "comment": "Malware payload (AsyncRAT)", "value": "a6d1f561f2da0aa711a60a4e17844840", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642762614, "uuid": "64d866bd-5356-4441-9d9e-2e4c20697d07", "comment": "Malware payload (AsyncRAT)", "value": "dbaef6ba6c9fd539c9e160ed6408ca764d7e575a51c754e320504efc6c0e5e2a", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642762614, "uuid": "e20a0072-de4c-48c0-bea0-b21526cc3803", "comment": "Malware payload (AsyncRAT)", "value": "7cc9ca94a98b4aa60a17f64406a20f62ed296fd0", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642762614, "uuid": "62f44e78-3c5d-4fda-91d5-0aa87426e71a", "comment": "Malware payload (AsyncRAT)", "value": "3094c08cfe9cfe3ab151955a3c536e8e2e4bd3d05d0d1d1171868be14854879aef26e86fc96a24212f21af0f1e61698c", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642762614, "uuid": "d00da11e-be7e-4245-9ecd-6013466cbf37", "value": "T1C1232A0037E8C12BF2BE4F78A9F262458676F6633603D64D1CC4519B5613FC69A42AFE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642762614, "uuid": "b0c74b50-a349-4b73-983d-b2235a44bdaf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642762614, "uuid": "7adf48ee-e97e-45c9-8867-db65480d6bfe", "value": "768:vu/CRTUo0HQbWUnTjSmo2qMIOdgcdN5JI2ZfJPIg5WjbbgX3i7RCM7+YUBDZWx:vu/CRTUP/2qQQnsabkXSNCMqtdWx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642762614, "uuid": "34e1a1f8-edad-4683-bda8-5e63e2da8b5d", "value": 46080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642762614, "uuid": "a9ce9b0b-12ef-4a53-a35e-86e2472ca5f3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642762614, "uuid": "17b723f6-fcf5-4a39-96e9-4dfc97b7d539", "value": "a6d1f561f2da0aa711a60a4e17844840.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fa55c1e-7a61-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642731863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642731863, "uuid": "d1a17f74-44f3-4151-af12-6b3f669ad547", "comment": "Malware payload (Mirai)", "value": "6539282e02d4abdd4a058ccb9e335a31", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642731863, "uuid": "35903de6-0d83-4e0f-8065-354dea09a554", "comment": "Malware payload (Mirai)", "value": "dbf2d9e67d95dc5ed48b8b9a0e2fbf07767c3f80000913e344a19cb408777290", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642731863, "uuid": "47d56e11-2923-4c49-bd82-526cdf5a9f43", "comment": "Malware payload (Mirai)", "value": "fae5824f361d26a2e630ee192eb058729157b3ba", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642731863, "uuid": "aacf3a38-95af-45e9-96f9-725ac8fc4760", "comment": "Malware payload (Mirai)", "value": "ca61183f4d0749165e4731cd7d7cdc7d80208475e46cf860790f150fa033a37cb16ea2bc66cb924b1d70abb4fd00bc91", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642731863, "uuid": "d51c9b68-02e9-4993-a636-3d4c249ef610", "value": "T1E16396193E218FBEFBAC863847B74A219658339626F1C5C4E15CEE015E7034E745FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642731863, "uuid": "8ebcd3d4-c042-4fd0-b6fa-2b2c1559e639", "value": "1536:hCNeYWDuwn/iiVaBZ9tcS50v6c/+b/KlqL4fBs6:4NehD9xV6p50SXOqL4fO6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642731863, "uuid": "24f8cad5-6d9f-4c7d-9f48-db2adfd91c04", "value": 69192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642731863, "uuid": "b1d8798a-c4d4-466e-9234-d592d245bd8e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642731863, "uuid": "4919c8d3-5907-4ab0-8824-d3f5547ebd76", "value": "6539282e02d4abdd4a058ccb9e335a31", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6a06e84-7aa7-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1642762235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642762235, "uuid": "8c7c4505-640c-4eb9-b616-8596749ab08b", "comment": "Malware payload (Formbook)", "value": "566497e56d1ccc0a1125eedd66794be8", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642762235, "uuid": "3d000238-b376-4fc1-89d5-6608f1fadb7a", "comment": "Malware payload (Formbook)", "value": "dd290e6c8cdab0540f36125f6243e56cef1da3f21bfd69e3345b25b705d5afd7", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642762235, "uuid": "99ec5116-1f06-49a1-81d9-09245d26101d", "comment": "Malware payload (Formbook)", "value": "35bec81f41295f54fec63c0933536ebeb8f68900", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642762235, "uuid": "a7cfcbc6-cc5e-48b1-b6f3-d161ffcd369f", "comment": "Malware payload (Formbook)", "value": "32404ad25c31937381b565d7edd8eb05cd274bfa337cfcd73fddc8c0f00ce66448cfa1b39a0647e0a45e8b0ca5805545", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642762235, "uuid": "c02b4353-91cd-4fdb-9dc2-1a21cb2415e7", "value": "T1EB04028AF464EC9BD0425A3D286D94131B2ECC67379706B2F2E73212443DD2C997E5BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642762235, "uuid": "b18c85de-6dfb-4f43-9fec-26760175d0d0", "value": "3072:gcNhfqhDE3dl1KCvhSSAb8no9TLx3WWXKJrwYzdQIfifXjD/GHH0VM3lrJlinm:xu87oSnoFXKqYGYKv40VMfB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642762235, "uuid": "26bd6712-bf0b-4380-98a2-8eeafe91b32c", "value": 187192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642762235, "uuid": "eb4ec276-a010-405d-a225-156901bf8745", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642762235, "uuid": "59a9947b-b5cc-4ab1-afd6-198493fea2ef", "value": "QUOTATION REQUEST - SUPPLY OF PRODUCTS - DTD JANUARY 2022.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38a718d6-7aa8-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1642762346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642762346, "uuid": "9a70f509-1de3-4208-9951-cce06f7f96bb", "comment": "Malware payload (Loki)", "value": "b5bc2cd366aef3ceea05aef732a2daa9", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642762346, "uuid": "43822d03-0789-417a-be57-3f84b4174fd8", "comment": "Malware payload (Loki)", "value": "dd5e879363900f6fb165bc02d131c844183d8b2061ed473a5f33b5984a7cb206", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642762346, "uuid": "6e01ec76-6c16-4969-a4c4-a29c85a0f862", "comment": "Malware payload (Loki)", "value": "1041e988b9c4045bd565221072bc18bc488cebca", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642762346, "uuid": "39364819-814a-4682-831a-07c0512db91d", "comment": "Malware payload (Loki)", "value": "d6b66c560aafbc2feaafd80d52bb32af7cef95a856404bd02e48ef622f486f830fb1e807830f6d943bce68bdbd7df666", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642762346, "uuid": "a9c5559c-d45f-428e-ba69-f5198572ca8d", "value": "T10074F1553240E927D99A7B354CDEC6DA6A67FC01BE378A4B3690F72F1E3B7904803216", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642762346, "uuid": "c11df3fd-9ed5-4048-b5b8-c8597ce907f8", "value": "6144:WxEtjPOtioVjDGUU1qfDlavx+W2QnAouxfQNHgx9TR2/AcdIWE1pataRGRKGzYbj:LAPcdIrT0HkbimJI3t9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642762346, "uuid": "262dd8c2-67ac-416f-b2cc-d299abcd7603", "value": 351232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642762346, "uuid": "a2231977-3b56-496a-aa4d-0070f9b13811", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642762346, "uuid": "93af166e-7f1b-4265-b456-5499a584e9f0", "value": "Odeme Plani.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8522ce1-7aa7-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1642762211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642762211, "uuid": "06d9cfa7-f626-4542-9d98-44bcd4fd8e5b", "comment": "Malware payload (Loki)", "value": "54a1d471b8232149f7bdc240271c9818", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642762211, "uuid": "d2ccb3b1-e343-4a0a-bc63-79b86d09ba4a", "comment": "Malware payload (Loki)", "value": "dd75c9788bd14773826b5a26236a6f4dbb671c53cca8fde40b498cb19e0079f4", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642762211, "uuid": "465cbd42-ebee-4cde-bfb9-7efb44430e9f", "comment": "Malware payload (Loki)", "value": "87208ef7f304c2617da5a19d2d98a3a80ddc8583", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642762211, "uuid": "59ef942a-8e8b-4ec8-8d77-81e18a5e3bd5", "comment": "Malware payload (Loki)", "value": "11e360a46c6395236d2422b223b3f5f7f8a2bd94e0a7c5c086ad73a6df3717283176300669d94d69d814ac3a24092fe7", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642762211, "uuid": "a659233f-4ff4-4fbf-8ccf-ee356d344e8e", "value": "T121141209BA954919FCAEC53854E0123CBCB5ED82F48077C469287D06BD72D9A136FE3A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642762211, "uuid": "31894ceb-3d04-4e25-b47a-cf964a4c9ecd", "value": "6144:WyWJw+bwi3DygXzOBVjNDBnFi+XgeVYsxwi:x4wYwi3mgXqzjFi+ksyi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642762211, "uuid": "9e86d891-5d64-4f79-897f-6d4e91c737c6", "value": 201016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642762211, "uuid": "56fd0a36-11eb-4d98-944f-08dcd6fdd68a", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642762211, "uuid": "077697ce-4069-4acf-a751-b5f07f6faf2d", "value": "PHE-0394- COMMERCIAL DOCUMENTS.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba9a8c49-7afb-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1642798212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642798212, "uuid": "43191d97-2d80-4745-96b8-837c82f32b1c", "comment": "Malware payload (AgentTesla)", "value": "da4a3878ed0b549954294e4ca19ed140", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642798212, "uuid": "c9a84e9f-dd59-4552-8f23-fc6c9e8c5c95", "comment": "Malware payload (AgentTesla)", "value": "de2387252a9a00bbad8b4e50b4eea5f426c701b3ac6c9cdb85921b2b9fa220ed", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642798212, "uuid": "56cc7124-40b9-490b-8afa-ab87a3fe3977", "comment": "Malware payload (AgentTesla)", "value": "9d100cc882a8e2ef390a8366b4f559c892d01098", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642798212, "uuid": "3763f1dc-fb3b-4dc7-b3ec-e0f8ae56874d", "comment": "Malware payload (AgentTesla)", "value": "2ed44b64f059fe2dc464170662b092211e8c4d0842a81228972e4f8e2edcb0816b86262a8b106ecf9d9c7140be85ec93", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642798212, "uuid": "ef9831e7-6173-42b5-8d1b-243d6d020af3", "value": "T1B515089D325071EFC867C572CEA81CA4EB61747A971BC207901312ADAE4DA97DF242F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642798212, "uuid": "7b0c2baa-ac35-40f0-8547-0c3909ff7030", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642798212, "uuid": "8e902ef5-b97a-47f1-8667-e2442878e079", "value": "12288:qgL9EyDPCpQYz2EsuXZPetn7TTlL09UdKq6+i9vYF9Ah7QydAuF3JvSepLfgd9rE:DapQu2xC2nriI6+i9vYF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642798212, "uuid": "a9d47af5-a2af-4581-a8fc-bcb13753dd12", "value": 892928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642798212, "uuid": "c7eab0c6-ada5-4704-8519-30914b948eb8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642798212, "uuid": "5abe6a04-401d-451e-a553-6ef6e5d92b3e", "value": "da4a3878ed0b549954294e4ca19ed140", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af9c4bb7-7a75-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642740641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642740641, "uuid": "e5693bca-34b6-4925-8a93-16428504e0dc", "comment": "Malware payload (Heodo)", "value": "1067a87f89b37eedf6839da32666277f", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642740641, "uuid": "c82d2058-628c-4e79-9bce-7fca0703348a", "comment": "Malware payload (Heodo)", "value": "e06d794800a6c8e29eaee2ec0e2ccd9f60b00c7d6c9b4a80ce605a4c156f9982", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642740641, "uuid": "bae67c11-87a4-42d7-afbe-a55848f9b45c", "comment": "Malware payload (Heodo)", "value": "9ddc45baab1fdcfbcbc2183ecd3ec9bf74f6e533", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642740641, "uuid": "19029b29-7b34-4525-8d76-20ba0819c002", "comment": "Malware payload (Heodo)", "value": "79344b0959a6fc5cfd4bbb5e8d03ab3b1a463d814ca0988fb19892051638742d7b57590d3fad755681bb826bc826321f", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642740641, "uuid": "7bbf9ea5-0e4b-4714-8c5d-02d8b649a06f", "value": "T1DC636CA7B78299EADA0483394DB643C5B717EC104F9A43C73694F7346EB49F08D9324A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642740641, "uuid": "5de534f2-d207-4b36-bce5-a0208b2edc15", "value": "1536:bpEk3hbdlylKsgqopeJBWhZFGkE+cL2NdA8eXZiozeOgXVZKyaZpvyR1kZkJvU+:bCk3hbdlylKsgqopeJBWhZFGkE+cL2Nr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642740641, "uuid": "72dafdc1-1737-4e2c-b7aa-18f0c33bd8d0", "value": 72638, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642740641, "uuid": "f916580c-ad1d-42ba-8756-b846b3a95a23", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642740641, "uuid": "de965785-339b-48c6-b378-53f9d8cba655", "value": "1067a87f89b37eedf6839da32666277f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4baf7ec5-7ac8-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1642776122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642776122, "uuid": "cad35544-2512-4f9d-a4c7-ac4235c6dfb0", "comment": "Malware payload (AgentTesla)", "value": "1736e805c60f7caaec02db08e336d788", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642776122, "uuid": "8abe5434-49de-407c-a9fd-7e193d007b5e", "comment": "Malware payload (AgentTesla)", "value": "e0704a694e935943ebadf05fac8e531cef005acab38b99a2e53ac0a101793553", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642776122, "uuid": "b06db136-141e-4b96-b6da-3f4e84f8ba44", "comment": "Malware payload (AgentTesla)", "value": "b4eb9ea7f72921f533c3373ba47b6c7a33dcbf11", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642776122, "uuid": "8c46e322-54d6-49e9-8f9d-3f9bb3255bce", "comment": "Malware payload (AgentTesla)", "value": "a8a54441e7562606b2179bebb2f0de7331eb61607784e8c3b2ef419f05f94f6a7aa2ae6c9c485632eaee629aebcd9fa9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642776122, "uuid": "0caa7cfc-2304-4042-b730-af7876b77c7b", "value": "T1D9F4E04032F88B05D97E8BF74871409017BABE0AAC39E76EADD1B1DF09B1B819616753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642776122, "uuid": "977f1259-14bd-4023-8466-14505d92801b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642776122, "uuid": "6b9aa6a7-1069-41b8-8349-64f4c47d137b", "value": "12288:i34Nc/4pQ2YbbAcmPZ9bZ8Tp70k7rp7Gr1BUDpNpZ8J9UBFq6+ievYF:o4rpQ2YbbAcmTVgWk7rMJCLAyS6+ievE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642776122, "uuid": "e8be2747-faec-4f35-b31a-755f8b48fb46", "value": 724992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642776122, "uuid": "c3ffe814-2f7e-4b4a-91aa-74b6f73ae613", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642776122, "uuid": "1affd4fa-1a58-4836-bff7-81ce1c02205c", "value": "1736e805c60f7caaec02db08e336d788.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c251ed16-7a77-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642741532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642741532, "uuid": "98ef3fb7-2368-4b68-9ef4-748dd446cdd0", "comment": "Malware payload", "value": "b25a1dc0fb916de53d0e1acbac79782d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642741532, "uuid": "25599f87-c4ba-4fae-959b-0a681623a5b5", "comment": "Malware payload", "value": "e0fa11a7d6143e58c0dc1cacfcca1c6223974adf37b82ce5b38f0c54704f6f1c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642741532, "uuid": "be69a540-eefa-45d3-8823-efffee1faa84", "comment": "Malware payload", "value": "1208b71c67bdb258226ad56ef9695a43e780a4a4", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642741532, "uuid": "f1c0b8e8-8972-43a0-8a53-a142a07e3ec8", "comment": "Malware payload", "value": "e56bf71b3e81214c362cfc8415bbe1fc87ac10c6cb7936288b0f2b5e1930c362791e593b100fd90da8e755c797c90460", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642741532, "uuid": "689d0e8b-632c-4926-9733-0063b9e17543", "value": "T11BA28259EFA58E3BDC6BDD3305A81A4531CDA14722B43B6A3534D838F51F84B4AD3CA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642741532, "uuid": "5d5f2713-001d-4e1d-8408-5ddf7b2847c2", "value": "384:S9RwF/K3EWbK7etgeWJLrqRIZwT/xB67Xi3Mtnei1FFjwrh:S9RwA0p7etgeWZkIZwTPQXictnekk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642741532, "uuid": "f4307cc6-e1b8-4f3f-a86e-6310132eb2d6", "value": 23028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642741532, "uuid": "f3979859-5963-4ee6-b96c-a616303ecf34", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642741532, "uuid": "43ecccaf-2857-4fa2-9d5a-21d8f388c50b", "value": "beamer.mpsl-20220121-0505", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b452f399-7acb-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1642777586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642777586, "uuid": "be25338b-ebef-44e5-aaf0-2eab5691e2a1", "comment": "Malware payload (Loki)", "value": "16f2e90502377a019cb434ccf66ce07c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642777586, "uuid": "f56f08bd-a118-4541-91ac-9e8d03424c5d", "comment": "Malware payload (Loki)", "value": "e10c51e6c0ab61d9ac4dea0ae50acdd5f20c1456c8e5641ab9b4208441b919dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642777586, "uuid": "3d900a7f-d4f3-462e-a75e-d0e8e340056e", "comment": "Malware payload (Loki)", "value": "e59251454c370f3fc4ee7cba59d6f42a8555b1f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642777586, "uuid": "6da4c410-7496-4750-99bd-b43332f5e95e", "comment": "Malware payload (Loki)", "value": "7ade32bbd8bb7975ce1d83870266b21c9a963419e8597525bc46799eac6b4f8486bb5487bcaaf191eb4c6e3b7a2e5d63", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642777586, "uuid": "40d013a1-63b8-4659-aa83-c660d199bd96", "value": "T1596423973CE59437D87216B02DE3EB9AEBB2F9042A94251F33C22BF215361C78A17751", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642777586, "uuid": "da37eedc-f792-4051-842f-ab880a1b9fc5", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642777586, "uuid": "3a4787ac-2aab-4b49-accd-3be885f1db1f", "value": "6144:5w2CekHm6i1u8tJmcrtZ0TiEevZNka4VV8snBMK75tGha92W2:LTGm6i1uETrtZCrGZN4VVfBMK7Wk2W2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642777586, "uuid": "c4703e0f-aa37-4595-ab32-e1a6fd0beeea", "value": 317567, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642777586, "uuid": "f68f08ec-cca2-49fa-9978-d4f695eb337a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642777586, "uuid": "eefa8da5-2ea4-4a53-9f30-998eeb8592e1", "value": "nuevo orden actualizadopdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26db4a3f-7af0-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1642793240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642793240, "uuid": "15fee76a-d925-46dd-a7e3-8ebb55e3ffee", "comment": "Malware payload (Loki)", "value": "cdefe8d30624f6193fd927f42b9c4b1a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642793240, "uuid": "e3ba050d-7e34-421d-bdd0-398b85286377", "comment": "Malware payload (Loki)", "value": "e12350c828d476da95d1afb8cfbd73e061ab9596a4303848687e925f3627ca35", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642793240, "uuid": "d05e2010-a8ae-4ee3-b67f-00d807918b02", "comment": "Malware payload (Loki)", "value": "a77c3bfb659883d8db0f24cc0dea3c556e95fea5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642793240, "uuid": "2acf635a-b7e0-4cfc-9793-d6b54065c478", "comment": "Malware payload (Loki)", "value": "2b673ba2612e2c5d51ad31651f97a0f336adf6f8b1469fca738f44e6c4724a80f9f66df7cdad604010f6db9f6071aa08", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642793240, "uuid": "54abcba6-88e7-408b-a8ac-0b629f5d2737", "value": "T14BF4E6AD325071EFC867C972CEA81C64EB61756B931BC207901312ADAE4DA97DF142F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642793240, "uuid": "97315648-e49a-4555-bbd3-9b684cb5c799", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642793240, "uuid": "d8678522-3538-4c44-a0fd-9ee6b76f3ba9", "value": "12288:XxB2SSgPDOgP4PfRFxyeYpQcq6+i9vYFLPVym9sOdEa/DRIwd9FZ4Jh+io/hoCNh:jOgP0fPxKpQH6+i9vYFj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642793240, "uuid": "0fa321e9-835e-4593-9589-e5b02cd4b816", "value": 752640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642793240, "uuid": "50fb006f-c598-4449-b133-e4f590242dc7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642793240, "uuid": "0adee9eb-a2ef-4587-aa32-60990f660b58", "value": "Pago-21012200.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33e3a4e5-7a61-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642731844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642731844, "uuid": "8f20fdf9-e7f5-425d-9828-2bb8efe425b5", "comment": "Malware payload (Mirai)", "value": "5ca61982c3626a6a6317eb28b301c00b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642731844, "uuid": "190426d2-ceb4-4e88-b2fc-7e0f23a6017a", "comment": "Malware payload (Mirai)", "value": "e1250ce224b971ff719ba2532e2de4b317aa90a9f82ddc18843d5d7f9a2b6b39", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642731844, "uuid": "434b91fc-96ad-46e0-9c06-eaa4a79d5c73", "comment": "Malware payload (Mirai)", "value": "ffde6d29d70c9a8471f0b0c86ca1438662183e8a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642731844, "uuid": "233f12c3-432c-482f-95ff-de06b41fd5a0", "comment": "Malware payload (Mirai)", "value": "2d9e58ca945df3323777d2068d61209b5de6828498d915eb1a3a3e04c3176d2426dd1d35019798434610cb960f507e68", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642731844, "uuid": "dc2c743d-245e-43c3-b76a-3c6784036181", "value": "T180334ADAB402AE7CF89FEA7E84164E0AF13063511053072B67BBFDD37E322549952D46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642731844, "uuid": "0169083c-8718-487e-9e81-39063390f376", "value": "768:wjeK74YNIHchFK0076BhBQeJF/gFHw5/Sfu3We/npgajRJT2YOnI8FL:8FMYiHcHGVFwtSW3pRgajRJiYOI85", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642731844, "uuid": "25c425d0-cc6d-4363-87c3-1da06862524b", "value": 52884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642731844, "uuid": "cf4d9a2b-6a66-426f-a599-cd188c5a1d5a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642731844, "uuid": "f03b86d3-e61e-4eb1-9b01-0ec3abbb080a", "value": "5ca61982c3626a6a6317eb28b301c00b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92c6848f-7a5d-11ec-9275-42010a9c0029", "comment": "Malware payload (GuLoader)", "timestamp": 1642730285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642730285, "uuid": "4377f6e4-f647-4b00-b628-afebab0a7f7d", "comment": "Malware payload (GuLoader)", "value": "152d9e15eb5ca4b0610c9c98bf4ff094", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642730285, "uuid": "fd08875b-f586-4655-9a50-aa139aa586e5", "comment": "Malware payload (GuLoader)", "value": "e12cd78365630b9cb54314ad1b51960a03e18940bd96bfe4a62ddd7f9d135699", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642730285, "uuid": "7fce41ec-f194-45f5-a201-b604c6b1dcd2", "comment": "Malware payload (GuLoader)", "value": "c3c9949071969071756bbd3b72ad9968f2210102", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642730285, "uuid": "fa1d101e-49a6-4299-b68e-0a71a4fbebe1", "comment": "Malware payload (GuLoader)", "value": "5e8557f1895377abe6e1008f8acb1d694eccc4d5608b092f7ec3764062342bad4558a22c609bbea71c33c23f4b99f73d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642730285, "uuid": "6bdd506a-85ba-4294-9014-a80d891796f7", "value": "T1DAD3F1202760C8B3E5F24AB5AE7A97771FF9F5102760CE971390BD883D71AC14A2E721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642730285, "uuid": "d772867f-262c-4cc4-a4e0-7f5ceb895c30", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642730285, "uuid": "d8262ca6-1dc8-43b6-b9f3-26fdd10fca9f", "value": "3072:zbG7N2kDTHUpou5/bsRcsBXI42lz38UzaDzZBk1if/YskPx:zbE/HUJsRcKXF2lzMUz6/kEf/Yskp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642730285, "uuid": "e39cccf6-4446-4f53-b4ba-208043a8b4f5", "value": 141520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642730285, "uuid": "0b92229c-375a-4b89-ae69-adcbe2859278", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642730285, "uuid": "e5493e79-fad9-4d8c-b856-a6e4911689c7", "value": "Pnportd65.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8aa661a8-7ae4-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642788253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642788253, "uuid": "bccdc500-5f4e-4584-9db9-2d5388d01a3b", "comment": "Malware payload (Heodo)", "value": "bc1363f77a064c1ab5a8b92ac98985f1", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642788253, "uuid": "45b293e6-58ce-4cf5-8194-5a4a07d891e9", "comment": "Malware payload (Heodo)", "value": "e134f9298e0c9e00644ec2b1d07bbd196db08aad4b45dfc8798a632cee1a785e", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642788253, "uuid": "1871d8fa-7fe5-465a-8939-19c75f611ad4", "comment": "Malware payload (Heodo)", "value": "52d81d3a43dbf020265bb8b89d670e35cfccfad9", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642788253, "uuid": "21038204-b541-4182-9990-ed28617d5481", "comment": "Malware payload (Heodo)", "value": "718f80f2fd55ebe9b6caed7769f43f2607f2355f04d20976fa14642e91debb044cc4892e936103664917021aaef93f56", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642788253, "uuid": "0af6baa1-c79a-4878-b331-f8320eaa98fe", "value": "T189A3B0527BC6CA59EA4547710DBB024AA723FC105B7A63473285F3783FB89E08D13A1B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642788253, "uuid": "2c803a0d-8d15-45b8-9009-127854fc3a0d", "value": "3072:n/k3hbdlylKsgqopeJBWhZFGkE+cL2NdAFxe53lGvFTQ3IzxgdrvxpU0OKvMB:/k3hbdlylKsgqopeJBWhZFVE+W2NdAOK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642788253, "uuid": "4baaab95-6b31-4e9a-a174-525410d8a9c9", "value": 104401, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642788253, "uuid": "73a08d05-f27e-4ca6-9fdb-0435ce301515", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642788253, "uuid": "6c2ad151-ca2e-4e98-b6eb-e9763229c952", "value": "Form.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bac5fb9f-7ac7-11ec-9275-42010a9c0029", "comment": "Malware payload (OskiStealer)", "timestamp": 1642775879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775879, "uuid": "410297b5-b14e-43a5-886c-02d825670115", "comment": "Malware payload (OskiStealer)", "value": "d62ad50b65151ada3167c117ff91f71c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775879, "uuid": "cc26cc3f-0668-4121-a430-d824585e2fd8", "comment": "Malware payload (OskiStealer)", "value": "e2d736aa3991b4b9d09ec99401ea45bea6cc317f3470e2a71105f1aac46d1ff8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775879, "uuid": "40100fd9-19bb-419e-9b86-4e2a1cf688b9", "comment": "Malware payload (OskiStealer)", "value": "773464014e40c178ee942dc8d19b68c509aed75b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775879, "uuid": "90e2c50d-381b-4fa2-a4a9-4d85d2435015", "comment": "Malware payload (OskiStealer)", "value": "8d5c5aec0091dff76e1be151f36e9f207ed68bc17444de4e8c7ee21ea0cd04f7fde9493bee251dcff38afce3e74c7637", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775879, "uuid": "fe39f4fd-8b23-4414-8164-f9751496394c", "value": "T1CAE4D04133F88B45C4BE8BF648710490177EBE1AA874E71F6EA1B1DF0DB1B819A26753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775879, "uuid": "ffe050e9-9a8b-4f9f-9214-60fd8f1b2067", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775879, "uuid": "be26c16c-010c-4a5b-8510-981ec4389b69", "value": "12288:o0/wQKpQ4Dj8ps9ILdVyELBPxdurgN9lq6+ievYF:9UpQ4f4zLKELpfN+6+ievYF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642775879, "uuid": "d122cfaf-b749-4679-be9e-f86b0ecdd7d2", "value": 696320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642775879, "uuid": "9b25f05e-4472-4884-b48d-80ea4bb80b09", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775879, "uuid": "a0d53095-e933-49a0-97b6-aea5c68c3098", "value": "d62ad50b65151ada3167c117ff91f71c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78e253fc-7b04-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642801967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642801967, "uuid": "0fff5e08-6c17-4f06-b6b5-714f95c8f85a", "comment": "Malware payload (Mirai)", "value": "99c688d82385c73fdead0aca5b36c70d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642801967, "uuid": "5e69cc58-8f3b-4317-8a77-a6f1b44a3a08", "comment": "Malware payload (Mirai)", "value": "e2f7e3787937d6b407b1708b469c37b2f1485cbce1723d9daa371f0a54ccd5c6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642801967, "uuid": "bf7cca91-a9b4-44b1-b989-143f21e0488a", "comment": "Malware payload (Mirai)", "value": "7cec4242b798bd743abe6445dd67287c5a0a67d1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642801967, "uuid": "82cf434c-e198-4aa6-888a-44aa33413e97", "comment": "Malware payload (Mirai)", "value": "cf804d9fabc2b313ec19ece28eaa96cb1c789d16bb109912153f09d839f16cee72e3f375ec09dc2b944e25d8105a98a5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642801967, "uuid": "ece8e12b-7cad-40a9-a72c-b6420bede2bb", "value": "T156B2E132772EAA22C074893BD6384A877F561379D2F271224321CFF8F5546576431B97", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642801967, "uuid": "b6f46c40-a10d-4a17-b47d-19ae0d624d79", "value": "384:ZifwSUMjsR2os/C2u9ys63q+uRBaXvRmf2jPyfNQL+qHhymdGUop5hD:IwSUMjsRE4gB3MRBafsf2Ly1QZHs3Uo5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642801967, "uuid": "2665b351-3ab7-4b1f-b9a2-2837ac601c9c", "value": 24480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642801967, "uuid": "a9a1f4da-19ca-424f-a397-4e22ba388dad", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642801967, "uuid": "355570a3-5891-4dde-bab1-4e0dbeeaca23", "value": "99c688d82385c73fdead0aca5b36c70d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a64dab80-7ae6-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642789159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642789159, "uuid": "9b2889d1-fb7f-4539-ad2d-7dee3dd288f1", "comment": "Malware payload (Heodo)", "value": "c6d8d14d9a9f4649695fb9ddfeb60c0a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642789159, "uuid": "af90eaca-c472-4a32-a441-17f21f71e261", "comment": "Malware payload (Heodo)", "value": "e39bda1e5d4f990da43aad6b5ddd94ec34b189f4ed0eca1771a1ffae6a82995b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642789159, "uuid": "10e6cce6-92bf-4e6c-936c-c792a8f7355b", "comment": "Malware payload (Heodo)", "value": "4a1580e8939656fa10a5ac57a38dab14e2c86abb", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642789159, "uuid": "17c09bb8-369e-47f9-9ce3-a4f32914fc83", "comment": "Malware payload (Heodo)", "value": "b2e3bcf3027b2f9dbd3a5e3cec4d44aac5e05be22bdc04e6b7516c0e939ac309f2292775862afe8e8a88f9c7736fee37", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642789159, "uuid": "69e6f6a6-95d7-476c-82cb-1747dfc8bd47", "value": "T1B4D4BF11B2D2C07AC1AF1674596393A463F9BE90DAF9C257FFC06A4F1E315828B39712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642789159, "uuid": "14a2cb9f-ebdb-486d-bc5e-e261ebb132f1", "value": "24b46ffcf60dc8d39e8124f411ebd08e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642789159, "uuid": "7783eba4-1b32-4379-92c8-bab0405a3889", "value": "12288:kqdJaxkOWFornPmGZqnTFWbDtUYVubhesslBvQqEPO7:kOOsornPTwFWbqYVohevBoi7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642789159, "uuid": "685d6180-39e7-43a2-8d3f-c71382d2df17", "value": 626688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642789159, "uuid": "a2b08d61-1c02-45e0-87df-7f31a4bdb6a7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642789159, "uuid": "9aeff383-eb6b-45a8-a5de-024425d45726", "value": "D4cEFfIh8TP.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3999ebb4-7aac-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1642764066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642764066, "uuid": "fc07d9e2-e56b-4642-8b55-84814bdaa2db", "comment": "Malware payload (Loki)", "value": "72a34e9762e15b555dd8ab5c8ea53ed8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642764066, "uuid": "9397f4c2-1c73-42c1-ad89-01aaa0360954", "comment": "Malware payload (Loki)", "value": "e4831f5ca0b505c82808d0c8ffd64007e3689a2c846d9c1e4a4d89a02c4381f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642764066, "uuid": "d91cdf48-c427-4f3d-9808-0fc958e30283", "comment": "Malware payload (Loki)", "value": "13ed35a1b1907fea11550ce3b6a9bf1676e780a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642764066, "uuid": "9600a941-b101-4d25-890e-a9e75e9d2cd4", "comment": "Malware payload (Loki)", "value": "1670e09e0e6eea23dbc846dcfa205f4e5ab573528bae9373f76e807bb17f9b46e8fe6877c57164db5e728cde146e3579", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642764066, "uuid": "acacca5b-8dca-42ba-a8e9-357a0beb4490", "value": "T11E6423F287E8E437CA212AB189B35F69F7FBF122273554875B6D5D9A11010CE2B0E583", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642764066, "uuid": "74d8ff93-8e1b-40d9-b4e0-89a09bbfc488", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642764066, "uuid": "1b3f6ea5-8ca0-4b64-89fe-56d5eadd134d", "value": "6144:5w2sWymanPtWkigVMsHEhcNeteeELywMED6ILzR/kMpEvRf6:LGhnkknMskzuyDEmiRsOG6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642764066, "uuid": "8859a241-21b4-4c27-bce8-f3fb68d7ccde", "value": 316998, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642764066, "uuid": "1833204f-47e0-4a8e-a710-502197ba8de2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642764066, "uuid": "b503bdb0-6066-4c31-945c-82c9f7ff4af9", "value": "Revidovan\u00e1 proforma fakt\u00farapdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f31e0c5e-7aea-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642791006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642791006, "uuid": "3a893b5b-7be5-4973-9ab3-21637e36b11d", "comment": "Malware payload", "value": "f1693cfee9216cb9d88d39eb27ce2148", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642791006, "uuid": "231fdecc-ab76-40a7-90b1-3aa815dd5b47", "comment": "Malware payload", "value": "e4886b1adc68737e4d372666b48a53abd17c1183c475cbcd54d6624469048163", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642791006, "uuid": "57546b11-6053-4821-8cef-cc3685a7be77", "comment": "Malware payload", "value": "60bd91a9fb1c1fb5c30f7bb2a8949fb5ab7bd9bd", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642791006, "uuid": "ca692233-bd51-47c6-b31f-52534a4ac0c9", "comment": "Malware payload", "value": "6458b591c27d0a55ec6de75b3d6fb1f0dad697dd09e87dde3ec395214e76f710cbfed6977fbe2988b117cad980eefe6d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642791006, "uuid": "51baf129-a4b6-4e9b-8c0e-8a4b0b52d88f", "value": "T16C33F101AA6875F1C5401C39ECE3CE0613632165BD99B0E6171E51BBC7CBDE1A7FA293", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642791006, "uuid": "fc6c0078-a636-486b-bee2-4956ce95bd7e", "value": "768:5TIPYi/92C8y055R00F4swWd5UDJBDzUHASlysjU143UE71P24wKcCO0:Vzcg707Vu58JJGcsjUe+4wKcCF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642791006, "uuid": "d5c9a81a-aab7-4561-9ff1-355b503534ea", "value": 51796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642791006, "uuid": "717aae93-cb4b-4b34-92e4-bd461dd881d7", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642791006, "uuid": "616307c0-20c3-4026-88d0-07363f9c9154", "value": "daddyl33t.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a4318d6-7a85-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1642747316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642747316, "uuid": "a2d16a07-d4dc-4132-99a5-67c33b1d3023", "comment": "Malware payload (Gafgyt)", "value": "458c663219633512f6ad07205d4c8564", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642747316, "uuid": "54acd18a-aad2-4477-b180-167c3423cb6b", "comment": "Malware payload (Gafgyt)", "value": "e665ca1ef6d6fc3ca8f1215abd04e139e05d58286643a60e021efda0d501305e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642747316, "uuid": "660a8d46-77ed-459f-a755-01f76597037d", "comment": "Malware payload (Gafgyt)", "value": "1114f760496376470d48a857a00d064fcd411d09", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642747316, "uuid": "c555ed70-9d67-4f1a-ae68-05c40ec1e671", "comment": "Malware payload (Gafgyt)", "value": "28122f773b938f397ee99ac0d9b2871bcc4ce41378b2f837463c8e5549de49106cdb0122144dc90116b6aabfaea1cf23", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642747316, "uuid": "7ecd1056-536a-42bf-8ea3-4c74197d1f9c", "value": "T107E34B09F6408B53C0D32776B68F534537239BA5A3DB33069928AFF43FC27A94E22955", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642747316, "uuid": "4423c856-2ea7-4687-8786-b4e70c2cf724", "value": "3072:tdntU2haO5H1XacBoGmh9H5Z5hDiGRvEM/9f9T637m5wTsL/Qpyn:ntVhaO5H1qEc9H75hDiGRcM/9l+7m5wS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642747316, "uuid": "0bb767d6-0169-452b-8fd8-ddabb96f3ec4", "value": 156296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642747316, "uuid": "42703c27-d6a1-47ed-a081-bbccfaea3e9d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642747316, "uuid": "bbe3fad7-cbb4-4c47-ba93-eef72730fe6b", "value": "fuckjewishpeople.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4624b84-7aa7-11ec-9275-42010a9c0029", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1642762151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642762151, "uuid": "320f5242-d109-40ee-8810-16ce48234776", "comment": "Malware payload (AveMariaRAT)", "value": "18e5e22dadf8d8298b8f6d8fa0a9aac3", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642762151, "uuid": "995669e0-97e4-4894-80a5-2cdeeb9d1017", "comment": "Malware payload (AveMariaRAT)", "value": "e6e838cfa657885526422253a832c907b293da415af490864634c2badf673b45", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642762151, "uuid": "1f1e9666-daef-4d9b-a5a8-4273edbe4b95", "comment": "Malware payload (AveMariaRAT)", "value": "be6c37f07cea53e2fe0ff47e63be8870d0cb51b1", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642762151, "uuid": "02dbd83b-d511-4be6-942e-2af81fd340e3", "comment": "Malware payload (AveMariaRAT)", "value": "88a245424e1248c1833ee2108d3be0b4a184d35b1c747c648e15f0aa0caaf180d5033f53a6acb6473f4a785bc7a70730", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642762151, "uuid": "dfe68dea-1d3c-44da-9e4e-3953f3596ab8", "value": "T1B40412752AAC95AAE1FD27F686CFC5092622EF55051C207BDD68F3D32FB849A11084B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642762151, "uuid": "f27cdb97-1b61-43ae-8c6d-d6b132b6da50", "value": "3072:vPHuBZ6Q3JP8wFXYqTrxAPtD+ooJW3NXkAk7XJ6c2xb2H4EkRz70TJuASGEZsdxq:XHuaxwFXYqTruK5WdXkz6zF2H4hn0Ju/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642762151, "uuid": "beb5013c-c5be-42e4-b40e-93f4970170b7", "value": 187272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642762151, "uuid": "75d5a382-4045-458c-8560-100abb77a1d4", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642762151, "uuid": "28c0e35e-69e2-4069-8d71-191d81506ced", "value": "192857356-045516-sanlccjavap0003-11462.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d2612a0-7ad5-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642781842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642781842, "uuid": "391a90f9-bfce-432b-bfda-e1d126be2fe2", "comment": "Malware payload (Mirai)", "value": "fd0e0fc87de89c140010a3c2afbde039", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642781842, "uuid": "3ca549f1-c705-4e5f-99ea-241395b8e1fc", "comment": "Malware payload (Mirai)", "value": "e7083e428d1123c380edbb5c84921e92b73c8b238734c27c7b3b46ec181c2967", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642781842, "uuid": "701753b9-8b76-46e4-a411-d7feff077df5", "comment": "Malware payload (Mirai)", "value": "7b58ce4554d6a06fb9ba331e570731269f371210", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642781842, "uuid": "9def760b-97a6-4946-b2ad-5c217a6c6832", "comment": "Malware payload (Mirai)", "value": "26eee2d8215f5b352220b927abc5130f4c24647db0b496e5da47f6de5ca602bcb2bbfb0f3eb0fc6696ca2fee54666aa3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642781842, "uuid": "f0994a0d-93e2-4645-8fe7-e59ce8f23414", "value": "T18ED34B46FB418F13C4D617BAF9AF424933229B94E3EB730649285FB43F8666E0E53905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642781842, "uuid": "c41add0f-9fee-4838-ae2e-9e6b2d2a9bb0", "value": "3072:f0DvinprSHrDqtV+zB3RJxQds/neqfasb2mKM/9M/zrr:f0DvinprSHrDe+zJxQds/eqfb2vM/9Mz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642781842, "uuid": "9d788eb8-7904-4930-b27f-e8d5b22f54f7", "value": 134572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642781842, "uuid": "f02fc1ec-2049-4ea8-8e55-926545dce19f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642781842, "uuid": "7fb60ed6-39b4-41d9-9d3a-619b17930468", "value": "fd0e0fc87de89c140010a3c2afbde039", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89d746d6-7adc-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642784816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642784816, "uuid": "8d1278be-fcbc-4640-bc32-46dd8ba8ba28", "comment": "Malware payload (Mirai)", "value": "a6d6fd13d293748f1ae16c095e027af8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642784816, "uuid": "c111c0b5-e270-4072-95d6-6d72fd787b50", "comment": "Malware payload (Mirai)", "value": "ea2d66d3edb26c5ef416c0fc0bf5d483ae29e06b8efb0c388a9e3763ca1e858a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642784816, "uuid": "07b382bb-90fd-4c96-a7b9-bd7e2c3fff08", "comment": "Malware payload (Mirai)", "value": "06da672bd2dfa9fa840b191a726c3e1a56a2ef9a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642784816, "uuid": "920f920f-f277-491a-8a0d-f522a7c36982", "comment": "Malware payload (Mirai)", "value": "4799a0b8aecb49130b43d243a6e8c6acc55f1ce5c9f9b4e3e7f6eaa3dc582aea56db2698079f44843c065876851976aa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642784816, "uuid": "0a2664ae-86ad-4e67-ab16-c658091b01f0", "value": "T10BC2D0DDB32255FCF52CE17187D043A018281E9791A3CA83A865F6C69E858B43CD3FD6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642784816, "uuid": "0866ddae-6bb8-4ff6-b1f2-0c3f09d737c2", "value": "768:0fL3VUtDZqUwj8CpVGSzWHRMjxWFK98JgGlzDpbuR1Jo:0fjVsZqUwPpAiW6joFK90VJuW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642784816, "uuid": "f8f428d1-2b38-4cf8-9e70-712d2a9bf3b9", "value": 26452, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642784816, "uuid": "d4ddc1ee-1dc1-4559-b9dc-a471cd2882ad", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642784816, "uuid": "c74eb92d-be93-45d8-b96e-41fc66e8ebaf", "value": "a6d6fd13d293748f1ae16c095e027af8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8ca7f60-7aa7-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642762132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642762132, "uuid": "f947da4b-092e-4f79-8202-84d224a9b3b8", "comment": "Malware payload", "value": "594d9d91395b17d062d06acd4118fb07", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642762132, "uuid": "8342aa97-f4aa-4058-a442-bfd9c9759d53", "comment": "Malware payload", "value": "ea444236afe9351a13e2d6d4652553c7426e424da8f16cae64026c4413c78a2a", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642762132, "uuid": "27f33ecc-98fc-4734-8467-d6f260e6bc81", "comment": "Malware payload", "value": "500207e36d930794769c9fde2231c15605342168", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642762132, "uuid": "4d1c0385-e4a9-4a37-a4a6-3b4ced951b17", "comment": "Malware payload", "value": "b4466da7819bea2652d3dd79bc95e1433427b95d59e9be2d2c7358d86905db6bf71f6e84809586c8fc0480f6cf5e9cb4", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642762132, "uuid": "4a27fa5f-69ae-466c-a900-3e2dddd38baa", "value": "T1F986F1222A99CA33E57E413494BAC73710A97E941BB150DF63EF59AE09744CE8371F23", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642762132, "uuid": "7e20129c-8c2e-4cca-8107-d68b77f2a363", "value": "196608:SwJDr05D9u53a3EyWd92wMlG8XPoFkCHTq9jarggN8Yi0pWtF13:xJDr05xu5q1Wd9F8PbNargZYi0pWtF13", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642762132, "uuid": "0763aa67-c0f5-43c5-9c51-e9f76c252d4b", "value": 8050176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642762132, "uuid": "bca03e6b-5305-4230-bf48-42eb1db55e0a", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642762132, "uuid": "13a9eec4-1acf-4953-a9cf-ae032fb6230b", "value": "594d9d91395b17d062d06acd4118fb07.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c565c42c-7aad-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642764730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642764730, "uuid": "08762740-ca85-4fd5-bd39-a118476cf057", "comment": "Malware payload (Heodo)", "value": "54aa989d312f82d0feac3e97275cfc97", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642764730, "uuid": "6dd01b81-648c-4345-870c-233ad7cebb87", "comment": "Malware payload (Heodo)", "value": "eaf75086f783f6dd42bd920f9074df4037abf3e8633c13481da5108b0fa4ce94", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642764730, "uuid": "5628393d-d16b-4ff8-a650-1723a85beb29", "comment": "Malware payload (Heodo)", "value": "c5821a0e0a11f2ec3763146d37a9c44f2220741f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642764730, "uuid": "c65c8abd-4b41-4994-ae54-4df8224f5ac1", "comment": "Malware payload (Heodo)", "value": "0e72d8d0b555ac1b9ab20b5253ecdc9ce19b0c5292a493404dea7e5402cf88a83b489fd651d4aee69a0c5e446c59d3d0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642764730, "uuid": "3537d9ac-37d3-46ae-9648-935aa445e327", "value": "T190D4B011B2E2C07AC1AF0175595297A973F9BE90D9FDC247EFC06A4F5E315828B38722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642764730, "uuid": "e638435e-e6d2-4180-82b8-0d4a2363cebd", "value": "24b46ffcf60dc8d39e8124f411ebd08e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642764730, "uuid": "dd49943e-88c0-48c7-a0b7-81f3bff7ba6d", "value": "12288:vClISqMT89ornPmGZtn5yzrDb1ywIdO3D7AfojAxOBnVV0KOFD3EPO7:vmTWornPDryzrVywIdOz7AfOAxsVZOFZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642764730, "uuid": "3422b394-8666-481f-a394-76e3beb069ec", "value": 634880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642764730, "uuid": "f66f72e9-1185-475b-9d9a-a20b4389113b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642764730, "uuid": "b6134ee0-0767-4661-9317-16ecf80d6c7c", "value": "54aa989d312f82d0feac3e97275cfc97", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "575bd2c4-7ac4-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1642774423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642774423, "uuid": "ebf8e95e-9dd7-47fc-9de3-0e9249af405e", "comment": "Malware payload (AgentTesla)", "value": "ea5a49ca8ec978e4d3c7d5da63cf42e9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642774423, "uuid": "ad4a2817-4349-415e-bac2-d72e2b9cd2ce", "comment": "Malware payload (AgentTesla)", "value": "eaf7c4052b5a1c63312618dfe1b407375c651a63f5ee45e50b56082d324a568e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642774423, "uuid": "e68f2440-b207-4e28-afa3-72c8a5e4a12d", "comment": "Malware payload (AgentTesla)", "value": "c0d4341ed19f44401d8a08bccf1c4644d7498c66", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642774423, "uuid": "949576e3-6360-4542-8547-421b96d38591", "comment": "Malware payload (AgentTesla)", "value": "8ab0f1e9ad6b00a6439859493b99ae4c9308ec3033cd1371d5d0420f8e7382ec7dcf78f304e150e024cdf798aecd17ed", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642774423, "uuid": "8267afae-2aa4-444c-ba48-05a2ce6edc71", "value": "T106A423774090F5FD538CBE3D73B9E68BB0F6016A141E332364A29968D2B612FD78146B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642774423, "uuid": "08507457-211e-4752-b4f4-01f179f73493", "value": "12288:XSmhpTnaiyHW7QfpCgsNPu1Xji4Eeq3Uj:XSGxngHW7QfpCgcmljireq3W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642774423, "uuid": "bd82315a-6432-409f-8fdb-fadd6a56a4c0", "value": 490661, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642774423, "uuid": "15d20ee9-0257-4805-99ec-ee7a75f10b9e", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642774423, "uuid": "51c6e643-68fc-4919-ba50-fb8dfee7cec9", "value": "CALCULATION REPORT.pdf.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48b94aa3-7a61-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642731879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642731879, "uuid": "f661ae29-0982-4ca2-97d6-f14211921d80", "comment": "Malware payload (Mirai)", "value": "75797bc071034cc54c68ae81e403096e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642731879, "uuid": "6a4f1cec-0f74-4f4a-ae57-6a8a2eadf2e2", "comment": "Malware payload (Mirai)", "value": "eb1e72903ad912f0b7a2d20587fa4a2714f8adfc67b716c79dbdc781128dfa5b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642731879, "uuid": "77cbc207-1b51-4f7e-aebd-9e0784e0d22e", "comment": "Malware payload (Mirai)", "value": "0a31fec94f3e33c040a27717d3e5bcfb43c97acb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642731879, "uuid": "8bdb355a-643d-4ad9-afa3-0d39faec3ba9", "comment": "Malware payload (Mirai)", "value": "34a99092f234a5db6c92744a96df4aa7e9071a2219aa563e91d7c9d478b0f2c7de96af8847647c92f7f704f79b1e5103", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642731879, "uuid": "590345d5-fca6-4ded-ae8f-d388af0a81fc", "value": "T1E9332A42B22C094BF5E65AF0253F0FE093BFE95024F4B584695EEA468236F731586F8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642731879, "uuid": "c255d252-2f92-4a24-9bf9-cf53292ff150", "value": "768:Sx2Mfcy7pgpC1uwECS5VUhRiogRxA3fgLTW9Ivf3KYHJ2VVFsYuWX2IeTrw:K2zy7qpC1uwJ2OErdgA3KYp21j3XLmw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642731879, "uuid": "766b151c-4fc5-4b62-a0e8-9f3e01f22281", "value": 51396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642731879, "uuid": "58b78085-8a93-4f38-b621-b762eebb0b5b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642731879, "uuid": "8daf7721-d65b-462a-90e4-d5f98c501ede", "value": "75797bc071034cc54c68ae81e403096e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dee5eb4d-7a6d-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642737285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642737285, "uuid": "1bb4caa1-cd8a-4f75-8901-a874d5b431bf", "comment": "Malware payload", "value": "37ee57627a4f75fc5f986017183009bf", "object_relation": "md5", "Tag": [ { "name": "mansengco778-ddns-net", "colour": "#8B7EA6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642737285, "uuid": "6d8cef16-17dc-4657-a031-a0efcdeef0bd", "comment": "Malware payload", "value": "eb5c817a0476fbe633e95d0316e9411bc5e0a5bbd55a395d5c12e1df6123f0bf", "object_relation": "sha256", "Tag": [ { "name": "mansengco778-ddns-net", "colour": "#8B7EA6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642737285, "uuid": "57d33a78-1a95-46c1-916a-f323a7d54ae3", "comment": "Malware payload", "value": "766c4714d4da6d4eb8099ddf54e48b9da3c90cd9", "object_relation": "sha1", "Tag": [ { "name": "mansengco778-ddns-net", "colour": "#8B7EA6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642737285, "uuid": "beff8fdb-782b-402d-a4e1-4a8bfd5aaa2c", "comment": "Malware payload", "value": "b8cdc4b72acbf06ad6c6c5219e9bf90647e8c953c87c335d53e01b4a8774e5ffe0eef5a1bb8063ceb47deab0832ea686", "object_relation": "sha3-384", "Tag": [ { "name": "mansengco778-ddns-net", "colour": "#8B7EA6", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642737285, "uuid": "762a85d5-ce78-4d3d-a16a-eacc9758fc19", "value": "T11C7423B944756B36047977334BB2DF1A25108CEB63C6CA49606C69719C923B5CC33FAB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642737285, "uuid": "d4d66b6a-f5b7-4db4-bc7d-66646a20da72", "value": "6144:AngWHpEDQCEPLav0Hboe+q6HvVN/y0jqqjfV/+0WWKCrVsnNiH8Ma:AnZpQTwb4vVN/y2qwfV/Xc4VecH8Ma", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642737285, "uuid": "c64850d2-3093-4bf7-be5b-3866ef5d6fc8", "value": 339756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642737285, "uuid": "aac06696-0df7-4a68-8d16-56aa735f6a8c", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642737285, "uuid": "a406364c-f92b-47e9-8dfc-df516f5074d3", "value": "cb.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cca1eee5-7aad-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642764742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642764742, "uuid": "b0b06ed2-e199-437b-9854-0783728ac17c", "comment": "Malware payload (Heodo)", "value": "cfe188eca5dac89fac92a3220503060f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642764742, "uuid": "6db157ef-7ccf-4cd8-a099-0c907ef6182a", "comment": "Malware payload (Heodo)", "value": "ec2343285a8e12a63e4af4cd102b29df3b8badc1d1ab28eaf8dc2ea26de91c03", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642764742, "uuid": "cfc53777-bf2c-4feb-9fb4-9dfa77714cdb", "comment": "Malware payload (Heodo)", "value": "b1d2d1613cfadcbae3471b45df67440524829546", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642764742, "uuid": "117506d6-4a4c-4475-9693-580e2cf45fd9", "comment": "Malware payload (Heodo)", "value": "c64c7075107f91fa0030c45ac3b2fe37eeb89714859f66ac4abd53b159e38a9d6e49dfcf8af6c5e08b0ddd9d12e0b975", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642764742, "uuid": "cfe4c0c4-c950-4b9c-85a7-4c1ba094a229", "value": "T165D4B011B2E2C07AC1AF0175595297A973F9BE90D9FDC247EFC06A4F5E315828B38722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642764742, "uuid": "82d85a72-7f76-450a-9767-59f7450cb719", "value": "24b46ffcf60dc8d39e8124f411ebd08e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642764742, "uuid": "d62bd129-72dd-41c9-91ee-9ae02320ce51", "value": "12288:vClISqMT89ornPmGZtn5yzrD/1ywIdO3D7AfojAxOBnVV0KOFD3EPO7:vmTWornPDryzrZywIdOz7AfOAxsVZOFZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642764742, "uuid": "630afdeb-6c10-422f-920a-9942bc934bc6", "value": 634880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642764742, "uuid": "1bc16919-64bc-4673-a954-d2ee0e35da73", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642764742, "uuid": "cc499ce8-0088-4a84-aeeb-7c8b5ec5a45d", "value": "cfe188eca5dac89fac92a3220503060f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae627b7e-7ad5-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642781871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642781871, "uuid": "a15a68df-9252-45ff-b011-43bfe7d80e9b", "comment": "Malware payload (Mirai)", "value": "023b256e0ebf30e34d160a26ac51a022", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642781871, "uuid": "7cc0b45f-daae-4644-af7b-c97b459e7b58", "comment": "Malware payload (Mirai)", "value": "ec48d17261c18890880370cc3ba1142aa5dc9841cc9901f37dbc346b958aa3e4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642781871, "uuid": "af8cc6da-53e1-4258-bf3c-3e01225b6995", "comment": "Malware payload (Mirai)", "value": "80fa5b8086bb5b6fb14bc1b45d9f1ac3724947cc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642781871, "uuid": "bd2408e1-1cef-4a5b-8382-fd352614aa3a", "comment": "Malware payload (Mirai)", "value": "7b9d368c5657d6c71d7a3581d4b68519ea55f38b90a553fdf04d71b4baf1fea0166e3aa5c702280994e786581f0c60ad", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642781871, "uuid": "a3bcb58e-c712-497c-9328-9d9676cb83b5", "value": "T1F1535A21BDBA2A27C0D0A57A61FB8765B5F503CE26A4CA1E3D720F4EFF215401603AF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642781871, "uuid": "d1a722b8-2513-48e1-bd65-f04359e950ec", "value": "768:QroKQQs8sVWgdDZweJ6ls0m7hCGa0irtLeArpFpcVqO+A7gnCgN:QrcQnsVWgdDZwm4FC/a0i4ZV4ANe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642781871, "uuid": "eadb57e7-70ed-469b-b63b-ec0dd9a75847", "value": 63936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642781871, "uuid": "e37aa5d7-2b0a-4650-be21-d2806d652e10", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642781871, "uuid": "2c1822e6-8cc3-4c83-879c-3ee1ffb33315", "value": "023b256e0ebf30e34d160a26ac51a022", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80dd4e46-7a9e-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642758172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642758172, "uuid": "03e7146b-1302-448b-940f-40fe91e6c55d", "comment": "Malware payload (Mirai)", "value": "63fb6d4b3b7dc1b2a1e9610862f80020", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642758172, "uuid": "b3d3c9c4-96f5-4a04-b7ba-e6ba97323d5a", "comment": "Malware payload (Mirai)", "value": "ece724b8cd03d0f60b9f80a7bc94c271049d38e3e4493e37b5f0ffff0af56c4f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642758172, "uuid": "ef1bbb8d-d842-4d57-b46d-f7252f5dea0a", "comment": "Malware payload (Mirai)", "value": "b0c0221b4e7ad1747227dacd93d8711231c6b964", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642758172, "uuid": "196c3787-776e-4275-8aa1-4d45c2e24d68", "comment": "Malware payload (Mirai)", "value": "845f7a5c96f95075700688c08b6bec813d5301691f5147718293712a6f2d4c5e1085b6d8b7998c561accb2517d2ea180", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642758172, "uuid": "726dc031-45f0-436c-bc1c-0bbe29d806a8", "value": "T12B539309BF650FB7ECABDC3709A9170524CC641B21A97B39B934D818F64B25B09F38A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642758172, "uuid": "40b323c4-e832-4a35-9b82-6ff9507b679e", "value": "768:7cxLkY4rZd0cx12hOPKfxSlA/el58XeOegEeDNzH6Za5EXiCQrblb9WnzCo:7chkY4tdKoKSGLdE0NzaZa5hbtE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642758172, "uuid": "e9f46841-e239-42ee-84ad-2ed62367e17e", "value": 64588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642758172, "uuid": "f83471d2-777a-4df6-a4d7-3d9d5c4709e0", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642758172, "uuid": "9bc7546f-0417-40d5-a30d-da0a99177b8b", "value": "63fb6d4b3b7dc1b2a1e9610862f80020", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f37ef42e-7aeb-11ec-9275-42010a9c0029", "comment": "Malware payload (Numando)", "timestamp": 1642791436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642791436, "uuid": "492b799f-f6e3-4090-bded-2d144221d44b", "comment": "Malware payload (Numando)", "value": "183488f2431369df867a5cab7421b44f", "object_relation": "md5", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Numando", "colour": "#FECD22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642791436, "uuid": "e4152d1b-053c-4b0f-91bd-b0ff1c1a106f", "comment": "Malware payload (Numando)", "value": "ee75f3b76903886f1a333afd9d8b882020e51b5960d480f1afb0424c4264dfe3", "object_relation": "sha256", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Numando", "colour": "#FECD22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642791436, "uuid": "a9f8379f-feb0-4d5e-96a4-a5fbf29302f8", "comment": "Malware payload (Numando)", "value": "9b85a4768cde20300dca9ffb44861e2643ec24f5", "object_relation": "sha1", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Numando", "colour": "#FECD22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642791436, "uuid": "82cc2362-6e29-4ce4-816b-9758ff793da4", "comment": "Malware payload (Numando)", "value": "120dff40a02369ddfd8316e42962f9ba83e05254e7fa518d7c6242a619aa0ea3499e5df2427fd860d24884dcd578ca6c", "object_relation": "sha3-384", "Tag": [ { "name": "banker", "colour": "#5CE45B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Numando", "colour": "#FECD22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642791436, "uuid": "a3c64bcc-1b3c-41c2-b7d6-e68a196eb388", "value": "T1C8D5230676C81B73D4AF0670A28BC326D676DCB49161892B539F0A0D2DF39B4A7B33D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642791436, "uuid": "e3927704-c361-41f8-af3e-429e50bcaf2a", "value": "49152:I+HuY5AzbNFIjKFiguez7buCnIrgmzu6kKWtMpL58ALkdyEKxSnzKxf5j2FVZzCp:SY5AzbNAKFpu27Cbrg+kKWYF8/yEQSYv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642791436, "uuid": "0cad72d2-1aac-4065-935e-e106307edaf5", "value": 2862080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642791436, "uuid": "219e3926-8edb-4239-a30a-50a739d01cd8", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642791436, "uuid": "70cf74e2-4408-4476-9e56-b19b28da58bf", "value": "1.UGMBYCILQI\u00dc.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d3e9b78-7ad9-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642783560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642783560, "uuid": "55ff2183-9aea-44fd-a92a-14348861bfc5", "comment": "Malware payload", "value": "234bb12b638a7e1e12c2e5ae5f354384", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642783560, "uuid": "34ee6f50-c1aa-4c25-aa74-5369dd1e1732", "comment": "Malware payload", "value": "f0fbe1cdfc76a0483a6487b452c0836e8c55a7a7679d82db519594a3af67a7d3", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642783560, "uuid": "f7a583a4-b2db-4c54-8bd6-036fbba02922", "comment": "Malware payload", "value": "f1640f3eb5678d725d10f852a09c0aa01c5e75ad", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642783560, "uuid": "4cf65f64-787c-4686-8dad-ce77428f58c9", "comment": "Malware payload", "value": "72efc52a572de159a24720e63b30cd1eec60e8b8dca13426600fe3b6bf5508b4f718331d7b92edafce12246e9023b8e2", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642783560, "uuid": "a8fd1142-3444-4ee4-8147-1319853ae551", "value": "T14E44226B4F034D17EB5344F1101243336CFDBC6C5E889253E5AE8DA24DFE934D8A6AA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642783560, "uuid": "087c4c9d-83f4-46eb-b8b2-e0510346e6e7", "value": "6144:Y8yYw66TyQ93dAQJsa+j9sSkOsOeC7YSAbEgOwqN/O6HFCjQN9X:Y87nshW8SzlgXssjU9X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642783560, "uuid": "a8276159-1c94-4a0b-9a10-caaa1a32cd15", "value": 260983, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642783560, "uuid": "8cec3657-d271-4cc7-921b-6447ae396cc0", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642783560, "uuid": "04bcc0e1-f505-42d8-972c-57e0e7a67035", "value": "psk.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f9f7e08-7ad6-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1642782249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642782249, "uuid": "2a1095a6-2ef0-466d-b972-536922f1fa5d", "comment": "Malware payload (AgentTesla)", "value": "d75b7fc5268996284370b0059cb1f5c9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642782249, "uuid": "8431452a-6de4-4d06-8c12-f88370585d2c", "comment": "Malware payload (AgentTesla)", "value": "f2c6a57690440bb544bc9d083daf77fd62abe9b0c1840e89e44af5ffd9311e70", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642782249, "uuid": "f6335054-b458-4afc-b0b8-cf013af78da2", "comment": "Malware payload (AgentTesla)", "value": "10ff440e48271a3c662250cbc30215dc78125fd3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642782249, "uuid": "a1d08b10-d324-4142-ad21-e9284379b102", "comment": "Malware payload (AgentTesla)", "value": "d50ac1f2fa89424fb2f8246930423c45459f3ba96984c11737d9559c604b02135e06a8c10b4d1d7e2a898310508d2deb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642782249, "uuid": "9a4337a2-f57e-421e-b29a-451fad104542", "value": "T17C15089D325071EFC867C972CEA81C64EB61747A971BC207901311AEAE0DA97DF246F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642782249, "uuid": "0b630e61-2c80-4dac-b542-046ab8695366", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642782249, "uuid": "dbef4bfc-0f3f-4c42-ade0-09f1853d78b8", "value": "12288:sswM9oYdurZUvz63rl2H1H6g6P/NfYNJgyV46rpQcq6+i9vYFbbIBQViVq86Nn5e:sKdKZqkBMV6g6P9YX9rpQH6+i9vYFb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642782249, "uuid": "de35b5d5-1dd9-464f-a064-7a70c47d8405", "value": 894976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642782249, "uuid": "1b0c7b7e-a0b3-4c9d-a9ad-c50c87de0dfc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642782249, "uuid": "9f9b1228-b4d2-4395-ad0a-8acbed721bb3", "value": "Invoice_DDT N. 201 LGM47436.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a85ffcc9-7aa0-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642759097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642759097, "uuid": "74b198b4-8c81-4da9-b0e4-4ac6639fad53", "comment": "Malware payload", "value": "b7426ee8dac9bb391ada8073d2cbbd62", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642759097, "uuid": "a239e83c-377e-44c2-9fc0-8594db0ea17c", "comment": "Malware payload", "value": "f336327e4dbb0c1f764d3a92e479be82b327560766bf8283f5b7121cc4cd1bce", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642759097, "uuid": "d10b6343-0aef-4594-a7db-c861737beda2", "comment": "Malware payload", "value": "2f5fa647daeeecdfd0abb493e3fde2ceaf2c8129", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642759097, "uuid": "a3309983-2b06-46c3-b472-ec58b61c9914", "comment": "Malware payload", "value": "fdee9ff28f31e1f2bd617a58bfbc9eaa693cd20f7e97aecc18c8d76310c615d67e9adf136591fddbfff0087627bba236", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642759097, "uuid": "bbd5dc97-29ba-40f6-8058-46b74ee75893", "value": "T13C65104C4436D09DE1BF2D4D6EFB844A87A0AEE92045C3E8463C34690BDFE39D4669DE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642759097, "uuid": "94804d10-4019-4fa8-b184-678538d660f9", "value": "1536:x64TAiMZNU2pCOVdYfJa2XnEM/nO+NFPykzI1QXYOI1BFVLpKJC0rHA2xUtbTPcU:u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642759097, "uuid": "ec9df5d2-dfc9-4a73-b128-3b4577f7a60f", "value": 1476995, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642759097, "uuid": "f446e7d5-a9be-432a-8a3c-668c556710be", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642759097, "uuid": "0a03f7e5-b892-4092-ab29-23604184eccc", "value": "aggah.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e83f47a7-7a8d-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642751044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642751044, "uuid": "bc31c054-0734-4b7d-8617-91d332aafb02", "comment": "Malware payload (Mirai)", "value": "bde132f101c5cda9426939a0f606d0cd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642751044, "uuid": "c038d680-034e-49ed-9fbc-23a346939e75", "comment": "Malware payload (Mirai)", "value": "f3d92e0005676f745e665816cf86fd05c644be022af617ce9eb3ea505dddb20a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642751044, "uuid": "d97aa609-b8d6-4104-8571-374de83751e1", "comment": "Malware payload (Mirai)", "value": "60a75a51aa133d9a909400a37ad50c91b4efaeec", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642751044, "uuid": "746c0866-15b0-43f8-a94e-fb7c14eeca00", "comment": "Malware payload (Mirai)", "value": "6480d399855e731bd95f8062e1271deaa9d006e93fd715aa8c0f42e2b10356b14806d4657f1f1fe256274d474eacf6eb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642751044, "uuid": "3ff8d092-4bb2-4877-aad0-fec478219d36", "value": "T1E2635A9AE152C9F1D91780B0222ADB79EB75ED332420CD2FE7D47E76E870A42D24531E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642751044, "uuid": "f375d434-c1cc-49b0-8fd7-1301d3bfd491", "value": "1536:XD9iMfwR6O30UgVt1rguwZCyUr31c/ijBRBr:XpbwiV7rK0ikD1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642751044, "uuid": "51f9be65-e32e-4038-a87d-c37f22bf8cde", "value": 67644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642751044, "uuid": "64c0e4d4-5caf-47aa-9e5c-e72d752a7187", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642751044, "uuid": "549cb2bd-8b27-4f78-a470-9ecf11172973", "value": "bde132f101c5cda9426939a0f606d0cd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b7175fa-7aac-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642764203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642764203, "uuid": "1593ea16-50c8-402a-a1ad-0159bf441616", "comment": "Malware payload", "value": "83f869bc596a8b5ecc565df36c9a3a59", "object_relation": "md5", "Tag": [ { "name": "193-201-9-212", "colour": "#5EC393", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642764203, "uuid": "38b08ef0-adc8-4906-a944-0d4f4c973c25", "comment": "Malware payload", "value": "f3eb5db9372c6911705101b49f9defa0ed61de3d4af922a23164b1ad28cc5f91", "object_relation": "sha256", "Tag": [ { "name": "193-201-9-212", "colour": "#5EC393", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642764203, "uuid": "0e01b74e-d19f-47c5-90db-0ac5e80f59c8", "comment": "Malware payload", "value": "664f309ae63d5c91e0cefe4149f886ac3eba6099", "object_relation": "sha1", "Tag": [ { "name": "193-201-9-212", "colour": "#5EC393", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642764203, "uuid": "cab8c8a4-d734-4341-bce2-9a7bd7cbaab8", "comment": "Malware payload", "value": "0e63ec45a9ac126867caf5849894e6e880dd8f651cfe59dcb1aa1d1c6887917a0244e4f3c9a67299f993b181a20c687a", "object_relation": "sha3-384", "Tag": [ { "name": "193-201-9-212", "colour": "#5EC393", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642764203, "uuid": "db4ffcb9-be19-440c-8cf5-16590b7bf480", "value": "T10F732A03B5D28471E47619310875CAA05A2FFE215E65DEBB3388123E8F341E19E36E7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642764203, "uuid": "37f360f9-ecbe-42ff-a25b-5af72e20822e", "value": "41997a901b72a7e99ec7f548d3be2bf8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642764203, "uuid": "63cd3b08-9b0c-4069-83f9-01fd76d7d3d2", "value": "1536:1Y4s5x9mGaXX9nt8D4R6R22rMyBvnZR21YJqFCsWgcd7iwxOBzhN:G95aXX9tu40wEMivni1oqFK7JxOBzX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642764203, "uuid": "983cb7d8-eba7-45c0-9293-900c210f75d0", "value": 77824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642764203, "uuid": "0dbaccf1-6fdf-4e56-8cec-21d0c7396bd6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642764203, "uuid": "8ef9010a-ccf3-404e-91e0-ed1d2a825c9f", "value": "payload_x86_58711_rc4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d96e91ec-7add-11ec-9275-42010a9c0029", "comment": "Malware payload (Hydra)", "timestamp": 1642785379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642785379, "uuid": "ff061ff8-63f1-4bfd-b718-d54d96a74f48", "comment": "Malware payload (Hydra)", "value": "3c34283a5d814f161cb9478decfbcf24", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642785379, "uuid": "3d7cfc68-7946-43a9-9f14-821966e70e2c", "comment": "Malware payload (Hydra)", "value": "f46f1cfa313cdfacd0bb26a070d16f866d2f88c5e62da386966a921556024a48", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642785379, "uuid": "1a8776a0-a9d4-4ce1-a038-6ba121745146", "comment": "Malware payload (Hydra)", "value": "071268de04cb1247c53ee24b3c7f1ddf4c8531cc", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642785379, "uuid": "506dd63e-cc07-4b19-a9c8-250804200896", "comment": "Malware payload (Hydra)", "value": "292eba2136edb8137b0ab98b5ad1376b336918d38dcf0be719fe38579571a433f286682be7248fcf8de57a714c04e852", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642785379, "uuid": "01ea7d62-2e87-402e-97ca-6b3ba3fc017a", "value": "T1998633297E809405EC6E5E36CCA1E14860175EE14753941A6F123637CEBBB998BC38FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642785379, "uuid": "0e3c0672-3b00-4faf-8a36-e52083f13c3b", "value": "196608:xiJ5QjgdEfIyAOg2YvwYThFZDxfof6G+8rMhCyNq:MJ5QSEyVJxD9o6PC2q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642785379, "uuid": "acfdb11f-6ca2-4e60-97e7-5cc595921379", "value": 7991016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642785379, "uuid": "29ece48d-0353-4dce-a532-4571987af01e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642785379, "uuid": "65c26974-1af2-4fda-9ef4-33573216b9e9", "value": "coba.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2c3d6d0-7aa7-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1642762175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642762175, "uuid": "c6a64676-3e5e-4628-ac9e-6dd573aced40", "comment": "Malware payload (Formbook)", "value": "c753d57816e63a5e6b8988348ed388fa", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642762175, "uuid": "2f015e69-279f-4f59-9c56-f0a8034f59d4", "comment": "Malware payload (Formbook)", "value": "f4b0cf120fe5ea6a747fd92a0eaff6997ebdbf24a6e234d37e13a9afdb9ac4d6", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642762175, "uuid": "db08dc74-2480-4ff1-8320-1267b8b7a931", "comment": "Malware payload (Formbook)", "value": "bc360c1e5388a157ce54e11231ea6cce2d0c6e7f", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642762175, "uuid": "479f349f-059f-4e3f-b1ca-0e51fdf6681b", "comment": "Malware payload (Formbook)", "value": "8cf84133821e8371e3a0f073f1b6f394b5c4ac05ca629b55dd83629c63d97abf0f6960fc56ec126c581dd8ef380c2928", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642762175, "uuid": "923c3ff8-ce52-46d9-aed4-5786b805a407", "value": "T1490402983DE2FBD3D0659A7D4C4C482CA235DC929514EA737C26F30A723299790B939F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642762175, "uuid": "cefc1db8-c52b-4c51-839c-73ee501e1bdc", "value": "3072:RKa3eX2t+UHpUI96HLTnVzMhdVSmK0OSdwqb5DLNV0LY0vi5eSMyUi/srAO0mwcY:Ua3euWI9UVzMhdvKSHl3GjKkG/sTwmq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642762175, "uuid": "729f73d6-c89a-40ec-a6ed-300467741021", "value": 186968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642762175, "uuid": "34e488e3-b70a-49ed-ab5e-7886644d30de", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642762175, "uuid": "d4e6f122-91b4-4302-ab5f-888a8911c044", "value": "Sales contract no SINV-7774.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb88d3a8-7ab8-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1642769518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642769518, "uuid": "7fdfeb4e-8707-46a4-8d90-a3d6a0d64e89", "comment": "Malware payload (AgentTesla)", "value": "e82437934689507ecf93362ef9f4ada9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642769518, "uuid": "4c18cb5f-72d6-4b83-9ccd-c8dae50adc1f", "comment": "Malware payload (AgentTesla)", "value": "f595ec0d00cc7f84b6eab5f191ad27a1ca06a90eef719ed0242d0e0fece43302", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642769518, "uuid": "f8b07565-ccd1-49f8-a603-745e837dcd1a", "comment": "Malware payload (AgentTesla)", "value": "7d25737ecb7f940af115cef6f0c8ff6fb4f380a2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642769518, "uuid": "fbd92be3-e845-497e-ae25-136b6340859b", "comment": "Malware payload (AgentTesla)", "value": "d8705da48c908791e38d7fc55166a2ab3c00ab885a4f5309bc4943aa644e612603e25c5f8b375b80033cea3e12aded6a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642769518, "uuid": "e6dc4ab7-47f7-476d-bd8f-1c3e2da988ac", "value": "T17355DF7721195F99F43F933A576194158BF8E82BE726D2CFBEC4A4D74CA0F06C21182A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642769518, "uuid": "1218b6ae-2bc6-4b98-9edc-791639260ebe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642769518, "uuid": "5d96811e-c18d-49ab-a797-53987a6204d5", "value": "24576:u4bjAJerGlzyR9jYM+iNSubFiekgw0qv+YruWyG:04rG1yLjAub4+7qvaWy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642769518, "uuid": "c8240651-28ba-4416-a618-2ec77c3fb3ab", "value": 1335808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642769518, "uuid": "b6fe9038-9cea-4d83-b90e-a1d2a1fe81f3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642769518, "uuid": "303846d6-4456-46a0-ae38-5e5dfd8150a2", "value": "SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "404db48f-7aa7-11ec-9275-42010a9c0029", "comment": "Malware payload (CoinMiner)", "timestamp": 1642761929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642761929, "uuid": "cf9ab177-99a6-43c8-b95f-396553dfb212", "comment": "Malware payload (CoinMiner)", "value": "c97b49cb79150162f6b00beed5a11d9e", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642761929, "uuid": "3bcff641-9ff0-47bd-8ecd-25c4a24819da", "comment": "Malware payload (CoinMiner)", "value": "f63f90decc7d763f3c5202c7a4c643aeb99fd1d85ca97d64bf77fc1cc733f9f9", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642761929, "uuid": "7b0753ad-b821-4f7b-b412-fc81ad938d8f", "comment": "Malware payload (CoinMiner)", "value": "2a225333ef5ff94ddd350bd02032e6b0d1de5859", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642761929, "uuid": "c361bbfb-fbd8-4f0d-9955-819be1c58afd", "comment": "Malware payload (CoinMiner)", "value": "c294418df05442f59603deaa0610364cbe2d7cacf55528d5cfc46fd278d115e98e4518ea4013452d43b4a49b1e9d683e", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642761929, "uuid": "38dceb6d-0fb8-4db2-ba10-d8a1c0e68ea7", "value": "T19276330063F808EEF4BBC638C6668221A0B2B46B9755D5DF17BC439A9F975D35E73A00", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642761929, "uuid": "2701b9b9-4376-4fd7-ae41-0a87dfd5f403", "value": "c5640c7a22008f949f9bc94a27623f95", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642761929, "uuid": "8a0a52a8-e3a4-491c-995e-797d86d63472", "value": "196608:8w+hvICteEroXxqENE+sKsXXgvkeM7A6ADMCXMND6:sInEroXjsKkXgseu0DYNu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642761929, "uuid": "73a6a548-2da1-4b26-b9a5-58d8ecca3ba0", "value": 7336893, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642761929, "uuid": "0e83c428-519e-476f-b9b7-1e3e6b327ffc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642761929, "uuid": "ab9f4946-c046-4115-a6af-4e74e568c596", "value": "c97b49cb79150162f6b00beed5a11d9e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc2c603a-7a9b-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642756983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642756983, "uuid": "99372191-be90-4702-ad8f-38900a71e9cf", "comment": "Malware payload", "value": "06352504ab75bf1e4eff60c4ce8fe0f2", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642756983, "uuid": "54b1a42a-0143-4f72-bbb3-df9294c43394", "comment": "Malware payload", "value": "f692a6486fa1c8917ae6059006e9309eeb2c3341a26486ae2a6572d02a877f4c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642756983, "uuid": "3ad1e86b-ad31-4ce1-bf65-7a59abce34b4", "comment": "Malware payload", "value": "a5f58e9940f1e130f60297b9d374d1880e58ee19", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642756983, "uuid": "dcf156a2-f1c2-4b1f-8629-3f6df0a555aa", "comment": "Malware payload", "value": "9b3a24749386f5777a6a24bfae717bab66b9cdee9edada8a8a6ee9178d1f2e67b3d44e451876c7ba12b82ed137d0d955", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642756983, "uuid": "70d045ef-69a3-4602-9520-2be6538a69cb", "value": "T1C181DA6A351CDB4BC44D667C4F19CDFC6960BC99EE02D8A7F104335E047939CE8958DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642756983, "uuid": "a472919b-c5a0-4007-a301-e4a35afaeded", "value": "24:ryPW08c5tYzpK1Z5w20DGjvDk4YzvkrPXErWo/I1r4NMhz92PtEy1+3ptl/K0vkb:ryPWg+pWjD7DkpvOiYt9Yl/0MR6F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642756983, "uuid": "5fd87994-c469-44c4-a1e6-6cb86fd33cf6", "value": 4096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642756983, "uuid": "8f34839b-6bd7-41a8-841d-f950525a96be", "value": "application/CDFV2", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642756983, "uuid": "2faa7e51-9163-4bb7-b824-1a842f627298", "value": "SecuriteInfo.com.Exploit.CVE-2018-0798.4.31715.30243", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9162f57a-7aac-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642764213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642764213, "uuid": "a9f9ddd3-739b-48c8-a6e2-60cd1c22ff77", "comment": "Malware payload", "value": "9ee23bf01be43f428fe832ae4cbfe81e", "object_relation": "md5", "Tag": [ { "name": "193-201-9-212", "colour": "#5EC393", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642764213, "uuid": "ff9089b0-6f64-4fcb-98a9-5f650b074989", "comment": "Malware payload", "value": "f764d5514f356016a48f87911dc41ba77706527c90263c9edb925dcab757c156", "object_relation": "sha256", "Tag": [ { "name": "193-201-9-212", "colour": "#5EC393", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642764213, "uuid": "915f1875-77d8-4f93-9956-565976fcd007", "comment": "Malware payload", "value": "5be376ce34326da382c55fa7fb07f7abe5c5660e", "object_relation": "sha1", "Tag": [ { "name": "193-201-9-212", "colour": "#5EC393", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642764213, "uuid": "9fc5e6b5-703b-4fd3-a4e0-d56f423cc4aa", "comment": "Malware payload", "value": "ae73aa70945e323db38cf318c5e441f21ed81a94515d5c21c5c9a02a6c21aedc7e276269020d653275be6d52fc7e56f6", "object_relation": "sha3-384", "Tag": [ { "name": "193-201-9-212", "colour": "#5EC393", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642764213, "uuid": "f2779b92-1b04-474e-9578-44249d07bff4", "value": "T123A35B6773F530F9E072823988A11905E772F83227219FAF4764465A1F633918E3AF79", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642764213, "uuid": "cbdfbe93-08ee-4d92-a685-3d63034b1ffd", "value": "0eab9f536638a1be80b24788818cc5a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642764213, "uuid": "f3cbb5b8-9161-4c84-ac3e-3a6bea68cf8f", "value": "1536:LnGvEQ+OSdHb7c5HTNESxF78vfdd8TsSQqjsWwd09dlRM8FOVrqstjxi:LGvEQUVnc5i0F4vfd4Q1MXLOLFi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642764213, "uuid": "fc1c0301-8a58-4895-a7ca-7f1f42ebee99", "value": 99328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642764213, "uuid": "8182bbab-3156-4f74-a577-d95055039a65", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642764213, "uuid": "01a48712-fe7e-440b-961e-077a26f8c00e", "value": "payload_x64_57119_rc4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4d5699c-7aa3-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1642760461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642760461, "uuid": "7ca7cad4-bf8b-46b1-b786-879d5820ae61", "comment": "Malware payload (AgentTesla)", "value": "053e2f0c336003014f67b71f3fb178e8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642760461, "uuid": "6e83cbd3-ddfc-4938-8344-a52d4719867c", "comment": "Malware payload (AgentTesla)", "value": "f7a69557063abaa6a5ad2438ebeea38e92f111848b50ff1b29d36b0fd8ffd2a3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642760461, "uuid": "e8d01ebb-15b0-4e3c-baa1-1e77bfa2f1dd", "comment": "Malware payload (AgentTesla)", "value": "3fd013bc8728cb62e8e5340fc50a87fbd6cc93f2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642760461, "uuid": "092ed033-3ab2-4b4e-a1a6-614bf13a6a97", "comment": "Malware payload (AgentTesla)", "value": "422ac67fdb21890535a681fca1a07c2c2c22db8847b7d4f59d21ebcbdd02b8bae3fa9884f0a83b013339779fa3c97543", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642760461, "uuid": "5782d438-44c4-4a86-bbe0-7c818c2d3cec", "value": "T156E4DF0132F88B45D8BE8BFA8836109017BEB94AA835E75F5DC1B1DF0CB1B819766753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642760461, "uuid": "4376ce02-781e-4f84-9240-6614683e0f89", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642760461, "uuid": "762ae33a-5ca4-497a-a860-ee37555f05c5", "value": "12288:Hx0+li0GsAyoCWhESu7en7lx49nHlUAsbyzpQcq6+ievYF:3GsAuQp2n9vpQH6+ievYF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642760461, "uuid": "06a830c9-ab5f-44b1-99ce-1944d81b9d3f", "value": 720896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642760461, "uuid": "8d9f71f7-a1cb-4916-8231-9f3f2a33080a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642760461, "uuid": "abad98c2-a49c-4994-9a3c-0a6cd53bf27b", "value": "CALCULATION REPORT.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c9d8f0e-7a61-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642731885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642731885, "uuid": "24a6ed15-22d2-4cda-80d1-2272e195558f", "comment": "Malware payload (Mirai)", "value": "44a89b393c226c783f95c0abce819900", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642731885, "uuid": "13372e13-3244-4338-a706-97ef87467e57", "comment": "Malware payload (Mirai)", "value": "f7fdd2b7ffaefc898d60c8cb731cdc8457b3d0020861ddc0b1a6b0619821cd37", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642731885, "uuid": "0cf504ff-ca7b-4ae5-8758-09ad30d16ff7", "comment": "Malware payload (Mirai)", "value": "c78cfacfd4c573ac776e5419063a18d078d47287", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642731885, "uuid": "4953654c-f691-4f36-aead-670e0f2c0f94", "comment": "Malware payload (Mirai)", "value": "6aa27fb807ba762d7c041f78cc577c6de515e278ec0e9584fea2fdc5751dc78c47ba3b70a70f94652e0308dec755ef0b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642731885, "uuid": "ce6ffb7e-b8db-43c6-b452-c69d621f2842", "value": "T1A053098678819A25C6D513BBFE1F018E3316576CE2DE73129D141F607BCB91F0E2BA0A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642731885, "uuid": "d895d5e1-d4f2-4069-b0d7-7ab6d715e888", "value": "1536:wdnqIa3HsFX+VqCIScAFzVLx1kHzy0sLpISi7MzuKWV:M8HUOVq3uhLxUlMzuKWV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642731885, "uuid": "4ac76709-a104-4901-b74c-419ffeffddf7", "value": 66688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642731885, "uuid": "ebe20680-8d21-49e2-8116-9d5aff94193e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642731885, "uuid": "cfb7c5dd-bc85-434e-a929-b26680b8d8de", "value": "44a89b393c226c783f95c0abce819900", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6657959-7aab-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642763953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642763953, "uuid": "2309fa62-85cd-48cc-9ff6-732448277a9d", "comment": "Malware payload (Heodo)", "value": "0f20fd5c4a790140803ef236d5dac136", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642763953, "uuid": "ab80adf1-13c8-4738-b091-3d68800f62d3", "comment": "Malware payload (Heodo)", "value": "f87d86b785eb094cafe192a948a1847cfe0aa531b7390ce529c51241c5e2ca7e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642763953, "uuid": "82f773fb-c8b9-4a97-ac92-3de4ace85277", "comment": "Malware payload (Heodo)", "value": "acc25cc9f50dba01f902befb3bca6a2744fcedde", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642763953, "uuid": "7e53bfbf-20a6-46ad-a49a-d017fea1c7b8", "comment": "Malware payload (Heodo)", "value": "f5cce839e4cef06f74c5ebae4885de8ed39ae0dc258608fe9ed36a4f32cb15b2b8e5672f2251d3a3477361663747ff2d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642763953, "uuid": "73bee6a2-5bca-41c5-907f-8023565a4be9", "value": "T1B9D4C002B291C035D5BF11B44E666B18A2EDFE905B3985C7D3C87A5F2F31BC2A635B06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642763953, "uuid": "cbafd45a-4f9b-43ca-98bb-36545cc6ddc8", "value": "42bfc936e90bcc6f5b01541917ef37a4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642763953, "uuid": "6d8952f8-85e5-4173-a7a1-dba831ab5c77", "value": "12288:hF8kySLmsbWV5WlvAuyfEgXkvPLEbs2gu1D0iv+9Ne1tGBkkQxCej+6IvUDEPwqh:wMmiWV5W5AuyfEgXkvPLEbsGDIfrLQxQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642763953, "uuid": "fbee7bbc-b85c-432d-a07c-497942f8099f", "value": 651264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642763953, "uuid": "f872f757-6a82-46cd-a4be-c833bd6323db", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642763953, "uuid": "29bfde0e-bc7a-4998-87a6-3c53535520ff", "value": "0f20fd5c4a790140803ef236d5dac136", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05aef458-7acf-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642779011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642779011, "uuid": "55ea2935-cc6b-4eb2-8703-30c01a172662", "comment": "Malware payload (Heodo)", "value": "d605c424ec605efd07423d482a0e901a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642779011, "uuid": "af0303a0-a46c-48b4-ac1e-1ebe1ca541d7", "comment": "Malware payload (Heodo)", "value": "f8a7fa06c1bdb971ebef431f103de5ac541d381c716c6328d860cf2bf33b50ae", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642779011, "uuid": "495281a2-9e79-4642-975c-aab3e07fdfb3", "comment": "Malware payload (Heodo)", "value": "3965611fe24d4e64538019a91851be12311fb064", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642779011, "uuid": "5eb3d538-33c0-41a0-bf3d-462a4fde9de7", "comment": "Malware payload (Heodo)", "value": "c8280f5d905a8c614f75002db5cbfdd80dbd27c766fd94cc87dfc6890098aa8ffd1193d4eaf8cfd9c30e829f5ea2c2ab", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642779011, "uuid": "8fc66c4f-3c45-4014-9375-c6d4b2bd146e", "value": "T192D4BF11B2D2C07AC1AF1674596393A463F9BE90DAF9C257FFC06A4F1E315828B39712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642779011, "uuid": "943cc713-c558-4c2c-92c8-ca61b1b89fe7", "value": "24b46ffcf60dc8d39e8124f411ebd08e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642779011, "uuid": "0bf2398d-731f-46f2-a78b-9c94685cd23e", "value": "12288:kqdJaxkOWFornPmGZqnTFWbDWUYVubhesslBvQqEPO7:kOOsornPTwFWbnYVohevBoi7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642779011, "uuid": "87a42aae-fa51-4980-bc04-01ecee60d929", "value": 626688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642779011, "uuid": "8819ff8c-62ae-43a9-9a95-5075001be179", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642779011, "uuid": "dc6f6591-5153-4c44-999f-e741e117efa2", "value": "d605c424ec605efd07423d482a0e901a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c173100-7ac6-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1642775398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775398, "uuid": "2152b73e-1c4b-4eb4-81c5-435172ef6aeb", "comment": "Malware payload (AgentTesla)", "value": "0486a3f7fafadc1679f38a9c9583fde5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775398, "uuid": "633d73e1-b8f8-40f8-bea7-b08152aad672", "comment": "Malware payload (AgentTesla)", "value": "f8ae495307add7bcfc2df711bb0a2be64573ec3bed11b610e6eb13ef0996c8ee", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775398, "uuid": "27d8c9ac-4682-4341-90d0-34ca72d61d7d", "comment": "Malware payload (AgentTesla)", "value": "a6f27a0556fa4dd98b982489b5be8dfe295dc8c2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775398, "uuid": "45895ff4-6f7d-4d0f-8674-67e93efd32c1", "comment": "Malware payload (AgentTesla)", "value": "6906d0a46c93472a43b653c1676c26ffc0c45dd42a187c5e0295ecac2ddaa27609499dbd01b4d9fb00890cee00348c19", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775398, "uuid": "99f6db93-4161-4f50-8a08-0f453ef277d9", "value": "T1A2B46EEC3AC11662ED1ED9B359191E28FB660F036284BF9277DB15CA874F0772C65C88", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775398, "uuid": "530b9372-86e7-4e91-aaeb-2ee092c156d0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775398, "uuid": "83d6af82-cc2e-44e5-8820-91cbe362ba53", "value": "6144:I6YMyuVavbu8dfk8UuSiv6QSK1MhwaSJ6T/eqT+vR/aEHLSAb5TdMHsY:zYqVaTuGhvFJ1EwaXt6vR/a4VTdMH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642775398, "uuid": "dcfae571-9db5-4679-862f-e37144dfef34", "value": 499712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642775398, "uuid": "1c71fc6e-239b-4bcd-b9a0-450dfb2f0dc1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775398, "uuid": "832a9b2e-9f3c-4266-97a2-afc67a9d9475", "value": "VSL PARTICULARS - MV HONOR DIVA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b45dc583-7b06-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642802926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642802926, "uuid": "88e96b15-b8eb-4eb2-898b-6169cd889c52", "comment": "Malware payload (Mirai)", "value": "29999e2d481c3e7be3c2b4ae01fe8e06", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642802926, "uuid": "bc0ec97d-26f3-46a2-ab58-d5d9f9fc76d7", "comment": "Malware payload (Mirai)", "value": "fa2f2769fca719f9757d9ece3bef52474082d41e147258c5a5e23dc1e0dcb84b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642802926, "uuid": "d4eaa131-8c8c-4f97-aca8-b79dd34409ea", "comment": "Malware payload (Mirai)", "value": "501074ba864073148662bfba932a0ff58a53afdc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642802926, "uuid": "f27cca95-5bf9-4dc3-a036-41c8e5367b87", "comment": "Malware payload (Mirai)", "value": "31b588499f2c33afce9c7aea9da00eafcb8939a3f8ee7379c4b5ba150e146d9723a451572f252eb0ce147b6b8e5f4ff6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642802926, "uuid": "fe076356-0857-4b23-a84a-d8e453fb5ba2", "value": "T16E539DA5C4B8BD99CF69927CB61488389723900564A33DFAE742C796D00BEECF10D7B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642802926, "uuid": "5bcfeeef-5bb9-4471-805f-968b74afeff6", "value": "1536:B/bivQhunGaiwt4gpuFosvXZxwaqUfs3rBktd1UYjC1V2:BjiBGhGp+XZxtf+d21UYjv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642802926, "uuid": "59fbcaa7-faf6-4a7e-b089-04f05e1e6842", "value": 64360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642802926, "uuid": "b3e48e58-18cc-410f-8b5c-05e3905253f8", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642802926, "uuid": "995b3312-13b9-4aef-9dc5-9c518805b61f", "value": "29999e2d481c3e7be3c2b4ae01fe8e06", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ac217de-7a9a-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642756310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642756310, "uuid": "cca4303f-afea-4f3a-9d4a-e9b4dd2731ad", "comment": "Malware payload (Heodo)", "value": "7ece1126fb695fcbff58a77f4ad3afb6", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642756310, "uuid": "5f53f18a-0bd5-4ec7-a19d-83a5d1ea8d8f", "comment": "Malware payload (Heodo)", "value": "fb155f74486710bb8e3ca2f50be434fadbb56292e3d42cb0fbdfb217aabb0b0f", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642756310, "uuid": "88cd225e-cec7-411d-b4a2-f2d4c4ec8117", "comment": "Malware payload (Heodo)", "value": "51b418c73afdff7bb8945b8671bfa18027b45964", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642756310, "uuid": "3d2fd32b-63ce-48da-bd27-46bfd554be73", "comment": "Malware payload (Heodo)", "value": "b6b6ab3693a9d156f4eed2b613400f44cb9236cb0f048cf08a7ca992af0179c853b4c62dabea5e99a267a499a388fda1", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642756310, "uuid": "1c872fd3-d801-4f3d-a0ab-675b10593cb2", "value": "T188636CA7B78299EADA0483394DB643C5B717EC104F9A43C73694F7346EB49F08D9324A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642756310, "uuid": "09cd0a8d-5b87-424f-85b4-2ab9fead1d1c", "value": "1536:bpEk3hbdlylKsgqopeJBWhZFGkE+cL2NdA8eXZiozeOgXVZKyaZpvyR1kZkJvU+:bCk3hbdlylKsgqopeJBWhZFGkE+cL2Nr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642756310, "uuid": "dc2aaf38-f47f-4a7e-b239-de60456555bc", "value": 71477, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642756310, "uuid": "76dc86bf-e167-4621-9afd-31d01f795358", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642756310, "uuid": "dc3b8f29-543b-42e8-aec2-7bbd638520ee", "value": "Invoice.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "877c0f97-7ac7-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1642775793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775793, "uuid": "baf47f93-8c2c-46d8-83ed-c3f794c55f97", "comment": "Malware payload (AgentTesla)", "value": "2702027a48bbc7e50d0c375d35ff0f32", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775793, "uuid": "cc3b0a02-247c-4a59-bd07-0669f75b8c76", "comment": "Malware payload (AgentTesla)", "value": "fb6202135abab1d7fcd7f8deee6624ff76e49cfc8b33a27909a032c891f47ef7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775793, "uuid": "6bde77c2-3074-4ca6-9a34-6126f38c8219", "comment": "Malware payload (AgentTesla)", "value": "7c2d402974758f3cb1f95d7ecb9ac0d4f785c3ab", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775793, "uuid": "31bdf311-8cf8-4db0-a4f3-aa20e9de6d31", "comment": "Malware payload (AgentTesla)", "value": "f2bce92b3a134209b96cfd89e65f767e5234d3d5ac37bdc20a5d0eb2b396c9574c762a22ae484a19a030997f01a765e6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775793, "uuid": "62c69ddb-6599-453e-b50c-f25329c7e564", "value": "T136F4D01032F88B01C47E87FA9831109017BEB95AAD35E65FADD1B1EF0DB2B419B56713", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775793, "uuid": "bb1c9f51-bc60-405c-bdf7-4e0a95d63e26", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775793, "uuid": "265d6042-f4e0-4150-8cc7-ce9cfac77b7b", "value": "12288:NlATIxpQDp5zgqsQdWjARB3m/eXhFwSIyfmpq6+ievYF:39pQvzHP6qgNw96+ievYF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642775793, "uuid": "41a00104-0eea-4b16-8c52-ec27e24a7db2", "value": 724992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642775793, "uuid": "d65b5f67-a5b8-4712-ab87-50897178b472", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775793, "uuid": "78143541-f07f-4f59-b186-0ca537db1a5a", "value": "2702027a48bbc7e50d0c375d35ff0f32.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9933070-7aa7-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642762240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642762240, "uuid": "b1fce412-7294-4b45-bd3d-1e3530237a27", "comment": "Malware payload", "value": "6924313bfb16b62e23a622e89894770d", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642762240, "uuid": "5ccc89fa-a667-4ceb-8fab-7f4c98215774", "comment": "Malware payload", "value": "fbc6c1d1149ffb9324291796d884d36bcf8e6bc2ad1c70a38619ad4f2cb8e3eb", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642762240, "uuid": "c12d9750-d04d-4dc4-9c7e-ef3f2918abd7", "comment": "Malware payload", "value": "e5a9afc03d8a1054f8eece1a0b56210c9e478eab", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642762240, "uuid": "60cd3343-874f-4bee-811c-16b092f8d7c6", "comment": "Malware payload", "value": "83a7a44e94e53c6d6607dd2ded76a6afffffdcbcfee3a9d7abc1f1eb5d1dd678f048376840e9970dc2b91e4a755d81d3", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642762240, "uuid": "bb1c8420-ae26-4c25-8ecc-879880066a27", "value": "T1BA04127C73400968C61CD0B75EB1F8EA586EFC748E22C54AF4A8BA6D3CB3F194D6451A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642762240, "uuid": "34580209-47c6-4670-bd64-ad6249e662c2", "value": "3072:jGa/m76K0qN+idXQei1FDxr6y9AJRa6iTW3HKLsWbAov+2LdfJovh8BMtZ:qa/m764+iBGLDxr6y9AJRa6i63HKAWb8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642762240, "uuid": "d2db86f4-8968-4884-bb4c-03dd259e486a", "value": 187288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642762240, "uuid": "bfb742e3-7b0c-43df-be47-c8d2d3ea4729", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642762240, "uuid": "df875d4f-2b95-41b6-99e7-ef61e8598426", "value": "Payment advice.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c44c35d6-7a77-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642741535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642741535, "uuid": "84751ceb-6d9f-47b2-9c2c-8d52f5fab5c4", "comment": "Malware payload", "value": "751d710b076484661447688e3c61f88a", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642741535, "uuid": "f212a22d-43d4-4913-9d6c-7fcd131207c9", "comment": "Malware payload", "value": "fd5f33c3e28ae957627936725030c36b9f52da46b06b8f53303584d0204c3444", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642741535, "uuid": "c6bf4dd0-f14b-439f-a998-c0559e5ed62b", "comment": "Malware payload", "value": "365d062e765b2410ddc86eede560fbed2d2a77c6", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642741535, "uuid": "760e1525-1e2a-468e-99c0-eb9105f284cf", "comment": "Malware payload", "value": "cb111d1ff5fa45f0b992d7a16c21d3d0820b4bc8a79f1b4e36ba4a9caf9c4a2eeef6ecb6ce1c1b2fd830860b8a81bf53", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642741535, "uuid": "33f96d30-245c-49ce-b346-2771e1ed3442", "value": "T18E52C6D0B9959A07C9C54373BB4E83997B256709F2EF3703BA1E3F20665BA570E26042", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642741535, "uuid": "2dc9a1b1-80f3-4bae-89db-09e34eb5faac", "value": "192:bfv+g6W4S0GESpUx58GJ8UQv1b5B7KBZ1Iv6JzmZmgqZ0/VV:bfaWgGESXjtBG1cql0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642741535, "uuid": "4474e1e7-0a8c-447a-82cb-6d2b6ae8c2c0", "value": 14212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642741535, "uuid": "1f05be0d-8b25-466f-aea8-f66228a893eb", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642741535, "uuid": "b8405a6a-0f19-4929-ab9a-6d6514b62f51", "value": "beamer.arm5-20220121-0505", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec11a526-7ac6-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642775532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775532, "uuid": "7b8615ba-58e3-4413-8772-4cbb61f93bd5", "comment": "Malware payload", "value": "17aa535eb17aa0816207ec18dad6302b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775532, "uuid": "415c4ca0-dab1-4e84-9ac7-f21170bc07d7", "comment": "Malware payload", "value": "fd6f4fd9c12a59f8b9e2b2a29cd45e93fb1dff2a2e6e719c1f4b08eee3f300fe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775532, "uuid": "111ae6cb-8a85-4f2d-a737-1e711b120882", "comment": "Malware payload", "value": "6d67b0ebe9f167a8973ee90d5d743f43699600b4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775532, "uuid": "bb2fc01c-03bb-4439-bb43-f7c4b6fc86b2", "comment": "Malware payload", "value": "ad1b347a305b5000279ab15aeb02818e61c5edc9530845264221a4b1fc0bbeb414b8299bce0daa6fa16f39127d64e6ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775532, "uuid": "c783787d-c664-48cd-b2c7-91775527968d", "value": "T1B5B4602CBE018662FD5DA2314E851B67BB968F03E2887891D3DF65F6F75B3152C0B884", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775532, "uuid": "b8b334e6-cbaf-4593-b02b-828815b5605e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775532, "uuid": "73d3cf89-fd56-4bab-9529-2f05d03b80ba", "value": "6144:jsiwLUyY0uAaUuj3hmyQl6UZPOSQ4ORWiQ2uaY5gD+Xc8ZI:jsiwS0uAaUQ/Q3Z3D5aMgic8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642775532, "uuid": "76efaf02-080b-4225-b054-83a38ea8852b", "value": 514560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642775532, "uuid": "7ad0f96f-265b-4cdd-9672-3279432edb23", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775532, "uuid": "2614cbc1-ea0f-4d35-a439-b0022de423af", "value": "MV SHENGSHI TBN - Vessel's Particulars.docx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93818bf5-7a82-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642746178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642746178, "uuid": "f385229a-1782-434e-ba02-cc5b9c1e8e69", "comment": "Malware payload (Heodo)", "value": "a3a61ced3a93c4921cdf02e87446e032", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642746178, "uuid": "0491461c-01a5-49ba-b986-e75e07af83b4", "comment": "Malware payload (Heodo)", "value": "fd83649a426e706a363449d7dcb503e4bf5b59cc3ab5d5a346e4ed308ec2e2f3", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642746178, "uuid": "ba8ccc86-892b-4656-a110-6e48e944cf12", "comment": "Malware payload (Heodo)", "value": "3166821239aca6d095a696a8359b8781303c7a2d", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642746178, "uuid": "78fe54bb-aed9-4272-8bfb-a18c82273238", "comment": "Malware payload (Heodo)", "value": "0b74a03b10d790dd9477382d6e25d1d7cc7419efb244f27f4f56ea3a6b12b16ad9d05a6887948cb18016f4bac7b288f2", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642746178, "uuid": "218fdbc4-2c4b-458d-8824-c775fd0db0a9", "value": "T161636CA7B78299EADA0483394DB643C5B717EC104F9A43C73694F7346EB49F08D9324A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642746178, "uuid": "acc4839f-5e45-4bbb-bc38-c9d1b2a91910", "value": "1536:bpEk3hbdlylKsgqopeJBWhZFGkE+cL2NdA8eXZiozeOgXVZKyaZpvyR1kZkJvU+:bCk3hbdlylKsgqopeJBWhZFGkE+cL2Nr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642746178, "uuid": "df606518-3280-4019-83de-ef7418ffd6ab", "value": 72525, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642746178, "uuid": "328ddf46-75d5-4816-a27f-7722d8cd2dfd", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642746178, "uuid": "6f748f3f-815a-43d9-b1cf-f658b1eaac42", "value": "a3a61ced3a93c4921cdf02e87446e032", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67a01af5-7ab2-11ec-9275-42010a9c0029", "comment": "Malware payload (Smoke Loader)", "timestamp": 1642766720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642766720, "uuid": "9f9c9573-f5c1-4421-96f0-24adec957c3d", "comment": "Malware payload (Smoke Loader)", "value": "454011111a4673fbb75ca3192d32876c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642766720, "uuid": "b611898d-f5a9-49fd-95d1-49be3349187f", "comment": "Malware payload (Smoke Loader)", "value": "fe035a3111a37c273676890230dd284b8bc0481377b921e9dd3818b39ef8c3e9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642766720, "uuid": "5d177298-54ae-4507-b529-824b1dc6d3d1", "comment": "Malware payload (Smoke Loader)", "value": "22404b6f91e5be9c5bab4b4b77c089e0681f948e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642766720, "uuid": "5af4f667-59a8-4499-9b29-024e47b10554", "comment": "Malware payload (Smoke Loader)", "value": "ea6257e827907009ef72a7f5e5df5f5cb85d1ebbd2a0cbe648bf89a49bc11b9b3cee1adc5b415fa86272ffe32d4fbd2d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642766720, "uuid": "146a4e43-a0cb-47d7-9cec-9bd114bebee7", "value": "T1B5647C00BBA0D039F5B322F44AB99778A53E7AB1572491CB53D52AEE5B356E0DC3130B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642766720, "uuid": "96296a7e-6f7b-4a59-9530-ecb880d60440", "value": "475f7058e090be99fd15edb6d2e40c10", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642766720, "uuid": "aebecc28-0749-48d9-92d7-b1847e1ae75d", "value": "6144:NluBat4vC5eJJt2IT/n/XAXfmBKlt60Y0LL3elzLPyoEitPbtV:Nlg9iuJAITnXAXOUltHY0LL3eZLPhEi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642766720, "uuid": "9f3db00e-7f5c-4e77-96f6-3f74617f3334", "value": 336896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642766720, "uuid": "d65c1eb2-7364-4d86-a07a-7bcc25d13dde", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642766720, "uuid": "c56f54da-6051-4f4e-8e2a-fa5d169710af", "value": "454011111a4673fbb75ca3192d32876c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c62a6e6-7abe-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642771962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642771962, "uuid": "80d13e1d-c639-4d6a-bf54-9793ed386488", "comment": "Malware payload", "value": "3d62c2a23289348c8824d6e72803267f", "object_relation": "md5", "Tag": [ { "name": "germany", "colour": "#0A5679", "exportable": true, "hide_tag": false }, { "name": "LALALAInformationStealer", "colour": "#5D1B4A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642771962, "uuid": "5746673d-62ff-4d66-9038-9b01f0ed4453", "comment": "Malware payload", "value": "fe355b657f8b962d3a830e2eee3cbc182a3a8cfc5032a5cadfb790648050804a", "object_relation": "sha256", "Tag": [ { "name": "germany", "colour": "#0A5679", "exportable": true, "hide_tag": false }, { "name": "LALALAInformationStealer", "colour": "#5D1B4A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642771962, "uuid": "2f045417-a223-4812-a98f-908f871cd818", "comment": "Malware payload", "value": "2b3f0bb6c064ee301180877a1bc44648b8dda3eb", "object_relation": "sha1", "Tag": [ { "name": "germany", "colour": "#0A5679", "exportable": true, "hide_tag": false }, { "name": "LALALAInformationStealer", "colour": "#5D1B4A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642771962, "uuid": "8093524b-6ba2-471b-b771-12ede2f27aaa", "comment": "Malware payload", "value": "ec736ba6cae5e79b754ee8bc7969ea002a34a7d75dcd0d73c053c2b6c5bda21ba673981586cf2a7f006cdfb8b3d60931", "object_relation": "sha3-384", "Tag": [ { "name": "germany", "colour": "#0A5679", "exportable": true, "hide_tag": false }, { "name": "LALALAInformationStealer", "colour": "#5D1B4A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642771962, "uuid": "3b5baf26-c6f7-4f3f-901b-f6b29f75fdc8", "value": "T179152FEB8F3B9E98B058B51B3040B909FBA4ADDD54EAD3EDBBE56727205C03214748D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642771962, "uuid": "ed406a49-5bc7-4aec-821c-674ce9c012ad", "value": "12288:22jK4jnZZn8ofvyYJm1t5IzLfR1UMaLIHNetoJc:0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642771962, "uuid": "8a55df55-860c-46d6-a355-04dc1dbb027b", "value": 885554, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642771962, "uuid": "991011e5-83a9-43d6-a24d-2405d1cdde65", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642771962, "uuid": "77c234e4-8eeb-4dc8-abd6-97adda4d667e", "value": "update.py", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63737fbd-7a88-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642748674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642748674, "uuid": "89ecc666-f7a8-43dd-9692-0eb57895fcdf", "comment": "Malware payload", "value": "ec3098dad313cd40004bdb42a3b3bf8c", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642748674, "uuid": "49b76a41-730b-430d-a187-02ecd98d966a", "comment": "Malware payload", "value": "fe899495f30b71f2b13825a259ca3039d59b5e9c3145611474ad32dee5622a7b", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642748674, "uuid": "3d66a368-115e-48dd-872b-ea091312c0dc", "comment": "Malware payload", "value": "dc586ba9194b7d4e36d257158dfe0b821c724a0b", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642748674, "uuid": "3efa99d5-cd4b-4e82-b8f6-d625e453cfca", "comment": "Malware payload", "value": "2d858b859cea9eaab28f73e297dc5cedf07d8d0568a2d231877c474e06764e111f3d547bb7c8cc880251f3560ba85cf3", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642748674, "uuid": "5efb817a-4777-43fb-bda8-330f1f2520cc", "value": "T17263E125C2847A3CC77128FCCA59A2FA7786D03992E7590F6481718F17D56E307CF2A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642748674, "uuid": "f67e0b71-65ac-4641-8f9c-8b3666a58ba9", "value": "1536:GV6swoBUqLURYU5/WnYS1G84dd5ek7NTC6v6HHUU:GV6rM14YU5Onq8yxQA6nUU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642748674, "uuid": "c1b90e4e-62e5-4081-8142-36049ab1b781", "value": 72076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642748674, "uuid": "d6da76b3-2811-4c62-962d-ed9a9f2e99c4", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642748674, "uuid": "ada1cc8e-6c5a-48d4-b284-a631d45d0395", "value": "Budget 2022 Europe BD_AS.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b925c3ae-7ac5-11ec-9275-42010a9c0029", "comment": "Malware payload (Vjw0rm)", "timestamp": 1642775017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775017, "uuid": "30ad69a9-1875-4778-952b-f6d4c2a2d763", "comment": "Malware payload (Vjw0rm)", "value": "9b888e0d179f1079bab199bf682c69d2", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775017, "uuid": "2b74788f-a0ad-46ff-99d3-654f68119a45", "comment": "Malware payload (Vjw0rm)", "value": "febb815216146ce5b082e909f7ee36a07f2692201b36671fa0f3c73eb7cd407d", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775017, "uuid": "02adf481-a168-4a4a-9a39-d6fc38e47021", "comment": "Malware payload (Vjw0rm)", "value": "55632e020598c5511d3c361fe2e3c483af39b0ba", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642775017, "uuid": "0d7c58b8-7580-44d3-a7d4-f85a417a6600", "comment": "Malware payload (Vjw0rm)", "value": "487e7080382c89b8411d0f0f63ab5983c1447f4b7e6720fc413cdfdc5934e86301808cb6d5057cf77f01df7a86c99429", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775017, "uuid": "551642d0-68d0-44c2-9bd0-ec63074089c5", "value": "T16F14128FE7A48513FB5A2A5303766119EC9AFC82C7703D54D9FD11CE9AEA108CB11CE9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775017, "uuid": "5bd111b2-dd99-4523-8c74-2218ba1517ad", "value": "3072:BcKljgI01eBomToQxJgz/GtbrOijIKfMlVI9SR3zL40XOCFubYdW+ZHtQcXavlJP:KKlsL1eBdgrYbNMKfp9Sz+PY0+99Kvll", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642775017, "uuid": "f0665d0b-5205-4b02-bce5-123bb3a09629", "value": 191760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642775017, "uuid": "7d5aa7e9-b461-437c-8b1e-23b0d214dd06", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642775017, "uuid": "a1afc5c1-a735-44fe-947d-b7bde8b779c4", "value": "Order confirmation.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8e8777f-7ad5-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642781862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642781862, "uuid": "85e1060a-1549-4c4a-b077-0d5aa12c1658", "comment": "Malware payload (Mirai)", "value": "95e3a975271b299af2480b9140f2430c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642781862, "uuid": "f8bdf92c-8d79-43ee-865b-04c3ce9b3f04", "comment": "Malware payload (Mirai)", "value": "ff02619d28c8f1ee7f2ea5bd88341684b2a8577983197431a9a40ffa726b2d87", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642781862, "uuid": "aceee986-bcbc-4841-b257-43cac15efa6a", "comment": "Malware payload (Mirai)", "value": "2b22b74a802d4f2a9440bdc8e058272ceeedc372", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642781862, "uuid": "a46930e0-4d41-4d68-b5bb-4805de45e4dd", "comment": "Malware payload (Mirai)", "value": "7917319790c731fc749ada98c10957637072c50da0606b601291e3ea61cb42932d56f96121c36915dfd61f8cbda6acf4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642781862, "uuid": "56c9b41e-d7b1-4e09-a718-75d73322e216", "value": "T1B373C519BF610FB7ECAFCC3749E91B46298C945621943B367934C818F68B25B5AE3C60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642781862, "uuid": "b6e013b4-eb7b-4b99-9728-3fc11afe1c78", "value": "1536:cJfEFvGQrH19rskjDosdsdTBIROY9lbWZephJT:cqGQrH3rskjDousVObW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642781862, "uuid": "3b0fbd37-7a77-4f70-8b41-3d7f5c6064af", "value": 78244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642781862, "uuid": "8bb10f00-93ed-4a98-aa45-88dca7f521ce", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642781862, "uuid": "cbb0ce7f-11fa-4d48-a10a-13fe3b3ed982", "value": "95e3a975271b299af2480b9140f2430c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "366fba35-7a85-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1642747310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642747310, "uuid": "e13d8cc1-f5cf-46a4-8a7e-63536e8b1b3a", "comment": "Malware payload (Gafgyt)", "value": "3cb08428c383887381a8adbfb2cc35af", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642747310, "uuid": "0e055e49-7ba7-4841-b05e-0aa684c8d594", "comment": "Malware payload (Gafgyt)", "value": "ff2f8d288108f34e9d1c29fee8d1709ef132421ab3bab98f965e02abf8b33648", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642747310, "uuid": "41ebd46b-43d8-4a2c-b085-7495c768ab31", "comment": "Malware payload (Gafgyt)", "value": "63e051d4e15ab274a3522240f0e00943c76b0e62", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642747310, "uuid": "fc66a27c-7130-43c4-b75f-1aa4fe807094", "comment": "Malware payload (Gafgyt)", "value": "096bed1497c7411b7e96790bc882acf49ab7b54ddc9fee9e4c93f25d9fd326b9b5ca40cfe769c6404b852bd22371d20e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642747310, "uuid": "dee50def-9cbc-4fad-8104-00e405756779", "value": "T1FDC33B06F5108753C1C2177AB79F561A77232BF897DB3312A6247FB82BC279A0E39950", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642747310, "uuid": "11b36e74-91cd-4653-a3f8-6dcd2d9a1288", "value": "3072:idwracAAviNmLpMQ1xl5hKHKSrbqlAdmyDQUJ1UX4Tn:SwraFgikxl5hKHKnlAdmyDQUJ1a4Tn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642747310, "uuid": "a722f2b7-55e4-4d0f-b949-c6ea64657065", "value": 118932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642747310, "uuid": "401d372e-2e29-455e-b534-52cf68898d67", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642747310, "uuid": "0b5d5c8b-7a9e-46dd-afb3-7bb93faf9cdd", "value": "fuckjewishpeople.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d887e7ff-7a93-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1642753595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642753595, "uuid": "b1c72b89-a004-454c-bd9b-da753b16256c", "comment": "Malware payload (AgentTesla)", "value": "933b03f4008920332a2d5ed26c185977", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642753595, "uuid": "b8d2e308-9710-4666-8178-ebc4781756ff", "comment": "Malware payload (AgentTesla)", "value": "ff343dad99a2d7db43292b9dca9f550dbc1fd1a877e5876b38b6eaac64fabf93", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642753595, "uuid": "eac83597-44b2-49ea-9838-1e72569fe1b6", "comment": "Malware payload (AgentTesla)", "value": "6b2705838a2b51b3bd5e2f8b0e49daf429cbaf1f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642753595, "uuid": "d084725f-f0c9-4ddd-82c4-5737ccef512c", "comment": "Malware payload (AgentTesla)", "value": "501f8da6726da45565d6a1733f61e02f2d26e3ef620344bbf323fd4f55c268ac02a492128084ac80a88d227c65640c00", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642753595, "uuid": "aa674a43-4fc8-4969-a20d-7201c41f6d3b", "value": "T1BA9423E3A4733B6C1245E12F3AFC82391718F34247C31A79799B37AE505F84792D5AA2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642753595, "uuid": "33d92462-2b84-4a50-8aa5-e5d81e91f408", "value": "6144:2JTfVn2xglFzeBsNJw6Yxpykp8gTsGNdbfCllKYnWbD4ZcjajzyvHWTcAi3fHIXM:2SoFzlK6STs+fyVnWbkZcOKvZBfHZAW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642753595, "uuid": "d177f5d1-b3c6-4ebd-bec3-614a339af55f", "value": 429371, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642753595, "uuid": "d13da946-cb91-44c2-962d-ba91fd730936", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642753595, "uuid": "34532ac1-675e-4c2d-b7e0-16487a350c41", "value": "Order No0027776455 01212022.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }