{ "Event": { "published": true, "date": "2022-03-01", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2022-03-01", "timestamp": 1646179382, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "8cfba93f-4781-46df-a373-c9da64b2fa63", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4c10e49-9947-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646129352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646129352, "uuid": "45d905b9-8694-43fe-8c3a-1e5b38bb4422", "comment": "Malware payload (Formbook)", "value": "6878e9896fdd84dcc11c997c9b7330ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646129352, "uuid": "4fb2b588-1bb6-4254-92a7-7e4f14d80af1", "comment": "Malware payload (Formbook)", "value": "00027d11309d55312ae77f32d4ae79671c91f541e577bace7a5a5abde05563ad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646129352, "uuid": "c7cb8be0-78ba-432f-98a4-04ff2ba4f5b4", "comment": "Malware payload (Formbook)", "value": "2e586f8db46953532b5e25e07add4dbaeea83a79", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646129352, "uuid": "c9a64de5-54b3-4a58-8fce-734e94374972", "comment": "Malware payload (Formbook)", "value": "49986c98f51a05daa342eeab5c5611f35eaefa16cb7a7851a3ad3e6c049e5bc545ac07579d6a61a370f8ac509ea76ce9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646129352, "uuid": "7e175408-16f3-4d24-ba73-0d94b24ae3bf", "value": "T104C4D04B3A355BE6C93D97346421160CCFF6E9A2C31EF26D7CC6B5C900B1B078A26A17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646129352, "uuid": "a90f9ff8-27f5-467e-a41a-1201d19fcb26", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646129352, "uuid": "9c862659-b0ea-4ddc-9be1-ed1e42c45a89", "value": "12288:m5qaxzGRUcZ64JcRm00dTWE88Dje2Ur9o6xJptIpiicMINOBx4D:EcUDRmZdTB88XMq0tDHBMBx4D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646129352, "uuid": "0b36501d-7fa9-4921-b651-3462737c299b", "value": 547840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646129352, "uuid": "bc0e11e5-8020-4413-8715-da443191cf9c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646129352, "uuid": "9581bca6-a5de-43c6-88a5-52404f31cba5", "value": "NEW ORDER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0fb50ca-9942-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646127225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646127225, "uuid": "19f8bfa9-fe49-4e1c-9b76-21678c808519", "comment": "Malware payload (Formbook)", "value": "a76b1f8a9cfef5b88c9d095ef7578017", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646127225, "uuid": "8e182b60-6771-4072-b8ec-9e4beecec70f", "comment": "Malware payload (Formbook)", "value": "0025e49b33a009c7362ba221cfbc3e43a6fbf5870c4eb43cd3ea8a7cf29bdf68", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646127225, "uuid": "37580d30-adf4-464f-9d62-66287298ef1b", "comment": "Malware payload (Formbook)", "value": "87672f68e5b9cc68d1536a4ee79ec129078addf1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646127225, "uuid": "e5a5f9b6-1b86-4b65-b1a7-443c2923a5fc", "comment": "Malware payload (Formbook)", "value": "5dcb99f2169e7b40f17da6fe5e0c92e046f9244d1516667c51fb16badbf31f81be194fa6a657fa6d7a0405eb5a53aa14", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646127225, "uuid": "8c9917fb-2e6d-4007-a542-7132dadb738c", "value": "T1F3F38E32D641C031E2A252F5B26D1B7B883E0D343755A0AAE3E61AE56EE05E5F43D31F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646127225, "uuid": "7843d7b5-bb15-41e6-83ca-271014cdd3c9", "value": "3072:4aJkd2hj8lzxEAwMbg/Mz92OgLNcj7S4g+WvIXTgSLSMPpct:4JdRcUeMz83LNcj7fg+RTVSWct", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646127225, "uuid": "f4303f9c-92b7-4580-b1c1-3f55a73f5bd1", "value": 167424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646127225, "uuid": "4ed9c5a3-2b0f-44d7-849d-e2929990f534", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646127225, "uuid": "bc9f6cfa-7e49-4e16-9b46-4357ef22854a", "value": "a76b1f8a9cfef5b88c9d095ef7578017", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8aeaa9e9-9991-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646161092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646161092, "uuid": "4e803af1-3888-4e99-a0a7-9b487763d103", "comment": "Malware payload", "value": "0c0bae0d210f3fc31eca1d57454a5da6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646161092, "uuid": "babbe842-8f5b-4ccc-a7e7-df3baf123bcd", "comment": "Malware payload", "value": "00618cf758d2dbbbc3565a8063f22ba6a2b1eaba02e36d62db931bf2e24e14f9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646161092, "uuid": "dbbead13-073b-4279-b3cf-bc8ce7e85a6d", "comment": "Malware payload", "value": "c0d19a26129fdfc322664d109e0e6983be7b47c8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646161092, "uuid": "9265fb4c-a052-4bdb-a864-93f34c282b5f", "comment": "Malware payload", "value": "8e930138019678aa2a3b20481baf0c92adb60e39a2a02542eecb4a0032ca6e06999f0a25c564155f1395bf39b882e77f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646161092, "uuid": "d561d47f-4dd6-45d5-a166-81897e953367", "value": "T17115AF4835E6607DE8368BB1CAC0EFF19B69F231D54960B650020E199A0DBBDCE45EFD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646161092, "uuid": "d8e39c96-ae0b-469c-bf00-36a03b051109", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646161092, "uuid": "e2d80957-579a-4e97-930e-3a6de2d5b3fc", "value": "24576:YoamCVBuXBlDXxKhAHnEXbkYq+yCiRXo:YoJCVadBLgLyro", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646161092, "uuid": "2a13cfb8-90c2-4e5c-b154-164826c75f25", "value": 882688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646161092, "uuid": "aec70c35-409a-4364-82b7-c0e0c89d4fd8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646161092, "uuid": "429c76d4-16cc-4f64-813a-8e81fa3de06b", "value": "0c0bae0d210f3fc31eca1d57454a5da6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d29c90f-9982-11ec-9275-42010a9c0029", "comment": "Malware payload (RemcosRAT)", "timestamp": 1646154680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646154680, "uuid": "395b4ecb-44b3-4453-90ef-10048b13f25c", "comment": "Malware payload (RemcosRAT)", "value": "be3010d82be3b19aba07e0286edd48d0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646154680, "uuid": "cf18e029-f7f8-462b-9410-5026575eea23", "comment": "Malware payload (RemcosRAT)", "value": "00a511f69117f567864ff224295fbf6054666dd3e7cf7ef13ce48e725b68f743", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646154680, "uuid": "f6d47394-b85a-44cb-aa20-ff8b2338a41a", "comment": "Malware payload (RemcosRAT)", "value": "6d2967076ba7f6a478926eb320cdd8d4ff233192", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646154680, "uuid": "8e8d0aca-ff9c-4c87-9cb3-003a662c6796", "comment": "Malware payload (RemcosRAT)", "value": "e74a47e0b3506f01559ec7a1bef95c75b7ee416ecb99ef34fed6f3db05793d88ee99acd3c78a9d2aa4b2d6fc639b13ed", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646154680, "uuid": "5b1583f8-3f37-4d8e-84aa-469acb3fef0a", "value": "T1A0A4BF11BAD2C072D97251340D29FB35DEB8BD202935857BB3E61D5BFE30180A72A6B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646154680, "uuid": "d256469e-bc14-489c-9e3f-ebfab0588e1a", "value": "029a987f21e33b48f24d21b6f9ff1129", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646154680, "uuid": "bff7218f-4932-494c-b0f3-47af628d5a94", "value": "6144:3OFBH/FMNjt18F+9a/NgAeDB4CcOtKp03b13a4LJ+sAOZZPWXbTcUHyg:3OFtiNBuFgawDB4NOmuwsfZPgyg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646154680, "uuid": "df18b61d-b0c6-4224-a485-78e0cc8d10c5", "value": 473600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646154680, "uuid": "a713f873-6dc1-40ff-9bb0-8bc7be086a08", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646154680, "uuid": "93235cea-98d9-4bb0-bc8f-99ec85acf2f7", "value": "be3010d82be3b19aba07e0286edd48d0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4da9376-98f9-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646095879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646095879, "uuid": "589cc46c-3bdc-45a4-a898-f9b1cc67249e", "comment": "Malware payload (Heodo)", "value": "867a1ca9c63770eae7ccb3d23edff2cd", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646095879, "uuid": "a0b6a0aa-449f-489f-9de1-878fd2b87c47", "comment": "Malware payload (Heodo)", "value": "00be0a6aba41bbc81133a82be5ed5609025ab63fa6231f3b62d357021c307c16", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646095879, "uuid": "f2774697-5da8-4d31-9d0a-9deef7d9a52e", "comment": "Malware payload (Heodo)", "value": "73f87bcbeb110a1c7c6e92a3a7b9b71815cc7123", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646095879, "uuid": "00871589-1718-4f1d-b5b2-312e5b7f06af", "comment": "Malware payload (Heodo)", "value": "4ff754ada52078cf4de9ddcec3e38299082b5fe8e3e96d7945b1b9a95f6b05a8a25ca6c65825eaaf40e7d39aa604181a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646095879, "uuid": "d09aca53-9c75-451d-a927-9e59392c54d7", "value": "T1CAB40706B152B13DC24BD0B96E0167A951AED9FD0BB137A3AFA813CC06A34D5735DBC2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646095879, "uuid": "93663b7e-da32-4dad-9c42-d25732d09b12", "value": "42fe0d732d1bb90c6a7a1bcfb8ef88aa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646095879, "uuid": "b0f2ffcc-650d-4fc7-9018-2762a3e8b055", "value": "12288:AASStHx1vVHO+1Hx54Wg0p9n4WNL7XE0UdX:ecHfv4qx/np9l7XE0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646095879, "uuid": "f317d1a1-8184-4047-87a0-546af6073603", "value": 532480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646095879, "uuid": "6f9414e4-361f-44da-b8da-4c4a3ac085c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646095879, "uuid": "d513cda0-afaf-4c4f-9aa0-aae710f18dda", "value": "TKsbVYRzyEiRbbWYlPzASk7vUrOTzapAnlO.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a021e19-9931-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1646119751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646119751, "uuid": "fdefbda3-ae52-4037-9e69-e7a193fdf9dc", "comment": "Malware payload (SnakeKeylogger)", "value": "c13306336a749dc1551fae955978e44b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646119751, "uuid": "d186e315-8dcf-4cda-be86-9b0bb5543f47", "comment": "Malware payload (SnakeKeylogger)", "value": "00cf133ba8da1fd1e73a1aa41693334c4d288ec71ced6c331e40d1de09a0c0df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646119751, "uuid": "fb7cf907-077c-43aa-8cff-c91baf34d503", "comment": "Malware payload (SnakeKeylogger)", "value": "7ec81c6d86e347a8d867212a003aa32bcca92d21", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646119751, "uuid": "03b7ba57-9c0d-441a-9bae-05220e1dfb8a", "comment": "Malware payload (SnakeKeylogger)", "value": "fb71534d855913c3a81f48dc7413c4aec6c88f98e46ad3c19777c82d1305baa8b436e62288d4646ad3a6d7e6e09c4a02", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646119751, "uuid": "9e1a7a54-d3fd-49fc-976e-1fdb3d7641bc", "value": "T1BAE4AE0838E65138F8369BF1CBD0E7F19B6DF221E48871F564010E559605BBC899AEFD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646119751, "uuid": "3f9abc05-d8d6-40da-8d80-053483de61aa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646119751, "uuid": "15ca0e64-3fe8-48be-b380-245983d8f419", "value": "12288:rEvbR/IsUB+VqSgR+yK6og8R1TLZlig55p/LMcKLW4q2Dou/6RG4XI02VC:BUVqSgA93hMcKhqcoUN02VC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646119751, "uuid": "75c18f96-8fcd-4a10-ab15-0552c8b50f7d", "value": 710656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646119751, "uuid": "b7aca578-3ea6-4cbd-8400-c6f7a534e6ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646119751, "uuid": "41f1c878-23b4-46bf-8707-a8e5baa2baca", "value": "20076564_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23e712fa-9933-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646120546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120546, "uuid": "845f3294-6895-4aaa-91c9-3ff37d751acc", "comment": "Malware payload (Formbook)", "value": "da933f5b6e34952eeb6b202d84029ea3", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120546, "uuid": "86d60e01-ec7f-4415-abf1-cad4183f034b", "comment": "Malware payload (Formbook)", "value": "00e3294eaf622d556f48f57d65a520c17a9fc2a65d18e578b8a78633980298b3", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120546, "uuid": "99434cf7-e637-4922-a789-e8f3cc86b3b9", "comment": "Malware payload (Formbook)", "value": "3e961a1efb528990a71656dfc73da67991ff19d4", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120546, "uuid": "cf2c423a-8d77-4e8f-a102-e61039c5550f", "comment": "Malware payload (Formbook)", "value": "cedc3fdf938d7648ac3cdef3d49d8e5f600591a550b36374d7d859e9cd589b747749f8b9bf7396ef653092d3ee14f1e5", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120546, "uuid": "3b2bae12-c8ca-4e0f-aab9-28aabe7b4cd5", "value": "T1DC1402097935FB35FAEBD03C78BD323A1D299E199DB0156A6120710D3F30E622ED6278", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120546, "uuid": "15e9f849-b92c-481d-a467-72482cc5347c", "value": "3072:7vNJjxup2+JkrOkZLTa6gTmDTB+izlp9mW+tL1eSwfVrdoviTkso63Ax111Ut:DNmJkJ26ymIi5p9mWIbWRxTLoxf0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646120546, "uuid": "c931176c-b392-4964-8779-185dbe78f5f6", "value": 191160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646120546, "uuid": "3ea6d1e3-2bef-4155-86fc-9dba4419a087", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120546, "uuid": "ac62209a-0924-42ef-ac8c-1fd95f1823e6", "value": "SWIFT COPY 937471.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d7736c1-9998-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646163915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646163915, "uuid": "5ff7ec54-fd97-4254-81f5-76d828413b31", "comment": "Malware payload", "value": "617c83d2ebd038b242bb3b10b9a4393d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646163915, "uuid": "082e0341-ebbd-4f08-9131-101dbb7eb853", "comment": "Malware payload", "value": "00f2c1e3d2df207df3b1487aff516a21aca49710217adb1a29b3b3b575094d7d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646163915, "uuid": "07fabd02-0990-4ad4-a969-879cae197ef1", "comment": "Malware payload", "value": "c7a2eba2b5ae9876cd6791755c5cfa2cd7511ddb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646163915, "uuid": "f5657171-43df-4cc0-b0af-7b1563d5159f", "comment": "Malware payload", "value": "c594706b8cd78811682feb2e458c7100ec1c6b929bd32b3d3ee41d40850997dc33561dd290ff89eb2de3ff4a4946c26c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646163915, "uuid": "c32f07bc-0df1-4016-ac52-b50c5d6160c3", "value": "T1B9B4AE11B790C076D2AA36342512E3B51AEDBC709AF5838B7FC07B7E5E315918A3835B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646163915, "uuid": "2b6e751c-0cbe-42cc-b770-77ff1047e449", "value": "f08242131de62ca6d7c4b2727b491b3d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646163915, "uuid": "5f043647-bdb9-4edc-8066-b278b841225f", "value": "12288:dbFLiEzuSo9guqHuWjr2pyI4W6SpktSuHE:5VWSo9guWI6ZE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646163915, "uuid": "40eedfcb-e2a6-4d75-abc3-b02cd7b8c881", "value": 500224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646163915, "uuid": "224e1781-b148-4fa1-9281-e02c4f3961d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646163915, "uuid": "214b65c3-b1e6-4f36-8e99-765c4b5d83d8", "value": "617c83d2ebd038b242bb3b10b9a4393d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76f21eb7-99ae-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1646173514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646173514, "uuid": "a7d2c3e6-d6f4-4694-8bcc-668670c734dd", "comment": "Malware payload (Mirai)", "value": "92ac2e534e264220492a1a78deae4419", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646173514, "uuid": "a580a47d-1f91-4d5f-84a8-7c36b4dc53a1", "comment": "Malware payload (Mirai)", "value": "01857f332bb670141348b8ccf865ffda84c4524c565e53c0d6017f32111007c8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646173514, "uuid": "5ec69863-bf63-4347-a243-de127beb6a5e", "comment": "Malware payload (Mirai)", "value": "d97d08d4140530227843edea717c9470634943a5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646173514, "uuid": "e6bef6d3-29bf-4f5f-98c7-17171dcc973a", "comment": "Malware payload (Mirai)", "value": "6386e838469d99a6032f55c98e06d73e551e8ab56572a841ddef77f4d60b9964028621e01d3ac3b677bf5237610f159d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646173514, "uuid": "38b3df6e-c98e-4cc3-903b-c6e346cf3e73", "value": "T135F2F1D1DADC4930C6F02E3F68F08957B3780E6DA5A620188255107FB2E255E5CE7963", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646173514, "uuid": "3719bd03-7ded-4c63-9c55-ae11a8f88e45", "value": "768:YQUUa5U+g9V3RJCAroYE8iENsLgElalfE7D3KKLSZ9EhuCu2w3Ugy:YQUU86h8XkNsUsay7D6KLSZ9EQE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646173514, "uuid": "16f785f4-a5aa-4dba-9177-9a758c534151", "value": 36544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646173514, "uuid": "e9711749-b6ec-41ba-99de-65876cbe33ea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646173514, "uuid": "9bcb5d14-d988-458a-adf1-a600180e61eb", "value": "92ac2e534e264220492a1a78deae4419", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef4550ef-9936-11ec-9275-42010a9c0029", "comment": "Malware payload (Gozi)", "timestamp": 1646122176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646122176, "uuid": "5591c220-3af7-4370-b71a-164293c673a2", "comment": "Malware payload (Gozi)", "value": "186a0ecb6782ddfb7e5a880869951e93", "object_relation": "md5", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "inps", "colour": "#CC4ED5", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646122176, "uuid": "7fc00288-614f-44b9-aa26-52c64461e2b9", "comment": "Malware payload (Gozi)", "value": "01c4168091df5b4df40719edf423143684eb96f27edddc8bf0881275568fe78a", "object_relation": "sha256", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "inps", "colour": "#CC4ED5", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646122176, "uuid": "f198aa7f-2553-4ce9-9283-e10a0624724e", "comment": "Malware payload (Gozi)", "value": "4694cf8d43369fb5049695459cd3c64120432f7b", "object_relation": "sha1", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "inps", "colour": "#CC4ED5", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646122176, "uuid": "01fe9c5f-38ee-4ea5-9285-baa62c8e1ced", "comment": "Malware payload (Gozi)", "value": "e1e1d3d955656173b39bb066f59650349245656e4a297a2f977fddb563fcf7ce63427b581d7d1262a691e76a458b9ab6", "object_relation": "sha3-384", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "inps", "colour": "#CC4ED5", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646122176, "uuid": "c9a27d0f-2b0f-4e38-915e-496eb1a6c315", "value": "T17DE1AE9CF6329B4FE2A0DAD14C118D9CB052CCD0088ECB3F5CACD32499A9A5345BA7D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646122176, "uuid": "9b115b92-bfb4-4426-8fa2-c986c1627a98", "value": "192:U4XshT4E69+9eh35Vt3iRYbqvg362spa+:lsh0Ey+wLi7vg362Mp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646122176, "uuid": "505ca7a6-7fce-4436-8557-eac6605cde42", "value": 6954, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646122176, "uuid": "80b50a00-6a57-4a6b-8f98-09037e91229b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646122176, "uuid": "ab8d9d9a-6d8d-441f-90e2-cc13ea245b02", "value": "metod33.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c38f2219-9977-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646150020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646150020, "uuid": "903276b7-f90b-49d7-80dc-3ac8fcb39c9e", "comment": "Malware payload (Heodo)", "value": "bf49d6bc6de1d2c65375e59e6a1e1b90", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646150020, "uuid": "bda80ccf-abd7-4e35-9c4d-51e801cbdb5d", "comment": "Malware payload (Heodo)", "value": "01db578bea63291f2bb5b1c043c079eb9e7802a367d2236d8854f229a0bd4a77", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646150020, "uuid": "31f9a1a5-4918-44ff-9c45-5cbb2d128178", "comment": "Malware payload (Heodo)", "value": "fee21909be41ba759b5d5c4bdc4e306550fb78ba", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646150020, "uuid": "67c2069f-4d35-4692-90f4-f7c3321ab410", "comment": "Malware payload (Heodo)", "value": "8e1de73a6074e2fe49715ef34700064508a91c1ced0724491730d61086c2cd112448ed0c43296400086fda8d61a3922a", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646150020, "uuid": "4d1fef29-2798-4302-a720-a50e80449ba9", "value": "T15F13E02AC0961959D727283DD6148EF4124C0E4A89E5F99B1D50B3AC2B6E1FB0B4FCB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646150020, "uuid": "13a719cf-3490-4bf1-a2e2-737865c6380f", "value": "768:i9oms9O+pOevZCwtxyKfcrND59V+L9Rw4eWrXcTqw0VfWZE:i9oms7tylND59V4jwmXc2RVfW+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646150020, "uuid": "1bb29949-c30e-42bd-afc5-7a7bc038fb8e", "value": 41841, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646150020, "uuid": "22449598-666a-416b-b7de-52d65fba370f", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646150020, "uuid": "f6858f59-0fbe-4064-a100-de1e972b2cc5", "value": "imedpub.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b4923cb-9931-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1646119726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646119726, "uuid": "5a33c80d-076a-4909-8d37-f03c0cf0637d", "comment": "Malware payload (SnakeKeylogger)", "value": "3df478422196a8e646d6531479ba7188", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646119726, "uuid": "40c4c492-bb49-41e4-9e7d-0fd0c49986fb", "comment": "Malware payload (SnakeKeylogger)", "value": "02a7ad6a2310a0b7dd465f40d6d81d59b3234b4f3ad8f039a866f3eac7d920a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646119726, "uuid": "73896b00-de1c-479b-9162-8449f9168b49", "comment": "Malware payload (SnakeKeylogger)", "value": "096151758d70da64bc9fde53b55268036a152228", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646119726, "uuid": "3b9a223b-00ea-4379-b9a0-af71ec10a578", "comment": "Malware payload (SnakeKeylogger)", "value": "4315249a47f80a15dee798efef0940158cd1d0f9a9dad17de952d042cc58e7e58148b57b77e9b49d48470351acfa843d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646119726, "uuid": "3b5c534e-01fa-4f66-ac7a-1163161b91d4", "value": "T12CA428EC31E235FEC8E7C4BAE9641C69AF10787A830B921790571299990ED97DF170B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646119726, "uuid": "6336a1bd-822b-4fa9-9b4f-627081cbf429", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646119726, "uuid": "dcc20cb2-a6a6-4c1c-9416-ee857e145c4f", "value": "12288:3V2+f6U6B5DFmBLoBiPUpuJYvGiX0ygj6J/QrRc6804T:3ff6fmxoQPUy4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646119726, "uuid": "8f43e15c-198f-4854-bfca-8063d802801e", "value": 486400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646119726, "uuid": "22212ea1-3900-4fbe-9ec7-03c150c6ab5e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646119726, "uuid": "e07bf064-a189-4003-909e-ee4322ca48fa", "value": "SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b93f9b1-9985-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1646155778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646155778, "uuid": "a2636a53-195e-4164-bfa7-a75f4892605d", "comment": "Malware payload (RedLineStealer)", "value": "c2713519c367d4ab45da7609efa1e98b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646155778, "uuid": "48223afd-43c4-4a6c-b321-37c3cdfd5d70", "comment": "Malware payload (RedLineStealer)", "value": "0329d21e769f3694b8288adc4bda2942df7578f2fd4a9fe3a1935c8086dcacc7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646155778, "uuid": "d4b9fa22-6ec7-4424-891f-8165f2638da4", "comment": "Malware payload (RedLineStealer)", "value": "5f4d10f7684a4df421d916c8994dd4eec5ff937a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646155778, "uuid": "0c9e2440-c76f-488b-8093-b696fb1ad2fe", "comment": "Malware payload (RedLineStealer)", "value": "31fdf647b1dfe8076dc1223cc654bca3a095e5b25e7a5deeb2410e98df841406efa75bc42095e02af06cc7f46db61730", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646155778, "uuid": "f1049336-09dd-42ab-9e36-a52c59d6746a", "value": "T1E7C423CE33807A5EE30C86F86872171F95EF246AE4E4361E963F0706457546BFE0A1E9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646155778, "uuid": "7cc59317-4558-4590-af8d-3410d83fddeb", "value": "445554923421947cbff896012e27345a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646155778, "uuid": "040c77e4-f1a4-458b-9c63-256b9ab52576", "value": "12288:GKPRiQdceJvMuVnMxdRB3j5QS03ULaHNqrxlKIQNoXI1mcOeOvqlq:3RiQOKFmvBT5kEaHNYK3H1ZOeQqs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646155778, "uuid": "ac0fc7de-5450-4b41-90c0-d24c7e1eafae", "value": 567808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646155778, "uuid": "3bd5d546-87d8-42f9-a6b6-e675ec9f4cee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646155778, "uuid": "6e444dd2-8f89-4d6c-b71d-2f09bdc03e76", "value": "c2713519c367d4ab45da7609efa1e98b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa3fd1a3-9956-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646135804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646135804, "uuid": "6e909209-6de4-446a-a8f5-6202ca1735d7", "comment": "Malware payload (Formbook)", "value": "92a74ea70be95859d974cff284cb163c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646135804, "uuid": "080377ac-24cb-484d-91ef-019abf3d6f37", "comment": "Malware payload (Formbook)", "value": "03610e21a01afd8dc19c986d69a4c13eeda93fbec0e6eae7828065781ca028bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646135804, "uuid": "0c2ea7c7-579f-499b-8898-e62353fe0d7c", "comment": "Malware payload (Formbook)", "value": "9caef11be00b7abb90728a4ec2c7b443cb4f150b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646135804, "uuid": "7fb97995-ccb1-4188-b74c-c4ce8705722e", "comment": "Malware payload (Formbook)", "value": "6b6c8f5e47aba0cebf9b3e95544971a44496ef1b09a507bdadb2e1430e820b3cc85dcc3bd10ae87a76d5d6245797c21a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646135804, "uuid": "9f72c5c8-3145-499b-8f8e-405f7cba5332", "value": "T16915AFE2FE905533C0271575DC0B93949826BDB03D2CDC4A2BE8FE4C3E355963A26A97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646135804, "uuid": "73e59c8f-67ff-489a-99d8-179795f0928f", "value": "33b94ee3884a0cf9c5e98b333fb633ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646135804, "uuid": "c99216d8-269d-428f-b26c-dde3fdc579b9", "value": "24576:/2x8NS5kItun5zIJjhBmaZce1aZME0W19d0:/QhB/CMEz19u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646135804, "uuid": "ee87a395-ea03-4f32-a4ae-650376ea7cd9", "value": 905216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646135804, "uuid": "9d63901a-6b24-4cf3-a49a-baf9d0e061a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646135804, "uuid": "e252b5cc-a9eb-422e-a32c-c049d7837379", "value": "Se ataseaza factura, extras de cont.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26b179bf-9934-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646120980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120980, "uuid": "8015779c-d775-43ab-85a8-a20fd6464fd2", "comment": "Malware payload (Formbook)", "value": "5f48741f51461e23d99522efc2076e9d", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120980, "uuid": "705c75f2-c28c-45f8-a9e8-c69cf58bfccd", "comment": "Malware payload (Formbook)", "value": "0390a495ee9267d9248648fede31fab542e336a855e21425f3034e783ce5bc6e", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120980, "uuid": "e9c0ad15-8f2c-416b-984d-74af4929e67b", "comment": "Malware payload (Formbook)", "value": "8c7c4659015c4fc0aac17db82fb44ec19f210742", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120980, "uuid": "faab8abd-b17f-4646-8009-809be6f9c2be", "comment": "Malware payload (Formbook)", "value": "e8db79e84fa31c3f5a95616e4de720d5b141d307e7fb3297f5ffd21bfe92f502020973313b5f603521ec4527605d37b2", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120980, "uuid": "1461af4d-c3a5-4300-b0ed-44676f816c54", "value": "T11814120B65167771DAE947BFD0DCE24B9070BE327946440134D5FA18EAB81FC8217BBA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120980, "uuid": "3c0c35f2-41e5-4085-8dae-64c4b9ad6916", "value": "3072:i0ZLYvyR575OztTlqb6o+otSKgD/8Y7mDjVdcOHLOlXhwXV3vv:18O7mhly6o1jAlK3VdcQLUxwX5vv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646120980, "uuid": "820f1fdd-690c-4a54-8677-1b71e9611d41", "value": 191048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646120980, "uuid": "29317386-a28f-4cfd-add4-48946e51239e", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120980, "uuid": "b85b9249-5832-48f6-bf80-8c2da2d62321", "value": "Purchase Order No. (PO-4147074).xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ae2825c-999f-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646166970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646166970, "uuid": "25cb7002-2219-4def-96a2-009c6a69f9d5", "comment": "Malware payload (Heodo)", "value": "a345fc5d54a52b4730b908fed5f5c7a6", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646166970, "uuid": "c6850fbe-d277-44e8-8a4d-82d2adc621f4", "comment": "Malware payload (Heodo)", "value": "04107341e719035189bf08266497fc88e541afec9403d555724c21bcb876a4de", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646166970, "uuid": "af4caea8-7849-4689-af29-d3662fe5870f", "comment": "Malware payload (Heodo)", "value": "ce831661aa0344620fca2ab4c5e7052b74f75153", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646166970, "uuid": "c7e74c9c-5fcf-45b5-9e5e-0fb7bcdf64dc", "comment": "Malware payload (Heodo)", "value": "17589f6f93084b2a310eb3b46c0c58e52fb6dbf63cbf3ed5c4f39e367df1b62e1a20fe61b3a59c3b741d3d56ab8fc2f4", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646166970, "uuid": "1ca84540-dd98-46e5-a2c5-36570cae2574", "value": "T12523D025C1607828C73E8C759200EAD2720A7D04D9D5EF893585BB4C3B96BEB57AF9CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646166970, "uuid": "af973703-182e-4dc0-b563-16c4724b413b", "value": "768:Sio9DOevZCwrvtD608zdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Uh0VPWft:Sio9D7UtT5fTR4Lh1NisFYBc3cr+UqVC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646166970, "uuid": "b08c2c50-a032-4f45-8a76-5a62362baa49", "value": 47699, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646166970, "uuid": "5cb9bf2b-8f93-4929-9742-41352ba5f9e0", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646166970, "uuid": "231bdda0-7328-48e1-8f28-4893852c44c0", "value": "Ommega Online Publishers_2.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99e52da1-98f6-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1646094545, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646094545, "uuid": "a0381531-50df-4564-92f8-26715761ee50", "comment": "Malware payload (Loki)", "value": "552c7651cb832966097e4f78d7ba332d", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646094545, "uuid": "da50649f-56f1-4bbc-9877-c1b42b2a7797", "comment": "Malware payload (Loki)", "value": "04151b443166e15f03c271d758e91846ba9ec46ce3be262625b0d15cc2a0b7d1", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646094545, "uuid": "1f88cf02-099b-4be3-ad69-cf21b27973c6", "comment": "Malware payload (Loki)", "value": "4e21a98bec6ec8dadb8c80c6ed4f9609c6c9bdcc", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646094545, "uuid": "ef0d83c1-dbf7-4321-8b99-892094a14dfc", "comment": "Malware payload (Loki)", "value": "f678fe4d9de0e86daf6b1184a6c7b62be7ea1f4b30db8172395407223375089f87d752247c1740c309d60c6870ef7181", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646094545, "uuid": "892a283d-068c-4062-968d-2d4f0992cf8f", "value": "T164140251FB78E075D9AC737D9C8384588BF0CC146E6DF997268C3E08E8BB9647528D22", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646094545, "uuid": "885ab3ef-5057-496c-b6bd-668784b9fb18", "value": "3072:v0SiAD1S5DRRHkpH5QSanr8qrFYeTkEY0//ymJ+Tg4YGIMA0IEmvB1H:A8I5NREpH5QRr8qY8TY0/6mJSg4m7B1H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646094545, "uuid": "eed94840-efba-4558-a855-2173c2318f85", "value": 190664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646094545, "uuid": "fe1f88ac-9dd5-4edf-b114-af2df3aabe87", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646094545, "uuid": "0df447e9-4504-4461-a15b-7566cd558e41", "value": "REMITTANCE ADVICE [REF0000360261].xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c131bb19-9977-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646150016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646150016, "uuid": "1eea9989-702e-4fed-a599-1eef80037c7c", "comment": "Malware payload (Heodo)", "value": "661d79d6f2935cad333b88211564742e", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646150016, "uuid": "aab38083-895e-47aa-8900-71d803df9b7d", "comment": "Malware payload (Heodo)", "value": "047a55d1c1dacdb685ea2e7000e64d0a7067711cec92d187c1e9c27f2c5ca137", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646150016, "uuid": "1e321715-fd8d-45d8-b397-c427b55f6f97", "comment": "Malware payload (Heodo)", "value": "66e5c983ee925c3d2ae15c73d4c08184e3c3ce71", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646150016, "uuid": "9e5cd2fa-9bad-4d90-90ae-5a7139fbfd17", "comment": "Malware payload (Heodo)", "value": "b9a2d25b43292ec58486ebfe76ca184f7da8b219c81b64cd3dcf2506c4c5012427c8299cf943de344a9f79456da9ad02", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646150016, "uuid": "9cfc5199-c5bd-48c3-8225-9118daebc040", "value": "T15523E129C1606828C73D8C759200E6A3720A7901D9D5FB893586BB1C3B96FEB53AF5CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646150016, "uuid": "3fca6158-d75d-4eff-a98f-550a2dba7aaa", "value": "768:myMo9DOevZCwrvtE9WzdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Uh0VP9HW:XMo9D88tT5fTR4Lh1NisFYBc3cr+UqVk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646150016, "uuid": "09d7a855-42b7-489a-957f-70e1d03d01fb", "value": 47703, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646150016, "uuid": "734ec393-333e-4e9f-92a8-9a3c7f01429e", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646150016, "uuid": "1685fcb5-b60e-4e17-9eac-075d46990fb5", "value": "FILE_030781.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "577cf002-9936-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1646121921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646121921, "uuid": "fd786916-98b8-4dfa-9aa7-e0acc2f59679", "comment": "Malware payload (SnakeKeylogger)", "value": "8675c4bd39363486ec0cc1a027952113", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646121921, "uuid": "b0fd1026-79b9-41c6-884b-44d1d50dcc8c", "comment": "Malware payload (SnakeKeylogger)", "value": "04e0bf1eb79feb7b5d733dd5fcafc576b29ab9c1c23261b46e1e94b44ace16e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646121921, "uuid": "b3a319c7-0e46-4288-89af-ca0e1e1d6d90", "comment": "Malware payload (SnakeKeylogger)", "value": "09465959f0bbebbe62ed0a6d9cb5472f5b622d6f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646121921, "uuid": "17c5dc15-07b2-4d83-8cf6-55acde8dbf30", "comment": "Malware payload (SnakeKeylogger)", "value": "9d843018a18845eac658f9cbbe3d78912b7714aee50e430a22c77816bd8eb773dfd768cecc70a2c838228fc0b0920e78", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646121921, "uuid": "d53d97c6-81fa-4862-8426-b0bfeda1bcc7", "value": "T10EA429EC31E231FEC8E7C4B9E9641C69AF20787A830B9217505312AD994ED97DF171B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646121921, "uuid": "5a5492c4-9fb4-49d9-aa23-3262d658fe7f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646121921, "uuid": "201fff0d-551b-45ca-98d9-e504efffe6de", "value": "12288:+ZMtLLSALu6RZzfsliDTB46uxl5z65XYsTdavUb4T04T:0MBTRZz0luH4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646121921, "uuid": "93534976-1a9c-4500-b6fa-1fbbb8507740", "value": 473600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646121921, "uuid": "57cfa1d9-ccf0-41a2-b4ba-3b34a839a1ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646121921, "uuid": "a84bf1b7-66ed-4ede-a6de-e3b850ec992c", "value": "PO22020035.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8520bf5-9977-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646150028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646150028, "uuid": "7ba93328-417e-4cab-98c6-fd8c168c18b4", "comment": "Malware payload (Heodo)", "value": "bed76697448af4d52fb82e8be0450d7e", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646150028, "uuid": "fa014cd7-8c68-4293-93ad-01e174b0f6f0", "comment": "Malware payload (Heodo)", "value": "0502cf3abedc4924f4054f6b02ca534678a5096da520f55a6e6bb2bb5e76c8f9", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646150028, "uuid": "a4ac6045-ce00-4f84-b4eb-158f8682fbe2", "comment": "Malware payload (Heodo)", "value": "6d514b58e9206bad61c81b1c8dd5c07b4988d673", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646150028, "uuid": "b410a699-8d7f-48b2-b251-081dc3f239a3", "comment": "Malware payload (Heodo)", "value": "57224f394fa3fb9cabe628584e74c3a73c35c8a99a512059f8e5bca306b728887f2854dfd1e8f13dba1910ce895216ce", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646150028, "uuid": "47489ff1-56b3-4dcb-8ea0-0fa57c40c9c0", "value": "T1F823D025C1607828C73E8C759200EAD2720A7D04D9D5EF893585BB4C3B96BEB57AF9CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646150028, "uuid": "8499561a-aa76-4721-a090-f1d2150befde", "value": "768:+io9DOevZCwrvtD608zdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Uh0VPWft:+io9D7UtT5fTR4Lh1NisFYBc3cr+UqVC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646150028, "uuid": "2ad11a00-41d3-42a7-993a-3ff48c5a2ffe", "value": 47699, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646150028, "uuid": "063fd24d-7bfe-43ce-8a4e-ff4f2314ff3c", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646150028, "uuid": "8522b245-7613-40bd-8faf-e0401e7461ad", "value": "Ommega Online Publishers_1.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "443559a1-9985-11ec-9275-42010a9c0029", "comment": "Malware payload (RemcosRAT)", "timestamp": 1646155819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646155819, "uuid": "8e3e494e-f9fa-4f0e-9fcf-e11a06bf619d", "comment": "Malware payload (RemcosRAT)", "value": "6c91c18406edcdf43b99259c75e97e98", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646155819, "uuid": "b69c0deb-2c26-4024-a4f2-dafa35a0215f", "comment": "Malware payload (RemcosRAT)", "value": "053b1db6f8456d02ae045f74602aa44eb5254da326a07c3e6ba604bbbd683739", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646155819, "uuid": "a6e26a3d-a383-494a-aa55-a4d77879b715", "comment": "Malware payload (RemcosRAT)", "value": "b955548fdbe22c84e147058adc286cb03e221d2c", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646155819, "uuid": "778f853b-740a-4a72-9a05-613d9d47caaf", "comment": "Malware payload (RemcosRAT)", "value": "637cceb5928967a9c9eb55fb932fbadea205b1ea33576a422ac3ec5070b17911ae2650ce9b387d90fa5829da60294465", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646155819, "uuid": "51d8ec40-096a-45f4-a376-a588ee225ec0", "value": "T1D8F273A2B2D2D80AD999077A4CE6C7E66726FC616F53D34B3285F70E1F71AC08903617", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646155819, "uuid": "848f5e5f-f90f-40e8-8193-17127a10d379", "value": "768:Eumk3hOdsylKlgxopeiBNhZFGzE+cL2kdAJF6zLQNs+Zpg+CQU0:Uk3hOdsylKlgxopeiBNhZFGzE+cL2kdI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646155819, "uuid": "de13f006-abfb-4239-bb91-f3598ea6c265", "value": 35328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646155819, "uuid": "b0cd0979-d5d3-41cb-beb5-485dae3e797f", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646155819, "uuid": "ceda29d9-742b-4b5a-93cd-150f7beec4a5", "value": "Direct deposit.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8ccbb7e-9933-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1646120769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120769, "uuid": "39bf0998-0a1c-4644-bf74-b209461322f0", "comment": "Malware payload (Loki)", "value": "fb35a65ed5ba260466f706a53fe8a851", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshopVelvetSweatshop", "colour": "#F8F749", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120769, "uuid": "6226a0f4-331b-437f-bddf-49e9fb4ce05c", "comment": "Malware payload (Loki)", "value": "055249b8cf3ddeeb5b5ea0c547184e4fc51ca830e66448778bae3632bfe89679", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshopVelvetSweatshop", "colour": "#F8F749", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120769, "uuid": "f3f3bcc4-be72-4da2-b0a6-aafb210828b0", "comment": "Malware payload (Loki)", "value": "af150f2f862855d1c6792f9ed531938f03db17dd", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshopVelvetSweatshop", "colour": "#F8F749", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120769, "uuid": "e0bc7a7c-721f-4a8a-8928-0f854d08f3c7", "comment": "Malware payload (Loki)", "value": "74f438427e11cd82acdc11f1c1ed111bea4b473379de1cb648318cb8ca543b3bf5999c792cfdbe8ba32b706b6122a9a3", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshopVelvetSweatshop", "colour": "#F8F749", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120769, "uuid": "be73bbc6-5203-4545-b64b-63666ba1710e", "value": "T1DA1412D2E1826A67E4A70379A5F84010E32DEE2DDB85A1AFFD3E7C181F795205310DAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120769, "uuid": "26b50a4c-920d-4a6e-ae01-0e22f93dfb90", "value": "3072:e1D709VXr4cepXKcd68BD2Hfr2ZCbNa5vATgFDLHTcVZH015w/RTB5aEXrx:o7upMMcBD2/hbmoivcVZjR9hx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646120769, "uuid": "ad44d0c3-0bdf-4624-b7e7-1513aefed659", "value": 191208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646120769, "uuid": "205c459e-e34b-4bf4-82c7-6a7c3f5fd62e", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120769, "uuid": "00b29349-8c87-4b12-b6f9-94e841d4e8c4", "value": "Updated SOA.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "266e6c54-9986-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646156199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646156199, "uuid": "007dd31c-2519-4b89-89c7-9a53963e8952", "comment": "Malware payload (AgentTesla)", "value": "f8f6fe6894a0e0724b2c060cbe595905", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646156199, "uuid": "ef7fda94-738f-4c77-bcac-4b88a8f08c6f", "comment": "Malware payload (AgentTesla)", "value": "05b420950171f93f4134448b4c5e9eb629abee389291d49db19940a0734541be", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646156199, "uuid": "68e7a6b7-6f03-4e1c-a60c-778c9bd4c070", "comment": "Malware payload (AgentTesla)", "value": "468e048c51312f3ca94681f5e231ccce9e853047", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646156199, "uuid": "8875746f-aeaa-46e3-88ec-8ee94e6b91f0", "comment": "Malware payload (AgentTesla)", "value": "94313780c67954acfa9397f768ef4597e8041fb2d2a16a3e94d882cfe813d540c917515b6df31a2947cb0550373dcb08", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646156199, "uuid": "d947511f-0b04-4b33-9060-5b75d6e7ee8f", "value": "T1AE0413E310C466FAFC0E7072C50D67A822E659995C6EA749A7CBEF065D3F084884F5F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646156199, "uuid": "c61cedd4-bfdf-448e-bfa0-2060eaf60dec", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646156199, "uuid": "3d560cca-2675-449e-adc1-255697a0b393", "value": "768:FbVQ2hKUPWzAzoYIltXwW0+o6dW5Fza6POey4ocEYO:FbVQ2hKsWzAz6EW0+3d+LPOe2cNO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646156199, "uuid": "8488511e-1f7f-4208-8455-d4844124e03c", "value": 179200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646156199, "uuid": "dfb81fcf-7b2c-447e-abc1-296e3978dc77", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646156199, "uuid": "1ee9d900-e909-45c5-bf5d-5bbfceb99f46", "value": "AWB DE DHL ADJUNTO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "674638cd-996d-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646145570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646145570, "uuid": "8da2b1a5-a4d4-4b10-8bf0-c83395728811", "comment": "Malware payload (AgentTesla)", "value": "f22be04cf93e08f738cd616ddb7d4ae1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646145570, "uuid": "4bef55d8-45c5-4e36-b287-56f07d89a71b", "comment": "Malware payload (AgentTesla)", "value": "066cea1ffeecb5b2de6efc2dc6211546be72984620a953aad49e0936a6055797", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646145570, "uuid": "b2954875-70ef-4944-88de-ad689a619139", "comment": "Malware payload (AgentTesla)", "value": "dc2e89dbdadb1cb608ed7361e821f47c2f40c81c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646145570, "uuid": "f354ec2d-b0ad-4340-9ef6-b505edda1f4f", "comment": "Malware payload (AgentTesla)", "value": "9f229ef5fe9a4620c0c55c341c2f388c7a5b8eb8359ee9202c2871847bd784af9fae831f89652bdfd84477fba34030ff", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646145570, "uuid": "cab3d6e7-329a-4d37-8559-8ce9aa1dcc90", "value": "T12315BF4835E6603DE8368BB2CAC0EFF0DB69F272D54960B650020E19960DBBD8E55DFD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646145570, "uuid": "d08a9cd0-bbe0-4e6a-9a51-cd733072da97", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646145570, "uuid": "d7be8ee2-aa0e-44da-b94c-046746146a9b", "value": "12288:5KP2wMwn5qOy86K9GbuLfgLXJUmgS4g0TW8u0aoQK/ej8LrPQHihvAJQfVW3RgI:lwMFO+yAX6mgSPh8lqj8vU0A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646145570, "uuid": "ca9f68d9-ab80-4ebd-8732-81707621ea73", "value": 952320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646145570, "uuid": "363e05c8-0cd3-413d-b40e-bb2b7777ff51", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646145570, "uuid": "9ba1aafe-6fd7-48e2-81db-bd31ad2e666c", "value": "SHIPPING ADVICE#202203.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8010a3ea-9958-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646136592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646136592, "uuid": "b3caee55-9bb9-46f6-9fdc-3c13e7275403", "comment": "Malware payload", "value": "b0770094c3c64250167b55e4db850c04", "object_relation": "md5", "Tag": [ { "name": "Daxin", "colour": "#652B35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646136592, "uuid": "fc6800d8-d9f3-4f0c-be98-38a38bb89d2f", "comment": "Malware payload", "value": "06a0ec9a316eb89cb041b1907918e3ad3b03842ec65f004f6fa74d57955573a4", "object_relation": "sha256", "Tag": [ { "name": "Daxin", "colour": "#652B35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646136592, "uuid": "79d65b8b-bf45-4690-898e-b3113a743eaa", "comment": "Malware payload", "value": "6abbc3003c7aa69ce79cbbcd2e3210b07f21d202", "object_relation": "sha1", "Tag": [ { "name": "Daxin", "colour": "#652B35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646136592, "uuid": "00c23983-1158-4d72-9dff-6b6d099d661f", "comment": "Malware payload", "value": "29ce5713b0204485257dedaca8615bc621de53d7f54b977e87e77c352c9d5280fd5efb1b143294ed898db8be878062d9", "object_relation": "sha3-384", "Tag": [ { "name": "Daxin", "colour": "#652B35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646136592, "uuid": "4143e4a6-cc5e-4186-bfa5-a6775faf6637", "value": "T177636CCA22A41079D4BBC27DC9A1963FE7F2745113604BCF826147EA1F13BE5A739325", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646136592, "uuid": "6f96779a-22c9-4276-aaa0-94761f183c64", "value": "c32d9a9af7f702814e1368c689877f3a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646136592, "uuid": "a7b35ea4-e499-4db6-b843-9986309652c1", "value": "1536:4RM1VWgS1lYpKCNTzc8jt4riPJdBnH2dXDGZ8W8tGVxJ:4hgUup7NQiP9H2dz08dsVxJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646136592, "uuid": "5b7d8fb9-8523-4d7e-9dea-0dd029049f85", "value": 72272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646136592, "uuid": "c6449a4f-89d3-445c-b464-918b122651a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646136592, "uuid": "a47cce70-3b4c-4fdd-9e28-06d123da1023", "value": "06a0ec9a316eb89cb041b1907918e3ad3b03842ec65f004f6fa74d57955573a4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d1b57f4-9966-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646142439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646142439, "uuid": "c2bfbc14-4f8d-4c0d-b30e-49c81a89668d", "comment": "Malware payload", "value": "0c7da79b4d340c6098c183114d165908", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646142439, "uuid": "1a19078c-2dde-44b3-a479-651cb8bf8547", "comment": "Malware payload", "value": "073ad18e2cbd3d00aa27a93fdef6c11c7256a39674d5c7e961420dd6acec1e85", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646142439, "uuid": "46592d20-7b76-40a0-ad6c-27d2b02bc8a2", "comment": "Malware payload", "value": "886238787f32480140afcfd1d95e854e013660c4", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646142439, "uuid": "d8b99e25-338d-4c52-8751-458ded63d379", "comment": "Malware payload", "value": "6d943edc697db977c49501a4c292fdb7891b2841955b6409e222cabe0d30f687473a5c66dcf88f78c80d00feae0b1924", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646142439, "uuid": "f928d381-0a1c-4d3c-ba81-95c9350f61d2", "value": "T18165E082B3C5FC2FCC7384364B7A8A6A95864C46C646D70759A1B52C4EFBEC09E45FC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646142439, "uuid": "063fa8c8-8b9e-4a24-947c-e644c11d96af", "value": "24576:DTHe10ERs6LffIQ7xDNKo/D6qeP72/3ePq920qIPGNrt2gJJOgv7acG:3HC0Ee6zIQ7JcP7euS9jqIPGzBOgv7g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646142439, "uuid": "8dc857e9-ba12-4b33-8302-c93e56d03e5a", "value": 1493656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646142439, "uuid": "3726990f-bf76-40ee-85e7-dfed7789ab20", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646142439, "uuid": "bfb1ba7a-a6c5-44b8-a4e9-74c0002bcdc4", "value": "postbank.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86034455-9991-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1646161083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646161083, "uuid": "c4094934-6f41-4c02-a844-c9e1ac704cf2", "comment": "Malware payload (Loki)", "value": "6a29a2c1ae343b6ed805022392021d68", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646161083, "uuid": "3be47d4f-4c50-43c7-9c80-77ae5f963aeb", "comment": "Malware payload (Loki)", "value": "082565f03fa8f59b87354a271edcf92c6559472043e21fef60a47cfc6072f495", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646161083, "uuid": "bb6f7d1c-b861-48d1-9114-4171cfa4f1a4", "comment": "Malware payload (Loki)", "value": "1dd0355ae71beac51cfdfbb19cd76ac6b1ad242e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646161083, "uuid": "d9f84ae9-2b3e-4743-8029-836d86da2237", "comment": "Malware payload (Loki)", "value": "3c5abbb49f7f7749ab6350b3bfa6dcac518b8068b3afee045173c44c79c7497c521afd82efbf572f78658509b3fe1fd6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646161083, "uuid": "090361a2-2ed0-43a5-b67e-699668029878", "value": "T18664AF10B6A1C035F9F712F899BA83A8B63E7DA15B6560CB62D417EE16347E0EC31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646161083, "uuid": "080031a0-0015-44cd-a9fe-8f24afdd42fe", "value": "803999de15851b525de7455d6fbe3205", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646161083, "uuid": "11206ead-8d23-466d-9d67-2cfa7238a959", "value": "6144:exz38wM1I8k+s7fQAqBl/Pj+0U9eSADc+szi4Ii:U4P1I8k+aZqB5Pj+0qABsAi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646161083, "uuid": "eaa128ce-6538-4b77-8a30-820dbddafb2e", "value": 334336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646161083, "uuid": "1539fa87-d55a-4824-80eb-e3a6e89b5af6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646161083, "uuid": "6d5504e4-8dfc-4d97-959d-ab5286cfcbd0", "value": "6a29a2c1ae343b6ed805022392021d68", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1063a9e4-9943-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646127385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646127385, "uuid": "c61a9ffd-3691-4c4f-b93f-87891eb57f3e", "comment": "Malware payload (AgentTesla)", "value": "b764aa7a59456bc76d2e69648c255738", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646127385, "uuid": "3c79eeb3-6d52-4482-8aad-bab4f33234fc", "comment": "Malware payload (AgentTesla)", "value": "0891474b47a810d81f01bea2427d691acb19c48d3b929fbff578c46b5629d1a2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646127385, "uuid": "ecd849f6-4ab9-4b4f-a0ea-1f34e2ad29d3", "comment": "Malware payload (AgentTesla)", "value": "a5fba2745936d706e44280c16680196538f7898e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646127385, "uuid": "0bad8a92-2cdc-48a6-94c3-3ff506446d96", "comment": "Malware payload (AgentTesla)", "value": "6e8b257e1e8acf5100d782edc0ba0f46c7b7fa7807cff7e2e149d054f7a1933b9a0e81509ce1d641c7585cf454b04d40", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646127385, "uuid": "cb57d0c4-db1d-4c72-8da8-808c2327e47c", "value": "T1A37423447C21B1F4217CFDAB3BE314B9CA62AECC7A422D1BA5AC084E31FBA55D07C155", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646127385, "uuid": "bc3a7f55-ff0a-4d6b-8a6b-36254f23421b", "value": "6144:bDjpM8/Jq/iE+czaz98/xwIKWjFnAMLFhpJhovXGo8ktnNKFbWv1TS0/RpHD:vS8/g/iE+cGz9+KWppLFRhofCynNK1WZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646127385, "uuid": "fba90d6c-4f85-4913-8531-92a21667ea39", "value": 353531, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646127385, "uuid": "8df56053-8620-4aca-94af-1247d4fece78", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646127385, "uuid": "7e6fc4d9-9753-48db-ac24-6f0cdfbbd008", "value": "proforma Invoice.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64eea17d-9961-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646140412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646140412, "uuid": "f75254bc-7ca1-4a02-978a-4905eeb37800", "comment": "Malware payload (AgentTesla)", "value": "3678845a361040b7a6c88231692bd2da", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646140412, "uuid": "c351466e-f289-4aa8-a2c5-e37e9d5cd616", "comment": "Malware payload (AgentTesla)", "value": "08a20aa75af104d8e348e752caeba05b7cc9757a5ad2edaaaff96659933465da", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646140412, "uuid": "c5be836b-24a3-4e80-a376-980c7f61f314", "comment": "Malware payload (AgentTesla)", "value": "fcd300be87d22f9f407722a5bbbe8676bcecf8cb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646140412, "uuid": "de8ed451-544b-4e86-982d-c51326e36119", "comment": "Malware payload (AgentTesla)", "value": "610475adf07f2a5c55a7d83269eaeec3ace304c0004c4c650150af8f731ff6dd066356197818e1ab4e0194dc699710ec", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646140412, "uuid": "3d24feb2-25cb-4011-91b3-8286a848b188", "value": "T10B15BF4834D6207DE8368BA2CAC0EFF1DB6DF272D54A60B650020E59960D7BD8E45EFD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646140412, "uuid": "3be7290e-4063-464e-9880-c1e027f3a0ef", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646140412, "uuid": "230ee242-8103-431a-b6dc-98b9ebcb50dc", "value": "12288:mTF32zZlvuPv92s+lzAqpjxfPFCfucl86+66ZH0+aoctgHmsFVE7AImRvt:ndpkv0syzpjtFCfucm62CyG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646140412, "uuid": "bd2bd358-73ef-4a2e-a24d-1dc5720320c7", "value": 939008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646140412, "uuid": "808601bb-2388-4b3d-b670-d73782db08dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646140412, "uuid": "3dc7877f-e8fa-4fb8-837b-d987b19f9290", "value": "Quotation..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2722ff60-9938-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646122699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646122699, "uuid": "1bab1443-64c6-4d67-9807-52f136ecbb1a", "comment": "Malware payload", "value": "7041faf49f4055939c08faa5c490cd69", "object_relation": "md5", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646122699, "uuid": "d7f057b2-0ca2-4c3a-b8a2-56acf1495341", "comment": "Malware payload", "value": "08b6a5aa70405dd991258d4994a6154993dc2be986a95992aa76d5c032b2e2a7", "object_relation": "sha256", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646122699, "uuid": "28e14f6b-596e-4532-b0d9-5115706c1865", "comment": "Malware payload", "value": "15da060c453cad20c78ba3da04b06c17a7163a7f", "object_relation": "sha1", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646122699, "uuid": "84818fe6-0557-4729-86d8-758a4e6a3fdc", "comment": "Malware payload", "value": "c93a87edf3f3f34544c7c42d41216424ce910254f2dd4a413907b9eb1a18f4998fbe0fff44d7f27c65cd3caf340e6c24", "object_relation": "sha3-384", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646122699, "uuid": "a44dfe65-e13f-4f90-9abb-9b69f6cf31c5", "value": "T123C2C0F65F523668C346083B062299026F243857C782BD179F7C2B7C99C1ED516ABF8E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646122699, "uuid": "6084d486-050e-4516-8612-3ac4a5b2e3b0", "value": "768:yusisp7RHizQYeHeCBcaC34jImh7LKMiAaV:n4eHezsKti3V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646122699, "uuid": "64b4ada6-8f64-442c-ac8c-ff6f72346ed2", "value": 27933, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646122699, "uuid": "dfb93427-c1a1-4f06-93d0-5ec106579df6", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646122699, "uuid": "4a519d70-a338-40ad-8b32-1a67e929f6b9", "value": "IMG-0077520021.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd7240ad-996f-11ec-9275-42010a9c0029", "comment": "Malware payload (RemcosRAT)", "timestamp": 1646146681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646146681, "uuid": "221887db-186d-4c9f-9d44-8eded8987321", "comment": "Malware payload (RemcosRAT)", "value": "5e970252d4033995da802f53b43c4ac7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646146681, "uuid": "c4b18663-2b1c-4091-b759-6a0cc9044dc7", "comment": "Malware payload (RemcosRAT)", "value": "0923b8a77c108fcf3a136e53a340c5d4f469ed0bf4667167986850e61d7d75cf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646146681, "uuid": "d5540043-43fe-4999-b985-7ef8a903cead", "comment": "Malware payload (RemcosRAT)", "value": "7839d322a47aae8b21cd8f0eea29f5e0a17c1689", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646146681, "uuid": "3529956e-6d39-4c8d-9a11-43b79790efaa", "comment": "Malware payload (RemcosRAT)", "value": "4fe5f6771ad66b778a157ba06f57db35b2fe91d63a1c4608edf83a0420ad1003fd34570609a54ec6ef6ed77111e8a51a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646146681, "uuid": "f99ce97e-c022-4eb5-bb20-90a6913885ad", "value": "T1BE254888ADD49166D85B5BF3E532FB3116232DA9687AD43D24C93D1FBABF38250D1023", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646146681, "uuid": "eaef475c-357b-41db-8b14-1149f01d5e51", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646146681, "uuid": "27f09d9e-72e4-4db0-aafd-8fb5d94be875", "value": "12288:lP7r9r/+ppppppppppppppppppppppppppppp0GR54afshwqMIlZ+jRBqIibmWUy:l1q+H9kjj+Jq36jD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646146681, "uuid": "273dc502-e861-4f7b-a1e0-8d78371b53d2", "value": 1044992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646146681, "uuid": "a467430c-2fe3-40fc-8c3a-7171cb0c72fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646146681, "uuid": "d3c16e34-166c-470a-a3fc-2c1dffbc894a", "value": "5e970252d4033995da802f53b43c4ac7_Attachment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da662b36-9985-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646156071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646156071, "uuid": "797fd180-580e-4726-9406-0abf42412c49", "comment": "Malware payload", "value": "23b0c39cf7b848f7d9334d254d8af819", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646156071, "uuid": "c337cf52-2f3e-45de-8b9e-2e4f664c2398", "comment": "Malware payload", "value": "09575f6f1ac1c0d216367d8fe34a1b4a18da3a75e1fb5f67bf055987168559b3", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646156071, "uuid": "5863ed0f-a8d6-4526-894b-08d4c023f981", "comment": "Malware payload", "value": "215a6b66ca0b4201c4d59bea079d4ebc3d62536a", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646156071, "uuid": "a81e1b9f-d62b-4a71-921c-22078fed2a10", "comment": "Malware payload", "value": "b245cb860b0684b0147115818d47dbbefb846e10c04dbf6fe8164e790d062232cca5b1be6a81cc1145dfb41dcf443f9d", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646156071, "uuid": "5e1d2cf8-c911-4a03-b82f-ce018d46bd5b", "value": "T14514029E6F80100FF45A02394DAAA7AF895BFF22DCDD45D22F15776D9F388830AE1911", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646156071, "uuid": "50639eb7-7009-4739-a815-a493c0f02319", "value": "3072:xyUuwgxsid/hcKo5fP3UcRryirtszTuCKg9kGJzlePs6o7TkLZJzec6SQ7cOx5E:s1dvc9URig9LMPsxo1JzpuzzE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646156071, "uuid": "fac0a5a5-8774-4cb4-8a1b-9baf4ecd32a2", "value": 190424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646156071, "uuid": "7aea25b4-7a04-4ed7-96b9-e10802cd6177", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646156071, "uuid": "bd69cb7a-8fa1-4966-8f61-c4718f9a48b0", "value": "Bank SWIFT.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "301f3d16-9985-11ec-9275-42010a9c0029", "comment": "Malware payload (Socelars)", "timestamp": 1646155785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646155785, "uuid": "47620665-78b0-49a1-a997-ed420a2ca9cf", "comment": "Malware payload (Socelars)", "value": "a926c1e881026eac591bf08f11192a49", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646155785, "uuid": "626e8af2-b68a-4d14-9144-f518ece3b437", "comment": "Malware payload (Socelars)", "value": "0a4b8b4559af068428de5f6defc6403cdff417ad86773cff9032f84283e647d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646155785, "uuid": "b0e60ba2-8611-409f-9d8b-f216ffd964fd", "comment": "Malware payload (Socelars)", "value": "1ce4be22200c8285e390d3d9301a5424a7e1dede", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646155785, "uuid": "65708145-1396-4c20-97ed-fac59bb5e78a", "comment": "Malware payload (Socelars)", "value": "4ba8b9f37e857fc4bfa3ce4d80019027711ac24d57239e40f0df91eef30dfd0b4687e86827f51963c44cf7dd922f6fce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646155785, "uuid": "10f937d7-d458-4091-aa78-76743bd97f1d", "value": "T13565AF11F642A037E8E30172C6FF4AFE8D38B622131854D7E3C45DA95E619E27A37A17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646155785, "uuid": "37caea3e-471f-43f9-a56a-85ad3f44c1c6", "value": "d69e4c13e25f0ad622344ac56118c0df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646155785, "uuid": "9e3f9be6-db17-427f-89ce-828c4782e06e", "value": "24576:MIpJFhPeNHtsS67DN2AtU+w7hpt6IsveP0PIPMUY0UR2kYmu4KtC1WK7U:1p9CQwvnc20PI0UY5R2khu46YW0U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646155785, "uuid": "f38239fc-5a56-4485-8a4f-3c8f5925a5ec", "value": 1525248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646155785, "uuid": "c8a47c4c-d282-4b46-a912-b564d68a8a15", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646155785, "uuid": "9d5e86c4-4075-46e7-b27e-29e35bb5e84b", "value": "a926c1e881026eac591bf08f11192a49.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a7729fe-996f-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646146273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646146273, "uuid": "2b5861fd-1d13-4450-8fcc-0a7d59130969", "comment": "Malware payload (Formbook)", "value": "9294a20eaa0b1e4bee3cc3a19ae7c679", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646146273, "uuid": "87ad3f29-039c-4139-93ea-ee1222a2a542", "comment": "Malware payload (Formbook)", "value": "0b32f79b8abe4a232193f819dccfa47a922353e961d37d1becd35171c2b04a89", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646146273, "uuid": "52d55d81-7e0d-4b47-8fc1-c1c6ec11721d", "comment": "Malware payload (Formbook)", "value": "1e0e9802d1a2d6d1dbb5f4c17ab65d3e2f8fe0fd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646146273, "uuid": "a3e91ded-43ac-4f8a-9ea5-d99665eed398", "comment": "Malware payload (Formbook)", "value": "4dfa8ac08028ced8c128b3c2b2bdd552c5628f4718220c703c8c0d6332524016fb9071c2cda3131b5de888f3ca97ec77", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646146273, "uuid": "cc029429-b39c-47f8-bb9a-12d20dee54c3", "value": "T11905AF0438EA5138F8368BF1CEC4EBF19B6DF221E44971F554000E559A56BBC894AEFD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646146273, "uuid": "7b2850f4-1c42-4547-8278-8becd9da4acf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646146273, "uuid": "1c46be96-22a7-4bec-867d-ce09133af19e", "value": "12288:iEMIR/IpVrOAXbgvDiph6hgvyilaOXwZKXbP5+usTwrXgmmE++4uiebzk70qOvO:sbbMmchQla0YK1+uEIXFD4Jefk4q2O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646146273, "uuid": "39fc7c48-54f5-4eb2-a828-212aef421b04", "value": 804352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646146273, "uuid": "2c47944f-3cd0-4f5b-afa9-1f67d737b931", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646146273, "uuid": "63bc552d-81f0-40ea-b7ce-d25bb64a1d1b", "value": "obizx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be3123b6-9989-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646157742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646157742, "uuid": "862d35b7-8095-4d88-bfaf-7b11529b1196", "comment": "Malware payload (AgentTesla)", "value": "bd0e87b0af4c6bdcab0ae03b3704f4d3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646157742, "uuid": "6ea3ce88-7fcd-475e-9341-5cf107ec5a8c", "comment": "Malware payload (AgentTesla)", "value": "0b96b48acc4dae991a46897dbf912ee78b04b81182e5948ab4c0dd5991bd9ab0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646157742, "uuid": "e41f403e-2cfe-4774-91b3-acbd5b33412e", "comment": "Malware payload (AgentTesla)", "value": "cfe5871fed8aa8d4156487ddd626ae85936f8871", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646157742, "uuid": "72e908fb-8d02-4ff9-acd5-fbe8c2afbe76", "comment": "Malware payload (AgentTesla)", "value": "8c82f4be23fa3bae8dcf3f327290030e69a74426fb36b684f383974b1815433070e222e88785997f32e2c80e039322ae", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646157742, "uuid": "71a6ae4c-9853-4a34-a5f6-055b28a70fa7", "value": "T18715BF4834D6207DE836CBB2DAC4EFE09B6DF222D24961B650020D59960DBBDCE15EFD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646157742, "uuid": "241a5351-1b5b-4cf0-97bf-1d1e4d8981d6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646157742, "uuid": "edc39bc6-b75f-4300-b7e9-768b7ab9a72e", "value": "24576:J4XCf+tXdGbCLDoYtwrna4S94k9SwW9WT:J2fYbCLDoYtwLQuk0w5T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646157742, "uuid": "a79e1310-289f-417e-968a-18c3c9676a7b", "value": 927744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646157742, "uuid": "771a4bde-904e-4a79-8e8c-71d2dcd204a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646157742, "uuid": "7bf580cf-43b6-42c4-89e9-9ca5e64903fc", "value": "bd0e87b0af4c6bdcab0ae03b3704f4d3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "141a5b4a-9991-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646160892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646160892, "uuid": "d9ebb1a6-802e-4072-b593-5c407340992e", "comment": "Malware payload (AgentTesla)", "value": "413c0d9edfb754207c1b800fe44325e5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646160892, "uuid": "de72026b-83e5-4414-8ed4-5e86c60d5678", "comment": "Malware payload (AgentTesla)", "value": "0bac66d084a240c68ffa2346c5352d1bf1992d9b171157e62bd5ca2bf2ef38fa", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646160892, "uuid": "7ee4b784-078e-4cca-979a-a24de17d430a", "comment": "Malware payload (AgentTesla)", "value": "a1a35ff63f1def4593a8071cacc6667705e9bd80", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646160892, "uuid": "b870e9f4-37c3-463e-837d-7ea16774b623", "comment": "Malware payload (AgentTesla)", "value": "44b72d79ad0282988789e828e03e02af6327d2471e9b4bf16d8b1bd3c1d315b2246ff567266c14740cd63cbd53b27c69", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646160892, "uuid": "8f7c6ce0-046c-455c-aa52-b1e150285cdb", "value": "T1ADB4D04A7B3457A2C93D97342425520CCFE6E9A2C34EF2797CC6B1CD0176F4B8A2691B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646160892, "uuid": "f434b6b7-75c8-4000-a660-f5dae2ccf12f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646160892, "uuid": "4df0aef9-ed6d-46e9-8803-ac75b81d18f1", "value": "12288:AVvy6z7GRUcZ64scRm00dTS7VCv5ZRXrFDo3aP3TaVnWEa1xZdc:ABcUkRmZdTScv5ZzoE3TnEa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646160892, "uuid": "6f3e1d79-2c4e-45a1-866d-0adcc7809dce", "value": 539136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646160892, "uuid": "27029fdd-9f21-4492-be0f-c0aa2f290706", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646160892, "uuid": "bdff8447-cb1f-403f-b797-90914a53137f", "value": "202202281005.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2af126eb-9986-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646156206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646156206, "uuid": "eb21ecc3-9168-4ecc-9f28-a725f0288ab9", "comment": "Malware payload (Formbook)", "value": "c1fde0694a5a9bb14c383283a27e9ae1", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646156206, "uuid": "1f664b33-1339-4dd8-8494-2817d528b5fa", "comment": "Malware payload (Formbook)", "value": "0c592b998752863f20e1d0e4b452ea6d9e1bebcd7194260c4a2ae1840b248318", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646156206, "uuid": "45e4fdd7-892b-42de-b97e-a72659b4eeea", "comment": "Malware payload (Formbook)", "value": "ab621e288c023d90ea69f4fa102b24ff64255874", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646156206, "uuid": "efe59f8f-a362-40c7-aaf1-b1fe2077540c", "comment": "Malware payload (Formbook)", "value": "7fc4a0775325277ef98ed560fed8be857e181603a9def68354d3988fb431f76fb87d36da7a9882505dd65d80452ae118", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646156206, "uuid": "26cf27ab-c279-4805-9781-23d93cc72346", "value": "T1E3D4B056FA7ADDEAD4391338242041188FF2DED6870BF3E86C89B97D8430B43566593B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646156206, "uuid": "59783d45-fc42-42eb-8120-a5ecae5516ea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646156206, "uuid": "5ea51ea9-b9d0-410c-8ff1-ed7af6542904", "value": "12288:49ySdqGRUcZ64KcRm00dTZNn594sSv2xhlOi8diYA:/cUuRmZdTV94sSu9OZdi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646156206, "uuid": "4bef021c-d64a-4951-8cd5-8e02b946c5db", "value": 636416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646156206, "uuid": "bcb4fc5e-7e48-4bdf-8662-989ecd45f6df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646156206, "uuid": "e2d98679-3a30-4534-adf8-27eb13b3e6f0", "value": "DHL DELIVERY DOCUMENTS PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2490e3e3-9939-11ec-9275-42010a9c0029", "comment": "Malware payload (Smoke Loader)", "timestamp": 1646123124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646123124, "uuid": "64a5c953-cfc8-4c60-b35a-1dcd28c926fb", "comment": "Malware payload (Smoke Loader)", "value": "3bbd64e8b98fc05de574f14c3957cefd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646123124, "uuid": "5086d9b5-52e6-4bc7-b2ea-941bfecaa531", "comment": "Malware payload (Smoke Loader)", "value": "0caac87f0074ea07f387f5fdd67607c8d6a96f4c1bcf51ad7c82f11920a1676a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646123124, "uuid": "4aad991c-2f0c-4e78-87b6-4c12d4ff4855", "comment": "Malware payload (Smoke Loader)", "value": "7903917a72fcaf62326312eea76e07914874131a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646123124, "uuid": "e60545f8-a7f7-49db-bdc5-c31050b8e0f9", "comment": "Malware payload (Smoke Loader)", "value": "f03f45497341ef27a8e6adc0c8105036e3352f1f88028196772bd0bc3b91fd7f9ea15df631031ae9286ba265e3d5a883", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646123124, "uuid": "44b36877-97d5-4462-aad6-cbd33e9f0547", "value": "T19964AE10BB90C035F5B312F8887AA3ACA63E7E615B2464CB63D557EE56396E0EC31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646123124, "uuid": "695e0e55-779f-4ab6-bb60-92323c1c308b", "value": "070604688899afa7e1438edbf6a9e9e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646123124, "uuid": "9afec486-c533-44ab-985e-9894a1109614", "value": "3072:d768GKeByl8i+39Tlg32qj3mK4nhtlNL4G+MCylL5foCmp6yPGmUMHyYVf:808i+NTlzK4nblNJ+M1TIDOmUMSYJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646123124, "uuid": "752bcfbb-624b-4beb-8fd4-b5f65398d946", "value": 333824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646123124, "uuid": "04e1afaa-ca15-4056-8672-7c72fc700c71", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646123124, "uuid": "d83eda24-6cde-43e0-93e9-93691c70ec2d", "value": "3bbd64e8b98fc05de574f14c3957cefd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7c5f8ff-995b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646138001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646138001, "uuid": "12a08aa4-2229-4d04-881d-1cb8e0c3d439", "comment": "Malware payload (Heodo)", "value": "bf43ede39da1e23520586ae34457efbf", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646138001, "uuid": "58f9b1fe-4ecb-494a-99ff-8ff2449ad80b", "comment": "Malware payload (Heodo)", "value": "0cfeddff4b376d57aec098d9187af67b7e6e29a1e5d944b857de7ff161d68d92", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646138001, "uuid": "c5a2e6d5-cd53-427c-818e-391e59483118", "comment": "Malware payload (Heodo)", "value": "4c1f693db57a625b9f973881bc307961dcd6f85f", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646138001, "uuid": "3f22a0de-0d24-4d5e-9176-40541a365528", "comment": "Malware payload (Heodo)", "value": "259d9f89cf72ca7ee8766de931838e1837bffe0ab6c1230f1dc1113d33613fbd773ebe55ab1875859117ce625a0e29ba", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646138001, "uuid": "5d90553b-1b42-4c72-a0b6-77041d5c0992", "value": "T11F13E02AC0961959D727283DD6148EF4124C0E4A89E5F99B1D50B3AC2B6E1FB0B4FCB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646138001, "uuid": "a3316fda-2ec7-47c5-a6ba-303a140d04aa", "value": "768:29oms9O+pOevZCwtxyKfcrND59V+L9Rw4eWrXcTqw0VfWZE:29oms7tylND59V4jwmXc2RVfW+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646138001, "uuid": "82f5af25-7bbb-4762-a079-1e43b6205684", "value": 41841, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646138001, "uuid": "7d4f15ca-d443-45b7-a62f-b6113b76b30e", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646138001, "uuid": "d713b246-886e-4d58-a5a9-2402645730ce", "value": "Fakturierung 2022.01.03_1329.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dc8e118-9933-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1646120643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120643, "uuid": "e8b21c06-0221-44f1-999b-45d3eca2838f", "comment": "Malware payload (Loki)", "value": "5dcbdc3fc1f607239329a1e37f46c6eb", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120643, "uuid": "6fcfc61d-10a2-4cc4-813f-faed53835b67", "comment": "Malware payload (Loki)", "value": "0d0ad5be5985410f05a1bf2f610a3163566b596b36ada454e0637bb329a5059e", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120643, "uuid": "57bb4f3a-bd0f-45a6-8bcb-6600d6fdcac4", "comment": "Malware payload (Loki)", "value": "0079e3354ff509654808fb4ea21ebd5b5f11900a", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120643, "uuid": "bc0e3fe1-0de0-457f-a9d1-4d3f8c22a698", "comment": "Malware payload (Loki)", "value": "fba73affd64a3a979022afdeae639e7637d12b77ce56b0e2c0ca04f87bb48692e3ebe4fdaf570b404e5fa95f8afa127a", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120643, "uuid": "58c6cb2c-d0ec-4c37-8ba1-77d518a017bd", "value": "T14714025835531E82F993BD78BD3BCE4015F7FE314044C419A629719A07FB848ABBEEA1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120643, "uuid": "93efcf0c-3e72-4a68-b776-fcfcc55036d1", "value": "3072:3N3gy0PKH0UK5IXSxZeZTCgCYKtViC+JRFhJx4z4zkpGQbHYO9kfLPX8+LD:dJ/0UK5IXSeZeBYKzWXFjxEw8bYO9gLh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646120643, "uuid": "a2fe5d85-6a79-4601-93dc-d7fd02487f1b", "value": 191128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646120643, "uuid": "0d75984d-77a4-46ac-a6fb-4372db769547", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120643, "uuid": "81239555-86e8-4727-bb53-a37d20642863", "value": "1189&2254.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20dd1dba-9986-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646156189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646156189, "uuid": "c0be3f36-5f8d-4612-bb4a-afc89cdfa037", "comment": "Malware payload (Formbook)", "value": "7b04cb1c09a11c57a9152306802187bb", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646156189, "uuid": "5c567d9f-c3f7-4355-8fa5-ce510c5a81e2", "comment": "Malware payload (Formbook)", "value": "0d21511856c72aac0a9f47144006860c2bcf8c2b798edefdd35f29864575b29c", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646156189, "uuid": "086d5fa7-230f-4460-b75b-6313a7ba11c2", "comment": "Malware payload (Formbook)", "value": "16fd517051704b8d43fc5fcbbffb1738dc0d9999", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646156189, "uuid": "660ad208-1f65-48f5-9903-e9217c2f70d9", "comment": "Malware payload (Formbook)", "value": "1fa7c7f85958ea6771293d442750bb6c5a4dbb289ac3da3896090a3b1069e7e2793d44d9b4175c3f3b3783411c3be712", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646156189, "uuid": "5abe3c3f-df3f-4817-94cd-27bb3bc65f8e", "value": "T11A15238235940E87EEA887B6740B40D1177078EF9FB3DB1B7801626F5CA37345B1EA5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646156189, "uuid": "b55566da-7ba2-4d7b-954c-13666aa87810", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646156189, "uuid": "38fc958d-edf9-4a27-9470-6500130ae5d8", "value": "24576:CoDILfKa1Je1mkGCV3+DMSrJ6X4yk+zYQWif2YBkZRWyhKfD:CoMLLi1mkN+DMwik+zY3YuZx8D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646156189, "uuid": "d74c9bcd-38ab-4f9d-96a7-9e945531126b", "value": 904192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646156189, "uuid": "50f9fc80-1653-4a3b-8f08-c3f160c4bf66", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646156189, "uuid": "803f3b72-6f92-41bd-b870-98f03b41e20e", "value": "DHL PARCEL UPDATED SPECIAL CONDITION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a32851c7-9956-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646135792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646135792, "uuid": "ea8822bd-a67d-4d94-8e0b-4968323c3e11", "comment": "Malware payload (Formbook)", "value": "cbb3ae51aa07a37727a79c54abac033a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646135792, "uuid": "6c30cd74-212c-4520-b362-0caa6358185e", "comment": "Malware payload (Formbook)", "value": "0d491a763b98f614a83b7f8c5fea244501316466da80f3387032e8554fbfefb7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646135792, "uuid": "9f164122-d72e-46a7-8edd-4452acdc19c0", "comment": "Malware payload (Formbook)", "value": "95f66fa8db0869a06b473c135436dc4d82c8ca8b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646135792, "uuid": "c1820106-3a88-48ed-b188-dcb60bda645f", "comment": "Malware payload (Formbook)", "value": "e1974b294186c8938cfe007d9af261ed4b11b42a8e2efa7d3aa0e680e97845aca48984480b44988d479b4beb91a8edec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646135792, "uuid": "3f386ce7-7357-4123-bb15-cb494fa4ea0f", "value": "T1FAE4C096BA7ACDEAD4395738242052088FF6DE96870BF3E87C897DBD8430B034665537", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646135792, "uuid": "b7e004c7-7adf-4888-b719-48d3fb6c1e94", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646135792, "uuid": "5800194c-9cf3-46ce-a0de-3f1b661b75a5", "value": "12288:ab6SXOGRUcZ64/cRm00dT9RvoIOZ/MFeRLa2eDoNmjhf+gcd:JcU9RmZdT3voIOdMFqLSoNmjtud", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646135792, "uuid": "2fb39062-cf25-446a-8c50-70bf9b0c6004", "value": 662016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646135792, "uuid": "47b1f46f-9b1a-4320-99cc-10030c351f13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646135792, "uuid": "7680cecc-7f57-4da0-bd89-b8e1fa2b5b1b", "value": "Payment Advice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a70af11-995f-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646139455, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646139455, "uuid": "38917b62-a0a5-4e49-a56e-620fa78b2a16", "comment": "Malware payload", "value": "564644486e8aa3497247f4d1930bc76d", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false }, { "name": "ZW6465", "colour": "#C4CEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646139455, "uuid": "3e07db1e-0ac3-430b-a0c5-87a26b9d623d", "comment": "Malware payload", "value": "0d7612c2d6ed5a3367a3d61e3e5aecfe2251a29d6e006b90aa596187fc1b8774", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false }, { "name": "ZW6465", "colour": "#C4CEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646139455, "uuid": "182ca164-c146-459c-9968-c6e26727f7dc", "comment": "Malware payload", "value": "717ac9c8f679e8000e838e018622df3fefaf6e02", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false }, { "name": "ZW6465", "colour": "#C4CEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646139455, "uuid": "d9e4f0ff-f34f-446f-bbdc-a29e9ea7c0fa", "comment": "Malware payload", "value": "9f6666fbcf910d72228c9ac10ee089b5ad513f7b6aa357e78bf3bb5ef69f1fc3f8e8ed663b84db74017c0066da3355bb", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false }, { "name": "ZW6465", "colour": "#C4CEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646139455, "uuid": "1d51fe47-525a-4939-9271-0c418ba4d743", "value": "T18424237C55CD159F75036AC9862F73FF06C4B0D9D83E605B30A35F5C21EABA8613254A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646139455, "uuid": "6873083b-a526-479a-8345-a1f7b03490d1", "value": "6144:abwNYgtOBK1LcakejqC8fJaSdFEm8ltvTHy:abMYK1LcHejqFQCz8Pu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646139455, "uuid": "5fc9733d-2840-4934-9ba1-78956d6ca337", "value": 217859, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646139455, "uuid": "789a6439-2301-4894-86b8-409cda071b23", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646139455, "uuid": "bab0d161-a6a9-46e7-b844-286e5515e9ae", "value": "rroarbe.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "361911ab-999f-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646166962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646166962, "uuid": "b9f02c2d-373d-4d4c-8c48-8c2637ba98e8", "comment": "Malware payload", "value": "0173359fb1aa73d3a9ee15d78c64df40", "object_relation": "md5", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646166962, "uuid": "463148bb-d7ea-4455-a231-872540e2a467", "comment": "Malware payload", "value": "0d9a9f107f0f9339d33de49397a8d4c3a287e9897684e2a07e5c098167a33038", "object_relation": "sha256", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646166962, "uuid": "c4835706-fd86-4709-a863-01ef179242cc", "comment": "Malware payload", "value": "656db33ab463c5fd2a7ac7b42849ba1b1022f29c", "object_relation": "sha1", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646166962, "uuid": "d13a8adc-91b9-4ee2-ac82-3ba8d8bd16c2", "comment": "Malware payload", "value": "de1f8c854442df8374443f518dfba8897ec953e2f65033e7e237e1811163cdc7850241ee0af1f2a14de5ee6dcf3162b0", "object_relation": "sha3-384", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646166962, "uuid": "757eb9aa-4d1f-4f2c-ae2c-763c2a8fcbd1", "value": "T1E423D025C1607828C73E8C759200EAD2720A7D04D9D5EF893585BB4C3B96BEB57AF9CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646166962, "uuid": "d3dd9557-0df0-4e6c-812b-9fc37f8a9ccd", "value": "768:yio9DOevZCwrvtD608zdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Uh0VPWft:yio9D7UtT5fTR4Lh1NisFYBc3cr+UqVC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646166962, "uuid": "932d6aa5-f561-40d3-8db7-b0313edfc05e", "value": 47699, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646166962, "uuid": "8cba124c-60af-49c1-885e-1fe1a1ad6777", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646166962, "uuid": "a6d7ed58-75eb-40f8-8d07-e3a8967f3eba", "value": "Medwin Publishers_1.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c907df0-999f-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646166973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646166973, "uuid": "b99b7036-7580-46ae-93e6-eb0d02f6076e", "comment": "Malware payload", "value": "85d7692758cdee7801dad001bd623f8a", "object_relation": "md5", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646166973, "uuid": "9158663c-2f6e-46fa-bb1d-a1023081a844", "comment": "Malware payload", "value": "0e44b8afcdeae8d5e8a600fb83dea442926e3cdbd1768529847d10b618ca6d15", "object_relation": "sha256", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646166973, "uuid": "f96f18b0-62a5-4e5d-ae25-38fa35841199", "comment": "Malware payload", "value": "c5107cebada00633ea708f77f1deb4b5535a771f", "object_relation": "sha1", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646166973, "uuid": "0f8423ba-4c62-4c0f-89c8-24e3e8a09663", "comment": "Malware payload", "value": "f0ac4e32bc1d5c155ba465e8dc79feaecc353c38ae51993955b255472aba3b1fe573cc07bb244d265284f3204e61d855", "object_relation": "sha3-384", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646166973, "uuid": "43c20d29-3aec-41d9-b9be-3c5bbbe73d24", "value": "T1BA23D025C1607828C73E8C759200EAD2720A7D04D9D5EF893585BB4C3B96BEB57AF9CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646166973, "uuid": "b21aa53c-c224-432a-9ab4-05dfa971a345", "value": "768:Sio9DOevZCwrvtD608zdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Uh0VPWft:Sio9D7UtT5fTR4Lh1NisFYBc3cr+UqVC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646166973, "uuid": "390d4550-3231-460d-aa37-73abbca90fa5", "value": 47699, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646166973, "uuid": "665664b6-fbac-4f48-a0c7-83d5307078b2", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646166973, "uuid": "aad6ce17-5064-4295-847f-432a49842a0d", "value": "Ommega Publishers.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "912cc982-99a2-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646168404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646168404, "uuid": "0723a3d8-f79e-45a3-9aff-3ff5a13035de", "comment": "Malware payload", "value": "1c9ae8b34facb8345981a5b8470f84fa", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646168404, "uuid": "5538013c-1730-4eeb-8882-3a9ca99ae9e4", "comment": "Malware payload", "value": "0e7fb8c9e786025444c1680dbed000b386f6938621272857ccb7e343c2b0dd51", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646168404, "uuid": "eb8d7228-219f-4925-bc7d-24a8c57f9ee5", "comment": "Malware payload", "value": "4daa34386066de78eb80f1ca144c93486a3e9579", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646168404, "uuid": "18c5a298-84f1-44ea-ad65-202fe1403d18", "comment": "Malware payload", "value": "69ae15d18eab7574c48516e0b4eb3b140c1e936001ddd475477818ea51b0f40300536b544c968d388b1ba5c6dbe031c8", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646168404, "uuid": "b0457fd0-f7bd-4fd6-9e94-301b10355942", "value": "T175D5331AC7DB0CD3788F4B2BC539A9B68ABE405689E26D9F7E044152B4B010CFD21F9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646168404, "uuid": "3d5014ef-3911-4e6d-9508-b76a3adf02e1", "value": "49152:EXptVgFk+eJoTSIRZlU7Hp1bTEeEtgFbfDPufZU7LXlbv5aQXQds/X+67EZki2U:0tTJCS0U7Hp1bTEyLCfZU7RcQAg+0EZx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646168404, "uuid": "2db76d6f-1938-4709-ba01-46e8ef1f9ea7", "value": 2801986, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646168404, "uuid": "0f0746e6-1fc5-463d-9694-fbb9a0a92311", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646168404, "uuid": "9d274109-2fe2-4dcd-a15f-a175b3be296f", "value": "0e7fb8c9e786025444c1680dbed000b386f6938621272857ccb7e343c2b0dd51", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c519c66-9958-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646136586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646136586, "uuid": "5b573fec-5a0a-4372-bf01-031ecf8a8b22", "comment": "Malware payload", "value": "46a9627fea9e34bea545aac6a991ff56", "object_relation": "md5", "Tag": [ { "name": "Daxin", "colour": "#652B35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646136586, "uuid": "7d91788c-c4a1-455c-834e-fba5cb024cdb", "comment": "Malware payload", "value": "0f82947b2429063734c46c34fb03b4fa31050e49c27af15283d335ea22fe0555", "object_relation": "sha256", "Tag": [ { "name": "Daxin", "colour": "#652B35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646136586, "uuid": "3fd053db-7264-4c17-8301-69b08fe4af9d", "comment": "Malware payload", "value": "a53e46a5d401e8a87fe1520e75ebcbe69ea6e6d1", "object_relation": "sha1", "Tag": [ { "name": "Daxin", "colour": "#652B35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646136586, "uuid": "5cda3da2-de0c-4c41-95b0-6c6e1e8ec2ea", "comment": "Malware payload", "value": "241640dd093264f68aa1d7e3eb64a78d35cc80e00643de8a07402107d2c1bb0eb4373b20917a24da9a913abbbe879fc1", "object_relation": "sha3-384", "Tag": [ { "name": "Daxin", "colour": "#652B35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646136586, "uuid": "59b44ec3-59f8-4e46-bdee-20d3aa30ef20", "value": "T14624126667B6092CEE824B74D1B1E245D920BE518AC0C18F2B744196C84B3FDFE5C7B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646136586, "uuid": "e54f8cbd-5fc1-4785-a4b6-bf9b26715733", "value": "70e1caa5a322b56fd7951f1b2caacb0d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646136586, "uuid": "e2172c37-8c9d-42e2-8628-187dddf93be2", "value": "6144:syKOL9/+S4vRxSTR0oR72xXeLwHnk8k374iCX:sad+9ZxSKoV2RNHnk8k37k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646136586, "uuid": "5541441e-1909-4ecd-a1a1-e674d8005afc", "value": 219216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646136586, "uuid": "56035845-1e55-451e-afb7-885d7c0b77f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646136586, "uuid": "d7196586-777d-4cfa-b38d-cbc65fac6cf4", "value": "0f82947b2429063734c46c34fb03b4fa31050e49c27af15283d335ea22fe0555", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f0e44b0-9943-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646127490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646127490, "uuid": "521b2ba8-2307-47c4-9a02-15f268b734ec", "comment": "Malware payload (AgentTesla)", "value": "e39a5d65c11522c2c4060b8215a4831a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646127490, "uuid": "3808fd5c-012b-42bc-a03f-174a03f265ab", "comment": "Malware payload (AgentTesla)", "value": "0fcb7bc9991d9595b72bcf084f3c8ef9047778ea311834c30bc48bf1e77d7cd3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646127490, "uuid": "d1ec6ff3-b7f0-4c0a-9668-59bed06a549d", "comment": "Malware payload (AgentTesla)", "value": "0d191cb12dc8e234e9ba5846fedb9a7471bb5b6b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646127490, "uuid": "5c49e133-3ff6-4c20-b4e1-32a7e9908a99", "comment": "Malware payload (AgentTesla)", "value": "b84a64eb07176e874440354da9ae9ff0cc6df5c942a4306ef1ef70c7bd5389fec6a52a7d5a6c82ffec83633231e9cef8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646127490, "uuid": "8c1bb4dd-69a6-43d9-8c29-01bd4fe15461", "value": "T180C4E08B76349AE6C93D97346412521CCFEAE962C30EF2B83DC571CD4171F4B8A2691B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646127490, "uuid": "a081a861-7b56-47aa-ad88-05c5d29d7429", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646127490, "uuid": "ce2b883e-ea4d-4471-a497-91c742621f12", "value": "12288:uhdK5McGRUcZ643cRm00dT/g9+4H9YML0Zbw3bi0Lhi:QccUJRmZdTY9THyMAFB0di", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646127490, "uuid": "51b5c3af-1d2c-40ed-89c6-78c9e54bb04f", "value": 579072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646127490, "uuid": "7298812b-6a98-47c0-82d6-0bee7e5e1047", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646127490, "uuid": "127b9a71-c2e4-4762-80e1-2a1baca643d7", "value": "payment overdue.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "268f59ff-9963-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646141166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646141166, "uuid": "8d94a5f6-2b84-4d5a-876f-4f0e86769a52", "comment": "Malware payload", "value": "0c3ec0f54461dcb4aef473e827473a4c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646141166, "uuid": "63734e51-3211-438a-9df7-c1775f2da402", "comment": "Malware payload", "value": "102fa1f424f59a87a0053707e6036b7315642badae8c5e097cb1b660a015854a", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646141166, "uuid": "2f1bed72-be65-4ef7-9b0e-5d90f7c140ef", "comment": "Malware payload", "value": "e1954fc460837d28b33448330e7a1d34777fe064", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646141166, "uuid": "dbd3d190-6330-41b7-ac78-b32099b15eea", "comment": "Malware payload", "value": "2ce14a2e821345f3c32b7d49a0715c249fd8aed6d07312a3f78412ecd8775f234c8d3a3645e947d07e4068244404269b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646141166, "uuid": "b246bf6a-41e4-4311-bb30-570152473766", "value": "T1F8A1F850112C1AB07246697AD26FFA52B40EC81B09777B358433A63C74F5DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646141166, "uuid": "3689498b-80a9-4f3c-b7a8-1510b2e18212", "value": "96:hRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:hRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646141166, "uuid": "b26aa858-b64b-4fc9-8ccd-f1951f29922e", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646141166, "uuid": "5be76845-6017-433b-a75f-cf248949eb5e", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646141166, "uuid": "b0427a3b-2e35-44e0-a123-36c6aa742cbf", "value": "102fa1f424f59a87a0053707e6036b7315642badae8c5e097cb1b660a015854a.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f93d92da-9933-11ec-9275-42010a9c0029", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1646120904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120904, "uuid": "ae1f49fd-a400-4305-b90b-6be300ad4196", "comment": "Malware payload (AveMariaRAT)", "value": "6b3eabcfd594ff159bb361e51ba3f7b5", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120904, "uuid": "8a01b49c-af45-4413-a6db-fc748bbea3ef", "comment": "Malware payload (AveMariaRAT)", "value": "105c8811b2893e4f0b0c5d8b7809d7c3f1d0429962b3869e7d04849ad47ed1c9", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120904, "uuid": "764e7f18-5f7b-409e-8ab8-263cd34cd971", "comment": "Malware payload (AveMariaRAT)", "value": "1f5b84a85be029ba124950c4e8fd57b5f17165c6", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120904, "uuid": "7f481c69-9d9d-4f90-bf6b-f3c08287f648", "comment": "Malware payload (AveMariaRAT)", "value": "27f9372f7d3e34d60fd44c0a8966ca329c010316cc212b66ac0318a116455268ef38b3523bcd716b87652e29a4500994", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120904, "uuid": "badcfc69-2e46-466a-af2d-c78a16af956b", "value": "T1131412C574595BBEE04A433FA8ACF86090EF6C4A8E1727C554C0FF9F24789AC5A2D634", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120904, "uuid": "53d23144-df6a-43f8-8d7d-6bdd953c40bf", "value": "3072:1NzhaGN46x3YlN/J6yDURJx/qfUrHdt/NmPNMhgqVetHwx0Qrjg1s4:HAX6NYVARmMrHX1+Zi4QqQQl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646120904, "uuid": "26b22e24-32db-4f4a-9911-d08b34556b19", "value": 191352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646120904, "uuid": "1d28fa25-6c44-4606-9dba-dcbb80c23e20", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120904, "uuid": "46c8a747-b3db-410d-8fd4-eede234e18b6", "value": "1-Adeudo por domiciliaciones sepa 2022-02-25 00.19.00,435.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "829bb9a5-996b-11ec-9275-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1646144757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646144757, "uuid": "bd0256e1-8656-4cf8-9319-31d33cd14300", "comment": "Malware payload (Quakbot)", "value": "d2ef341c0623f0d2c1064ba7465adf98", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646144757, "uuid": "cd554fb7-907b-420f-9743-1e2d2e90ea14", "comment": "Malware payload (Quakbot)", "value": "10f91d1d4464b080437b60fdd836ac760de9344b16f36bf3cd6fdb030f923c6d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646144757, "uuid": "787ad3af-42b3-458b-b11a-e44356cb349a", "comment": "Malware payload (Quakbot)", "value": "23bfcfc3028252395ec55e2f9b457835ad5a799b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646144757, "uuid": "537a02df-cb63-4808-ad6a-ca5ed4d14875", "comment": "Malware payload (Quakbot)", "value": "c09c1b674a95e0e45f1256de4904c578ccaa58b7d477f41119a139e4f2161f177251593e08c27f8eb56abc7ccf03cdf0", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646144757, "uuid": "f3033414-49a3-40c3-90f7-978cfb4d79df", "value": "T14325BE71A2E115BFC1733B7DAC3E6198CC24AE512D14DC4CB7DD1E8E0E296A227251BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646144757, "uuid": "5cbe94c8-6f3e-4c38-ae25-fd8e20d68585", "value": "39e575b47547313526712cf504793169", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646144757, "uuid": "88468f7e-931d-45bb-9ad0-2caa01e94f19", "value": "24576:cSdk/wBjirEIzNbNsdU5xB31FFbDt3xywiDSR6b/2+:cSlmg2NbNsIxB3LZB3Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646144757, "uuid": "018c9655-e86a-4639-8b9c-34f38975edb6", "value": 1057316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646144757, "uuid": "e217d2bb-7de5-4d6d-b892-4127161ade99", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646144757, "uuid": "5940685e-816d-4ce6-a96c-e10d050c8741", "value": "10f91d1d4464b080437b60fdd836ac760de9344b16f36bf3cd6fdb030f923c6d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bee3a41c-9933-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646120806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120806, "uuid": "d391a0a0-8796-4345-81ed-5d412097da04", "comment": "Malware payload (Formbook)", "value": "19fcc660e32f43056536aa5250964dfb", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120806, "uuid": "d94a513e-990c-410c-b6b8-7ae2a704286a", "comment": "Malware payload (Formbook)", "value": "11d35c981fd7a8b495b5ca4e14c8c58dafbb5a34a00cf588738e398d216952f1", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120806, "uuid": "0c576f2a-5351-4346-9d37-8ac562119547", "comment": "Malware payload (Formbook)", "value": "50a4f9c0ab1594abaa49b92b6b1230710eb9c739", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120806, "uuid": "981b3039-f369-4719-a027-aadd2b68e185", "comment": "Malware payload (Formbook)", "value": "977413e32dcb97e8f1036a37bee39eb405173ee6341da48617216dee70d61b89ffe7e8baca2df8cf89e4851bc8667a70", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120806, "uuid": "9415536c-7eb2-469f-bf7e-76ae99e2a024", "value": "T1901412C6B0E142CAEAC5837FB23DC6A847D4BD6216DCA00BDEBDB5A748B22453846143", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120806, "uuid": "2c7eb829-be54-4fc6-adc7-f2fa11fc6e9c", "value": "3072:x4no0Q7mTl6pF6Fs4UQ4nPbFMsQUpiGQvUbUB+xdqk3h4IMAkzRm0ukQQ:Cno0rh6Gm4CzSzvUYB+Xqk3a5mHQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646120806, "uuid": "1c9ac576-12f2-42d3-8653-1fccac29b410", "value": 191032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646120806, "uuid": "988a9153-117c-4a1c-8083-f79a98d91a50", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120806, "uuid": "7176579f-dd71-49ab-ba5e-5d2c6a0038a3", "value": "payment swift.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0832111-99ab-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646172402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646172402, "uuid": "cc5dc904-e47e-45b9-bc7f-8b4222939145", "comment": "Malware payload", "value": "43b7483e8174d6407e997c43bd9ab8eb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646172402, "uuid": "7e4edf7b-73c3-48c9-a581-bc60f19c8dd8", "comment": "Malware payload", "value": "11e1bf4b8153f0e7f1e5c751c03ec3196dce6d7fc098840f5eedc7f242a7bd9d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646172402, "uuid": "71ab6b0c-b840-43da-b479-200906e80e59", "comment": "Malware payload", "value": "671712d0418c36c79fe4949eaced8ec2f7afc18b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646172402, "uuid": "e65c4d17-d9df-4c97-a2b0-ae7b401c8789", "comment": "Malware payload", "value": "1b9f2d8441dcec21bf54fb5a7e418d85a7ef16ad6f651580c41e6a738474ec8e6a653e836d9b9d99a4cd72fc60b204bb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646172402, "uuid": "1f8958e4-3cb3-4c78-a1e8-d30be0519f29", "value": "T1F1B4AE11B7D0C072C26A35342926E7B656EEBC719AF583876FD03B7E5E301D18A2835B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646172402, "uuid": "e934d0a7-1143-4a44-bcaf-ea61045ac099", "value": "d02245ac5c961d83d0907c826d8ba5c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646172402, "uuid": "d227e449-b74e-41c3-ba49-a6a8570d3416", "value": "12288:JhC1q3aXOwkiPs2iCtyjROAIlgOkar//wJY8Itgm:Jgq3aFkiPs25aR2Bkm8jm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646172402, "uuid": "e2eeba0c-320d-4018-813f-4ac30d117e28", "value": 499712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646172402, "uuid": "b879c39b-64a7-4006-9a94-059325ed98f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646172402, "uuid": "39f471ea-39d2-4ba7-bf4a-fdc98bd9cbaa", "value": "43b7483e8174d6407e997c43bd9ab8eb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c41cc8a5-994a-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646130693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646130693, "uuid": "6de8a7ba-ad79-48d6-ac70-a2b7ed1ce505", "comment": "Malware payload (Heodo)", "value": "6f06df76bc057a5e22b1af4bc7226423", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646130693, "uuid": "a9bdab93-3a74-4276-a374-86de17756218", "comment": "Malware payload (Heodo)", "value": "11f09903e82f619ea2226c5f08ad5d275d3b7cf2e7740cba60377265458004e4", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646130693, "uuid": "19c3aaff-0992-4855-b0f8-8f4fbcc5411e", "comment": "Malware payload (Heodo)", "value": "c7c1c033f7dfdd908b905055922755ddc57e24e9", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646130693, "uuid": "0ef8a1c2-348d-47fb-85f7-543fc4f04a29", "comment": "Malware payload (Heodo)", "value": "f4cced72c4eac14dc1081ad7995c84828f2a5129709598a5505ab305ef8e24c89fc9bf51aeb507411d0dcb1d446e90e9", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646130693, "uuid": "7d4bd536-4f6b-41f9-9bfd-0d091b3e9a63", "value": "T139D47C82F7429EF2C00B03347C32B2586BADEAD5D2158D6B9398A5AE1F35573493DE43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646130693, "uuid": "c3a1d432-74b2-439e-89b1-50f012f9ec72", "value": "e0b213ccd96f46d30dcd8e225f4e9fc9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646130693, "uuid": "66805e7c-3945-40a1-9550-5c4c2f8d7e20", "value": "6144:XjPgWGbb0OEmS9Vzf5WI9nI1LSfcaxMyhKmZHNRuIfv7YtaIIo0cm59CH7PQ:X0bEtf5WyI1LSfcIfxhstaICRLmrQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646130693, "uuid": "55e50bd2-8166-4ef8-bcea-6b49051b9d32", "value": 602112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646130693, "uuid": "a774935b-98af-4dd5-af58-2b3c4523d1b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646130693, "uuid": "9f48e286-c036-46a9-b860-15a189fe5584", "value": "4BLq0JPyUVSx.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6168931d-992b-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646117213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646117213, "uuid": "f4f9c7c9-05dc-44d8-aea9-52a02e98d0af", "comment": "Malware payload", "value": "2e52aa357251e6322316e3996d709f8d", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646117213, "uuid": "515d212b-a886-4830-843f-ee6d606fce40", "comment": "Malware payload", "value": "12388f15ba1f180213f35a215c8638377a10049cc179f0bace6942bfd7ccda72", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646117213, "uuid": "344fd8d0-e317-4ad4-8ee5-a6a1bffc9e93", "comment": "Malware payload", "value": "6850ba4304ea0a03f4da93608b58201f0cdc0fb0", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646117213, "uuid": "1cf1a489-dc0f-4192-a33c-d561fa635496", "comment": "Malware payload", "value": "b951d4520c520e0036dee1f15f62e525a5e619c6aa0cb1c7bfc7c7af98efb21f4c42edf82efe99c95a438f77ec1b569f", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646117213, "uuid": "6dd7e1c3-9100-46ab-bc17-bcbc7e3d8c02", "value": "T16E6423B30064E944CB747E1DA7D6DB0F1BC5BAABB677D3D4D88D0E18E1CA2908D85728", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646117213, "uuid": "32f3bfc6-796b-4daf-8ef7-05014002dd35", "value": "6144:GhrPvdvzwjq50jAt4xdrAyqowADFT7w9N+1KVSyo58HVGhW/:mWq59tIFqEFnw9Umzc8HwhW/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646117213, "uuid": "d586fb77-6c8a-4637-8d70-9ef4eb9a6e55", "value": 323608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646117213, "uuid": "bbc9f8da-e924-4c29-a9ab-c6e575073416", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646117213, "uuid": "2b80b0b3-0c85-4aed-b44e-1eaeb4f0b6cc", "value": "XkenUcjc.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ecfa85e-9985-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646155971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646155971, "uuid": "2039ff97-f3fc-477b-a273-25f399113064", "comment": "Malware payload (AgentTesla)", "value": "fe13b275dc9d9ee550e7d9ab127ac6a5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646155971, "uuid": "384b34c4-779c-41db-9c34-2c5a9596e9fb", "comment": "Malware payload (AgentTesla)", "value": "123fde04145b2501338ce24b1235d0e37b8d1326b6160053c9438e38e429f7a0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646155971, "uuid": "1430b094-0b79-494c-9a55-fb2c7ccf4341", "comment": "Malware payload (AgentTesla)", "value": "296dc2bd4c26df6c54feaec5f3c67004766eab40", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646155971, "uuid": "cfb27777-a03c-4f3b-af33-ee385d3cf150", "comment": "Malware payload (AgentTesla)", "value": "8eadad71a23af0eb1089f1c31d279bd4ed954aa478571a143d448ff61becc3a24977a0fc2d6e90e105a95c98a9ac19c2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646155971, "uuid": "570f5a6a-5284-428e-a00e-28e328ee6312", "value": "T1721412FDB3E6C139F81A6878451687129744EDD91C0776006725B3BF38FAF15A2AE20B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646155971, "uuid": "25a0835a-0a02-46df-be2d-9985c1c6d544", "value": "3072:xlWrv8D+3iSFjqhpWNTTjVOmvlq+4bZJPQSvFAcm++CdcPk/DLsRZbBEEPU:+rvh3jqhpWNTzU+sP3WoRiM6EEc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646155971, "uuid": "1b9e0d04-fb41-4fa7-9448-74a59ee2ce7b", "value": 190552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646155971, "uuid": "24afa7db-b49d-4f4d-b5a3-bd232ed273ad", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646155971, "uuid": "3f059cae-ccbb-4e09-a8d0-a126c70f18f6", "value": "NEW_PO138494.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "291c1b79-9963-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646141171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646141171, "uuid": "07d09a2d-857b-445a-8d84-b39e2222b880", "comment": "Malware payload", "value": "f79a0839a23d0b89a44e28c49bd92024", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646141171, "uuid": "a304699f-6085-4cd8-a118-c82e8c28d677", "comment": "Malware payload", "value": "12882ced2c549e0b35ad987da6d8828a50f3e6cbd4525628efd84ee5e1d37176", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646141171, "uuid": "04598c39-f28b-43db-a92f-fb48f754f4fe", "comment": "Malware payload", "value": "3b852aa6f00e75d22534f365690e709e61dcff4d", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646141171, "uuid": "98d60cec-37b9-4adf-9509-aebca1567fd7", "comment": "Malware payload", "value": "1ac61f8a167c61149c94316e91a60d4c1e3fc677c89ec907d22417e69318a27e9352b72f1b61dc6f5d50cc1234de639f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646141171, "uuid": "8796e482-6a69-404d-b4de-4ce6b32183a4", "value": "T1F7A1F750112C1AB17246697AD26FFA52B90EC81B0A7B7B358433A63C74F9DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646141171, "uuid": "d37c7da7-384f-4825-926f-9ff5bbd57471", "value": "96:rfRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:rfRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646141171, "uuid": "7d424d61-f74a-4002-a0e2-2dcf562c88ef", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646141171, "uuid": "d39bb2ab-a39e-41f2-998b-9c638597f4d8", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646141171, "uuid": "f5becda8-edb8-4c2c-99c9-1403a6fe1551", "value": "12882ced2c549e0b35ad987da6d8828a50f3e6cbd4525628efd84ee5e1d37176.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c5df24d-9956-11ec-9275-42010a9c0029", "comment": "Malware payload (GuLoader)", "timestamp": 1646135781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646135781, "uuid": "04133d04-bead-4bc5-b3d3-847ff74c0172", "comment": "Malware payload (GuLoader)", "value": "cfb0933901fd66cfdc26553572c7d866", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646135781, "uuid": "89110643-bc29-490f-9d24-a380ca048403", "comment": "Malware payload (GuLoader)", "value": "12af5267dd46cb199277c512603ef4aef71aff657a04e891302e2ef9b424d56a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646135781, "uuid": "fe3444bb-0a7d-4a3d-b520-81b1965ab05f", "comment": "Malware payload (GuLoader)", "value": "5805ced73e15bf09bdf95848780ebac46f1302f6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646135781, "uuid": "646ea3ae-0bfe-4c35-b4ce-a62a3ffdbd58", "comment": "Malware payload (GuLoader)", "value": "403e11d3abb108b492ba694e95fa0e776b6b9e61fa3c87355f730aad5b38b046d707b20b8027bf3c2975f79a128af17e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646135781, "uuid": "34992645-4e70-43d3-baaf-ab607669397e", "value": "T139840229AB64C0A2D1D10E316D35E36A9EB9EF612576039B3BD37F9E70321C14A0E353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646135781, "uuid": "090e3fd0-8f57-482b-a526-b44a54ad464f", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646135781, "uuid": "e6fc7ad8-7ead-4477-bafe-fbb78c196401", "value": "6144:wNeZGuOwoXx1OQFUaag++4W2I234Pd0qHjEn8cFUekD9UqtJr0iN9X:wNoO9UN3Iy4V3jE8cF1A9ZJr0iLX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646135781, "uuid": "77779f16-d445-4fb3-b4e9-aad734546e5e", "value": 383235, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646135781, "uuid": "84fcc7dd-7769-4c57-b551-dd75209085f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646135781, "uuid": "977a9e78-ad48-4776-9a36-0ea75cb79b7f", "value": "Bestellung Nr. ORF2200215 PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6c6cc52-9977-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646150025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646150025, "uuid": "084a3c98-3ad6-4620-8f25-e1b41632ba49", "comment": "Malware payload (Heodo)", "value": "426738f7308540d935a1f01adf55d75f", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646150025, "uuid": "feb5a67e-30c9-486d-be19-884985d2d999", "comment": "Malware payload (Heodo)", "value": "12f03fa4fbff689111165737af7c1d9fad04df8f2d23e50bc517b86057b7d1a5", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646150025, "uuid": "3525d38f-120a-4d63-8459-9df67ddf6a89", "comment": "Malware payload (Heodo)", "value": "640383e79ef4ade60f1282bfd93bb1cdc0d2b9f4", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646150025, "uuid": "df36bcaf-8bd6-40d9-ac85-56d9fed84917", "comment": "Malware payload (Heodo)", "value": "127e2166b1b33c3cde968179ca8b2f2d6df8a08c7412ec612028aeef2f0972e19bc276d518765c68f0df460ef1e31adf", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646150025, "uuid": "b6e9829e-0668-4cc7-971c-d832bf6d3039", "value": "T17823D025C1607828C73E8C759200EAD2720A7D04D9D5EF893585BB4C3B96BEB57AF9CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646150025, "uuid": "a9df8d24-57e7-47fe-a529-b961cc14a67b", "value": "768:iio9DOevZCwrvtD608zdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Uh0VPWft:iio9D7UtT5fTR4Lh1NisFYBc3cr+UqVC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646150025, "uuid": "7c095ccd-3acc-4081-9627-94c8dae70178", "value": 47699, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646150025, "uuid": "52c2ed59-bce2-4afd-abd8-b059762b9753", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646150025, "uuid": "415322b9-73c0-4e08-a70a-01fa8b02adce", "value": "Medwin Publishers_2.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40e0c0b1-99b6-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646176859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646176859, "uuid": "47a67e4c-8149-4ca8-bc91-f74f54cd20ad", "comment": "Malware payload", "value": "5afcf6f773112fd212c80dc85f8a78e5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646176859, "uuid": "45e446a1-1ee9-4c81-a6ad-84c1f446eb24", "comment": "Malware payload", "value": "1317f13a7cf7f599086f870fe71acd5aeba0ff8b0e52383adefbdf125da46cf4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646176859, "uuid": "7b314311-7303-421a-996c-a4006cc19137", "comment": "Malware payload", "value": "59aea93689162d67c67ba10e855ecd22736a1e21", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646176859, "uuid": "0a6bb83c-d151-4987-b235-2e679ffc6d27", "comment": "Malware payload", "value": "34f3e67d6802008f4e6bca358c50a31497c2671efcc2219b3bf35256b94755a914b35e3004a50fb74dfb6b8fe465d580", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646176859, "uuid": "709f9171-f201-4e98-bf54-7c4ac9823e27", "value": "T17915BF4834D6207DE8378BB1CEC0EFF1DB6DF162D64960B650020E598A09BBD8A55EFD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646176859, "uuid": "384ce879-6433-4f33-aaa2-7e41592028e1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646176859, "uuid": "cf0e6ad5-b0b8-434d-9b55-fd06de0bfdb5", "value": "12288:g+T8loqZi8XMMYYUA/MiFqAKyBEhP6ZmZADfaq1+CWCY0jYVjfIVNhFejnUOTgOE:RqZi/eKk66ZB4CZYtIVDqNp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646176859, "uuid": "60f692ce-6cea-4e33-b2c4-bc7235f17d61", "value": 923648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646176859, "uuid": "5ec84280-775f-4562-a0c4-66883573b94e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646176859, "uuid": "241e2ca7-bcdd-4737-8917-43dc6072afdb", "value": "new order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44ea1948-999f-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646166987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646166987, "uuid": "15bc8272-9519-47e3-b2e1-898d77ba12fe", "comment": "Malware payload (Heodo)", "value": "9b16c1d9af3c76005b8084cfac12654e", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646166987, "uuid": "145b5363-045d-4624-af3a-a450e32a4492", "comment": "Malware payload (Heodo)", "value": "1338cf7af0be9c69e360f42a5e97169d17ed4d416c851f6e3004992b26fd0dfe", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646166987, "uuid": "d46a9d37-7703-407c-b6f6-e2abe07a0e0b", "comment": "Malware payload (Heodo)", "value": "b15b87aabd792e59854c13408e020cdaf10ce7b7", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646166987, "uuid": "d82bb298-0ca7-4c8e-afd4-5740bdedbb4d", "comment": "Malware payload (Heodo)", "value": "4f459e977c72365006b076c8f88c28d31b887f4b73a6d7eb77f308bc4cc8cf7507ec8f01457b0114561b5706c6d4f289", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646166987, "uuid": "e64dbcbb-8ac2-417d-b81d-561abb886ef3", "value": "T13423E129C1606828C73D8C759200E6A3720A7901D9D5FB893586BB1C3B96FEB53AF5CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646166987, "uuid": "076b8462-3d9e-4f95-be7e-b744b494b00b", "value": "768:myMo9DOevZCwrvtE9WzdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Uh0VP9HW:XMo9D88tT5fTR4Lh1NisFYBc3cr+UqVk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646166987, "uuid": "0fbc0854-f1b7-4ee6-a006-f6d98f1915f7", "value": 47703, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646166987, "uuid": "7645f634-0f93-42f5-9a40-5d29d0cec22f", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646166987, "uuid": "2ae9228e-fa28-41bc-9ff2-17526aff6019", "value": "SCAN-01032022.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c43a826-99a4-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646169093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646169093, "uuid": "4301384f-2f55-4c0c-8a20-c866bfc6f1da", "comment": "Malware payload", "value": "01301ddcbe63fb91b46266811d40119a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646169093, "uuid": "c6ef1478-0508-463b-b6a2-e184cce32fda", "comment": "Malware payload", "value": "146d3fce49ad11628f5cc44bd1b018982c04f610e55a4a9d0ed7c1fede7c6ffd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646169093, "uuid": "f37f6348-e934-4b40-b7e8-3bb52b3a5e3f", "comment": "Malware payload", "value": "04179f1d6479ab57c108b53c6ca6412f05f65f65", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646169093, "uuid": "a71d53c4-e8a8-464d-93dd-3ce00f204b14", "comment": "Malware payload", "value": "be7eb4eb5ae03007030cb92e40648c15cb6fb0dffb504e467c04bab3e2392b9a69bc75fa31d26825032582ef6812c47b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646169093, "uuid": "4a17c62d-b7ba-43ce-8dbf-d32b69ee1da1", "value": "T1277633284EB5DEEDECA2E335A7118F637FBA10170906EB4586E855DC5D5B0A3330E878", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646169093, "uuid": "e4e3014b-d4db-45e0-9fd3-0847226cf538", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646169093, "uuid": "889034ad-4762-47b6-9f74-3bd7a8eb7e28", "value": "98304:JI57+942P3MnStZag4LNfIuf/MysZb5P4rEUEdWgEIRAdhUgPP1iPt7qoDq/Ka8L:JI57C6SegeJIufcRdJHALPg3Dqf8chu7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646169093, "uuid": "c37924e7-b85c-4e76-8181-66da5e185068", "value": 7722080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646169093, "uuid": "86d45f78-6feb-458a-a8e4-7a9c746e54bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646169093, "uuid": "9d92cd52-8c61-464e-89e3-e700c7e7dba0", "value": "i864x__setup__621e87182cb9a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff37c459-9986-11ec-9275-42010a9c0029", "comment": "Malware payload (Smoke Loader)", "timestamp": 1646156562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646156562, "uuid": "16e8ad45-a3b6-4484-95fd-b2cbbf1bdf6f", "comment": "Malware payload (Smoke Loader)", "value": "16720a85bc94ccea9f56822642e22ba9", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646156562, "uuid": "a7571ce3-d2f8-47bc-a5a0-e419b1be04c5", "comment": "Malware payload (Smoke Loader)", "value": "148565389f129bdbb31636fbd357c83a36ec0647604ba6898d0c80c79ca3bfad", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646156562, "uuid": "e7f95863-2a9f-442c-8271-e68b08e2fa3e", "comment": "Malware payload (Smoke Loader)", "value": "db5a8763b95bd9d3a3df4df10f4449e08fa7734e", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646156562, "uuid": "f1856e30-44bf-4b3f-93cb-b893f202569f", "comment": "Malware payload (Smoke Loader)", "value": "e62a526ea79409de6547ac5a92a8f5d49a2abbfa49eef35b4a6d2899138c82b9e38dbea2ff83d5b3cda3d671217dfa11", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646156562, "uuid": "8a1ed6ae-f408-4b00-ac69-347c4ff45f84", "value": "T14D749D40BBA0C03DF0B711F8787A93ADA53E7DA15B2051CB62D52AEE16356E0DDB530B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646156562, "uuid": "b0e9fc6b-3c94-442b-bb28-5b3f27efd7d5", "value": "26b4d512596063f87f095ddd2779dc70", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646156562, "uuid": "3c31c629-4995-44f6-83c4-abe62f5a7fab", "value": "6144:he7iPG4Jbn7YZLc2QdqqchXbOZvQQWBEI:Etmbn7YZtQqqchrQvxd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646156562, "uuid": "4f94a5fc-6da0-44f0-82ff-faa428f96d1d", "value": 359424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646156562, "uuid": "529c220b-d8bd-4e9f-bba0-a1af7cfe2f24", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646156562, "uuid": "91161829-c79d-4f13-a4bc-d39e7669c875", "value": "16720a85bc94ccea9f56822642e22ba9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "496b1f74-9938-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646122757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646122757, "uuid": "2fcbade2-87b0-47ba-9cd3-b0408ff9017d", "comment": "Malware payload (Formbook)", "value": "8c840ddc9358aee5ade07a6a85b7df47", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646122757, "uuid": "58a41f67-726a-4c22-bdd3-bddaee364eee", "comment": "Malware payload (Formbook)", "value": "15bff226310e77a5ff67a9e131c8e5d7ec0686e967e0863dca784f20fd8d0268", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646122757, "uuid": "5c7c02b4-ffd4-4b22-b308-eb1d79f93e3c", "comment": "Malware payload (Formbook)", "value": "307cfb669a96d3f2c61dcc4fc40ff8f2c0af0d58", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646122757, "uuid": "cb38aaec-d011-45c8-9687-02a3bb427fb3", "comment": "Malware payload (Formbook)", "value": "5313aecb9f27d440994b48aa8243e7290cf81ddeac9a7a3412b603fd7f3861e4c4e828dc028adf594ad63af9e70b75a1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646122757, "uuid": "75f301ba-eb6d-4afa-8a22-36f384bfe89f", "value": "T1E515BEE3AED05432C13A1739DD1B97989926BF112E38594A2BF5DC4C8F3A7C1383A257", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646122757, "uuid": "9e4f3a0d-5f48-4fbd-ad2d-9334b390f788", "value": "64e5840c420b2c0e97168f714bb7e606", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646122757, "uuid": "358f5059-6887-403f-bbc7-55a5a633a0ce", "value": "12288:KzUIfU7Qz6JaV9TjdNRgjYP6hsmSgJRO+jj6F2pUHOwlME0WUX/CALdWSPm6LR:KBfUMV9ThgYPYS8/j6F7ZME0Wk9d7HR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646122757, "uuid": "4bbb80e9-d472-447b-9d2e-4981137de3ba", "value": 936448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646122757, "uuid": "27e73f2e-b954-4be3-8517-77e3c19197ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646122757, "uuid": "4711ae4f-2ba8-4a1b-b19c-f383caace70d", "value": "DOC982761717.DOC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee068b9f-9936-11ec-9275-42010a9c0029", "comment": "Malware payload (Gozi)", "timestamp": 1646122174, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646122174, "uuid": "1162d885-b43a-4a64-b3a0-a261ee44eb0f", "comment": "Malware payload (Gozi)", "value": "613470b0b543f0bffb7a994810158e9e", "object_relation": "md5", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "inps", "colour": "#CC4ED5", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646122174, "uuid": "9c58c98f-1ebc-4fef-a4d0-c3ce180c5363", "comment": "Malware payload (Gozi)", "value": "162f9efb734ab9b2769b170ef449ad5e16220a2031e0588b56a71e8de80644de", "object_relation": "sha256", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "inps", "colour": "#CC4ED5", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646122174, "uuid": "568b2ebf-56d9-49d7-b08d-3550080c26e8", "comment": "Malware payload (Gozi)", "value": "4a3364589a44809bab2ca05f0b612edd46b1a6f4", "object_relation": "sha1", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "inps", "colour": "#CC4ED5", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646122174, "uuid": "d230b5fc-ef4a-449e-adbb-d3298415bb2d", "comment": "Malware payload (Gozi)", "value": "174b9b767b2856b6da494c09e1b3d2d5b8ec04df12e16dd1d1ac3086aac83cf92ed9c8268cdd0bdd6abad7449e307467", "object_relation": "sha3-384", "Tag": [ { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "inps", "colour": "#CC4ED5", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646122174, "uuid": "00b91d6e-9d3d-4231-85f8-b03ce581e0ac", "value": "T114224B9EA25790D8871324DBE8BE6F0FE500CDE5DFFA9142F80C578218ACB469E0428D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646122174, "uuid": "7833a337-d914-4a8d-aeb0-56541eb870e7", "value": "192:S4YgEw22Z/QmqHEFzIdvmrRBgi2GjKJTP1/PBc2fqhJ0EFC8hFohHIf7yvf:S4Yfw22ZdoEJI9mF2LJTNXM0EEc9mf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646122174, "uuid": "20cdcbe8-df52-4f92-abde-d2e6a7918beb", "value": 10461, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646122174, "uuid": "0377ffb1-ec00-48e9-8439-70b78aa75e7a", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646122174, "uuid": "b99d8386-cb27-4da5-801f-6ff69d9c2f16", "value": "metod33.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0487dca-9959-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1646137076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646137076, "uuid": "e510951a-ce87-4316-accb-f30228d0a1a7", "comment": "Malware payload (RedLineStealer)", "value": "19291ad5430d031f934aec03bf3a3dd6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646137076, "uuid": "45db605a-bc17-43df-8a4f-9f6b1272b58d", "comment": "Malware payload (RedLineStealer)", "value": "1635567f96d69d53a64c49fb4a8cb5d65663d545f4ae4ea7c6465b49e4c297f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646137076, "uuid": "883496d8-c92c-4491-8eee-3c10d4663ad4", "comment": "Malware payload (RedLineStealer)", "value": "1bbf7cf6a8db2ec6afc0450b70e27c65a19d0b2d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646137076, "uuid": "02c0adea-f2a2-4331-9f5c-0c4e3b6e4438", "comment": "Malware payload (RedLineStealer)", "value": "28d14c08c583f2d144a9c727e75c892bfdd658445e39748931a30de4bd14000214c6e9cf59231da14e0efe0f656ee15a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646137076, "uuid": "55272521-bfed-49a6-bd5f-5ca0cd99524c", "value": "T1C9C4238153C52E2DC0DE00BDA54CDB4AF9F68A50A6C07173D216D7A9CC1489FFB9A2B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646137076, "uuid": "eb4800cb-87c5-4740-a07a-fc67c30635af", "value": "445554923421947cbff896012e27345a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646137076, "uuid": "9a62c791-e299-4cc2-9403-472a17f25d07", "value": "12288:NLWmUZ+mp1JdjggTztQS03ULaHNqrxlKIQNotgmLCCTcnA4dIvm:5wZ3zrF/tkEaHNYK3wgmL5TcSO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646137076, "uuid": "2fee294d-9a5f-4429-ae9c-f02c2a07d9f1", "value": 578048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646137076, "uuid": "e53af1ba-8292-40e2-a922-2f732770a0ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646137076, "uuid": "352ba1e2-31bc-45c4-aa60-5fd71104b811", "value": "Genshin hack.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "910958b4-9941-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646126742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646126742, "uuid": "07be8a7c-b868-427f-91e7-8154af375359", "comment": "Malware payload (AgentTesla)", "value": "96ed14da23afc1f15df3f67107e8635c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646126742, "uuid": "86bbd84a-f49f-479a-b6ef-5d449040f705", "comment": "Malware payload (AgentTesla)", "value": "17a9af1769c088760c113fb2c361fa4e75d30d59d058340142697e8b93efb17f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646126742, "uuid": "2dda9016-4dcf-42e0-b54d-404b6d3dab00", "comment": "Malware payload (AgentTesla)", "value": "dfb76825545c3ddbc8b3c58f3df33c6ea9c7916d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646126742, "uuid": "98014a09-62db-485a-ae04-afb0f8c52c44", "comment": "Malware payload (AgentTesla)", "value": "7e7fa5b0af9d36bb5a579c3042e69e300e27633b2a2d87aed65076be79572ae5a1d858ae3140c78493aa9d4a3ac32f77", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646126742, "uuid": "f8394e86-9979-431e-bf19-836d2c82ed9f", "value": "T13915CF0539EA4034F93697F2CBC5E7E08B7DF621D889A0FA68000F595511BBD8949FBE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646126742, "uuid": "79b815e1-a74e-4e11-ad0a-f4ae67ad60ae", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646126742, "uuid": "b4993860-1e80-47f9-9821-a73ce862b170", "value": "12288:fhQR4DlVoYO9dKnhFCTCtpgLGlIcSruMRrRuxlqHSuRJ7ZGvlCgmq:fzVoYKaDqCtzvSruMjuYR7qsgmq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646126742, "uuid": "6ff0b200-4ed8-49ef-a35e-ddb051529808", "value": 898560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646126742, "uuid": "1a148435-3ed9-4cc5-9fdf-f478441f905d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646126742, "uuid": "a4891708-3301-4c50-be90-ed566db7a970", "value": "96ed14da23afc1f15df3f67107e8635c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb1b4b3c-9998-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1646164206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646164206, "uuid": "d75296da-bb68-42ed-b5bc-73013e88e881", "comment": "Malware payload (Mirai)", "value": "23193ec9bb67d3623f97cfbd15c7da33", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646164206, "uuid": "80b70086-8ea3-4092-ae74-8870ea451569", "comment": "Malware payload (Mirai)", "value": "17aa2e1694a8f66ddc52830b698cfb4666cdb318d56a72af7cf3b1f7b305fcb5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646164206, "uuid": "fbed21da-1082-4b34-a655-3b48d027d848", "comment": "Malware payload (Mirai)", "value": "07283831a0ab5aec6d28b54a4d05b3e34b3abbc7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646164206, "uuid": "a1880532-f71a-4153-9776-332ebb6aedb6", "comment": "Malware payload (Mirai)", "value": "16fca267c2b0884c65cf75998c3027b6fdc0bca74a1423147aae97cd8d474b2258b07b35de4ebae45f367d96f3538949", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646164206, "uuid": "75763e7a-dad7-4699-9f3c-88417b520729", "value": "T14AD2D074A16A71B189314035BDAC8AD713632170E4EFB1B737842AB97BE30892DE15DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646164206, "uuid": "e3d9a09e-898b-4ddf-bf8f-a4965ae516f2", "value": "384:7+pBNm5t8706u9jtiyM0hYQEmIyGrjEEHFtFj9elFiQ7w6d47eJTtw3hymdGUopo:6A4uBc0TiXEgFtFj9elFiQ7XxAs3Uozq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646164206, "uuid": "0719d460-34ac-48d3-a95a-8e70486c8187", "value": 29944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646164206, "uuid": "eb4970d8-9cd3-42ef-a82c-6280575699c4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646164206, "uuid": "57168849-6734-4408-b08c-89ab35fbd05c", "value": "xd.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8ec27dc-994f-11ec-9275-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1646132876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646132876, "uuid": "b8ae2ad7-fc35-4c06-9b29-cccd79b1b015", "comment": "Malware payload (Quakbot)", "value": "425231baf8beeaa6a58ab0652eef86e2", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "THE FAITH SP Z O O", "colour": "#87FB2C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646132876, "uuid": "12e05783-46c3-4b19-a16f-908d1d4813a5", "comment": "Malware payload (Quakbot)", "value": "1897e405b74c9a5bb3b3a526a5dc5aa77b07c1f2b65526f49be801a276f4d317", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "THE FAITH SP Z O O", "colour": "#87FB2C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646132876, "uuid": "4b9fc247-7004-4c7b-b7ad-5b158dbaa40e", "comment": "Malware payload (Quakbot)", "value": "229dc191794a210f0606c9649f6a756d7a14f023", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "THE FAITH SP Z O O", "colour": "#87FB2C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646132876, "uuid": "10eb7c0f-e6c5-49b4-be0e-9139fecfa4b6", "comment": "Malware payload (Quakbot)", "value": "8b597f46e96dc432b7f7b521ce4f86da64a30ce9e2217433389a2a44cd28ca6b33c8d5014d7b723f3d2630528ca877e5", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "THE FAITH SP Z O O", "colour": "#87FB2C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646132876, "uuid": "ef7b2a05-857b-4775-aec6-c221f76fba86", "value": "T14115F94286642A0DFD3DCEFB6F3AA3ED40664F70192AB256E350288951B81F1723DF57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646132876, "uuid": "46e62042-6065-4758-bf62-ade0d6b57293", "value": "a2c4c1cc45cf157e67048505a3f85c3c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646132876, "uuid": "a5275802-20c9-4fc7-ac1e-5095da4a05e5", "value": "12288:Zg4d/lpygJCNLgUgYUypwKzpVCD2aep4Xl8I1JV5OwBi6fC8a/ZnFH08hXhQrVNP:ZdddhCN3tVwV1Twh/n/qVh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646132876, "uuid": "cc36fe7e-fdd4-444e-aa4c-81b8885cd2e9", "value": 955509, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646132876, "uuid": "f1095519-39dc-4870-93fc-45b41029eb38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646132876, "uuid": "0876e2e8-7dc0-4239-ab71-f352d3fab84f", "value": "1897e405b74c9a5bb3b3a526a5dc5aa77b07c1f2b65526f49be801a276f4d317", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5205145-997d-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646152573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646152573, "uuid": "d285c227-2db1-4923-856e-f5ccf726fed8", "comment": "Malware payload (AgentTesla)", "value": "cbb1a451c99620cd04967aa6d28442a3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646152573, "uuid": "86a22fc6-5914-469c-8b69-7cbf7e4167f7", "comment": "Malware payload (AgentTesla)", "value": "18a574b56d1b7c907190a23841194768e1f3c3a66bd0fc05327292efad332df9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646152573, "uuid": "d9eb011f-1b53-4231-8402-7ca37e4286e1", "comment": "Malware payload (AgentTesla)", "value": "51edafd42397deca3c1164f92dbabe474c2434fe", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646152573, "uuid": "9e01606b-6fd0-4a44-bef9-81dc144026a6", "comment": "Malware payload (AgentTesla)", "value": "4b0091a77c504f5edfe234cda87981647bdbe72efcad9b568b09436f25e4b490332f99b96f2de461e4337aeee3c7f6ef", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646152573, "uuid": "e286b371-2410-493e-9f85-5163948ebda5", "value": "T13215B04835E6603DE836CBB1CEC4EFE1DB69F222D14960B650020E599A0DBBD8D45EFD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646152573, "uuid": "05fb855a-469c-4c0b-b26d-30a0b84502c3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646152573, "uuid": "4d0cbd8c-0d20-4134-8617-3a41218b7d43", "value": "24576:mU7iwrfCtdoT51Psi5gvdZkWslwaQmXHTjIr4:mUWwN1Ps0gvdkygT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646152573, "uuid": "b1948083-14ec-4810-93e4-b0b0f9fdd880", "value": 929280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646152573, "uuid": "a45ff0a1-83ac-46df-bccb-28f8ec953cba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646152573, "uuid": "9c5ef263-4c94-4a38-86d8-9ac231f7be55", "value": "Inv_7623980.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf28afc9-99b1-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646174950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646174950, "uuid": "e0abfc3a-8977-425a-8641-75a966a80e56", "comment": "Malware payload", "value": "096a14da7b1c40bc941dc22b3e5bf961", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646174950, "uuid": "a212efbe-fff2-4f75-bb14-441402f637a1", "comment": "Malware payload", "value": "19b0ae69707174f0611bc18de98d7b8de37df9eca5dba12bf77d80d957311979", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646174950, "uuid": "1ed69554-001d-4f3f-8039-ad60e0f00ba3", "comment": "Malware payload", "value": "0c3cb9a1ea7b045e30c8998050d0326f33fe8961", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646174950, "uuid": "507924f5-9b09-4eaf-ac19-a4170b456b71", "comment": "Malware payload", "value": "f81a5ff824d35c6f705e09c9eec2ec0fee9880136512983615157bda01c5d6333f16900302e3ae8b693dec5265700a07", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646174950, "uuid": "5e1796fd-defb-45b0-a07d-3fe2c48ffc17", "value": "T1C1B4AE11B7D0C072C26A35342926E7B656EEBC719AF583876FD03B7E5E301D18A2835B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646174950, "uuid": "ff8f8aa8-3c66-4c05-9365-23be193df1bd", "value": "d02245ac5c961d83d0907c826d8ba5c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646174950, "uuid": "7b05d400-e29b-4994-9749-8e54e48249c0", "value": "12288:JhC1q3aXOwkiPs2iCtyjMOAIlgOkar//wJY8Itgm:Jgq3aFkiPs25aM2Bkm8jm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646174950, "uuid": "e0f6ee96-f7cf-4632-8ed3-5dbe26bbd064", "value": 499712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646174950, "uuid": "174e7afe-c6d5-4dc4-a7e4-f0eaf95597fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646174950, "uuid": "d5681f9e-bc58-4804-bc8f-8e887c81a75b", "value": "096a14da7b1c40bc941dc22b3e5bf961", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "378d3ca1-999f-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646166965, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646166965, "uuid": "7658de43-10b4-4404-be26-f9fe1aea2362", "comment": "Malware payload", "value": "23058461f4be3f43df4acc318f05ab0a", "object_relation": "md5", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646166965, "uuid": "e6b7be5f-7f98-4472-a62e-5faf903c707c", "comment": "Malware payload", "value": "1a3d8d0d405c0ddf68a76234530555aa59be65aed9baff7e47d9dc08b3de3b5b", "object_relation": "sha256", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646166965, "uuid": "05f8fc91-d6ac-474a-820f-a8439d051d5f", "comment": "Malware payload", "value": "ccf0702483cb9927eed3774b455095028e3cbad2", "object_relation": "sha1", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646166965, "uuid": "a3f6bdae-fd97-44aa-9537-d5982a9f0fb2", "comment": "Malware payload", "value": "b4722e82619e0859cc0d457f3f3947ad0603dd45cf41b680ce4332ab5dcd5c59eb64d7c57fd5f0b94e647decfb4e596c", "object_relation": "sha3-384", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646166965, "uuid": "d68849f4-3c21-4939-a4c6-f024fbaccffe", "value": "T1C623D025C1607828C73E8C759200EAD2720A7D04D9D5EF893585BB4C3B96BEB57AF9CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646166965, "uuid": "2f215421-01d7-4fd0-b053-8e91c56cd85b", "value": "768:uio9DOevZCwrvtD608zdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Uh0VPWft:uio9D7UtT5fTR4Lh1NisFYBc3cr+UqVC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646166965, "uuid": "48fba4dc-1e50-4858-b618-071279672ea2", "value": 47699, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646166965, "uuid": "9ff16bef-84a8-461b-b162-a1c9abbee6e6", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646166965, "uuid": "5f519144-1178-4b78-bb18-10aa820ee5d6", "value": "Ommega_1.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be136620-9942-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646127247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646127247, "uuid": "2b1aa53f-0113-4bdf-920a-f40ffe224752", "comment": "Malware payload (Heodo)", "value": "c767cce7e48ff6b2fec5272b3e85b957", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646127247, "uuid": "a2518c81-8ace-422b-b387-630994845b0f", "comment": "Malware payload (Heodo)", "value": "1a412e8fabd9586c96638126686d86a09ee1f937c1a26e715ef4558e92503f9e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646127247, "uuid": "44d73ade-5dea-4dfb-a00d-18cdb76e4d28", "comment": "Malware payload (Heodo)", "value": "6506cbcad9f4700126d064855de9d4d7eb3d5cfa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646127247, "uuid": "c7796310-28a5-49b6-81b5-ab9ddd1118fb", "comment": "Malware payload (Heodo)", "value": "304228d981d6a3d4fe8a1746ab3d7515e0670cd32727305e2dc7cbae1d0949828b6aad11e8384c35b461aa489ee21707", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646127247, "uuid": "8649ba15-c1ed-40a5-95e1-b5671e19d6c7", "value": "T1C6C4AF12BFD39072CE2F293C503DA77413A95C65971A8863979C9BBE1D3F9428B3190E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646127247, "uuid": "79bbc864-799e-4102-a685-a5523a6deb1e", "value": "e0b213ccd96f46d30dcd8e225f4e9fc9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646127247, "uuid": "5c2b3481-0b82-45de-bfdb-ff695eecc2b5", "value": "12288:onEtDywy8SYlHD70WychG0QOCM8T9xvCtyDyPgyQz/VDNeg:onEtDywy8SYdnhG0QrM8hxKt7a1Ne", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646127247, "uuid": "b9e1ec37-b371-4b64-9d32-ca3b9f8671cc", "value": 585728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646127247, "uuid": "44c6f0f4-ebab-4f31-91c1-03590b011062", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646127247, "uuid": "ea75af49-a273-4f60-8669-c4a9bff5bbbc", "value": "c767cce7e48ff6b2fec5272b3e85b957", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9897772-9956-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646135803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646135803, "uuid": "086c2b54-229c-43f4-82ef-49ffd7309285", "comment": "Malware payload", "value": "f9af66817046ed38e6652e3d90e8fa09", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646135803, "uuid": "5b1ab3dc-ece4-4fee-a8b9-124e02f77d51", "comment": "Malware payload", "value": "1aa3a012441c3c16f1183f41af1880c03fff1ff7a0e91ecf1d3254861a65fcb2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646135803, "uuid": "df69dbe0-69dc-463a-a352-ddb961c17a48", "comment": "Malware payload", "value": "b86d9c8453b03cf32e823a919738937b1d977a81", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646135803, "uuid": "16aec812-25a6-469f-8793-0f50679cce22", "comment": "Malware payload", "value": "0bc2d306b85151b8e025af7be542130ab3649a2c8a380bee23c27dd7f63f31308ec2090e488ca2536eefb55a6fceb016", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646135803, "uuid": "9775d74d-cb62-4d60-8ca2-95ac0e73a9f5", "value": "T109A4BE813CE00AF3DEFC94B6F93B04A85F570D7DCAC4519534F5B6984EAAA358C1BA24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646135803, "uuid": "d25e4da3-ddaf-4683-ae6a-b878c544f7d9", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646135803, "uuid": "6af44f54-eb08-4a43-852f-668f32ad3923", "value": "12288:i3bQ+uw2aL6TL1wkgtJpeaHwLLvppI6+69GTU+NUp5e/tppT3ppJypKpSsMpFphZ:i3bQ+uw2aL6TL1lgpwLLU64pXtOzwL8z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646135803, "uuid": "ca2a9692-bce9-400f-8bb6-52ecac7b3203", "value": 487611, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646135803, "uuid": "ad8e421e-802b-4ca2-a24c-b6d0db396c02", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646135803, "uuid": "50674c47-99fb-49db-9b33-8f69e9e3ea5b", "value": "RULES AND FORM.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "565268e5-994a-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646130509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646130509, "uuid": "031761a8-77bb-472d-ac60-d2d3a99a29fd", "comment": "Malware payload (Heodo)", "value": "666c0c687beb69c106e65d508d5a0d0b", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646130509, "uuid": "72985e2f-518f-492f-a4ee-9804a4e31395", "comment": "Malware payload (Heodo)", "value": "1ac9b5c8c424e1ecc862e87d96a1cdc489a419eeb7728869171b4169b2ec3be8", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646130509, "uuid": "04aa03c3-a0b9-4aa4-838f-5b417db3298e", "comment": "Malware payload (Heodo)", "value": "6be1f88bcdc027d1e671621d4b4b2c0f99ac1b83", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646130509, "uuid": "55ef7a2a-2705-4013-9d3b-fe83b51fd26c", "comment": "Malware payload (Heodo)", "value": "fd64924f4f773206d6ee2b12a8ec03abdf4edb380454c71f79b0ea5b1b2aadc3418258579f76d206cb5b83a345eb4158", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646130509, "uuid": "f07bd3cf-314e-464e-9fe2-e9bf00772218", "value": "T1EC13E02AC0961959D727283DD6148EF4124C0E4A89E5F99B1D50B3AC2B6E1FB0B4FCB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646130509, "uuid": "105f231e-f109-46bf-b6ac-ad8ebd356cc7", "value": "768:m9oms9O+pOevZCwtxyKfcrND59V+L9Rw4eWrXcTqw0VfWZE:m9oms7tylND59V4jwmXc2RVfW+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646130509, "uuid": "70ba0119-58c9-478f-81ac-eaba7cb0d7d3", "value": 41841, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646130509, "uuid": "1015d85a-fa49-4d6a-9f57-f800b55b094f", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646130509, "uuid": "f0603512-4d73-41c2-b932-a76b25dee13b", "value": "Form - Mar 01, 2022.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "286b8c11-9986-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646156202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646156202, "uuid": "5515570f-b3da-4914-8f77-21d774982f4a", "comment": "Malware payload", "value": "386787a25e7067b373714b7ccb284600", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646156202, "uuid": "f83c7267-a011-40a5-9919-753cef91ef75", "comment": "Malware payload", "value": "1be5c12bca0bceb62490a7dfb48d5844865940c9dd1aa2fd2e933bc8c191e81b", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646156202, "uuid": "b7556f83-7857-4888-8b8d-ede70f346178", "comment": "Malware payload", "value": "260b847b63e416fb19627bf158b41421b12a03d4", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646156202, "uuid": "22dd2511-cbd1-45aa-8765-d9fc768e4313", "comment": "Malware payload", "value": "7dbbde01b813266de183eb58b193c48b94334253a9772c580c9b48f87eac46c24293238ede036c3dc32a711385d5219c", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646156202, "uuid": "76721cf6-ef4f-40dc-b490-70e97843d29f", "value": "T1ACD35DA85CDCAC94F984EF42C6A2B5463F31792F65F63084264F691147CFC3AA3399D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646156202, "uuid": "4aa8520e-f960-4aa6-a94c-22954b34b6bd", "value": "1536:zA5X2HbFWD5XcgEr3vDCGImnN2HTA04oc3yQTR8BRtc8mZiUz/zA/IEUqnMtSuft:tYKgmLCT8046QFyXEio72+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646156202, "uuid": "ceb1d582-b90d-45a8-a42c-ccdbf7efee39", "value": 135693, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646156202, "uuid": "f64b36c2-5bfa-41d9-8f0c-35c634bebc6d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646156202, "uuid": "a0940dee-ea7b-4d1b-8103-8abd530585ab", "value": "DHL-ShipmentNotification-716342623_DHL-ShipmentNotification-716342623_March1st.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "240a2790-9963-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646141162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646141162, "uuid": "80359039-488a-4d05-9a47-432c9891610a", "comment": "Malware payload", "value": "bfaa2ea25a9ccaee5407beb4e04ce3da", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646141162, "uuid": "0df28cff-a339-44dd-92aa-e1a1bf6df4a2", "comment": "Malware payload", "value": "1c2d3545e5214cb2efe1a614d1daf6d07f4f2a07aec5fe162b4e2553a28927e7", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646141162, "uuid": "f35edbea-fad1-430a-98d5-e2113732b3e0", "comment": "Malware payload", "value": "40281e1d13c64ec8c10ad4d2724137d1f5d89846", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646141162, "uuid": "4ba0c7c1-25e8-47ea-8183-c9c335d9d6c9", "comment": "Malware payload", "value": "7337e3c445e0a46cc979cef7f78965fab78c4c3519f95dc5d8a69dad3cc3126018701e612e3c0e20940ba0465de457b7", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646141162, "uuid": "a8fe7874-c01f-4be8-8954-3232416e1ab8", "value": "T127A1E850112C1AB17246697AD26FFB52B50EC81B09777B358473A63C74F5DB8E0396C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646141162, "uuid": "b32ef1d4-3d3e-44db-ac72-db03b7779904", "value": "96:yRYZxQOBpLyxIcymLKY8M991wuIaQPYPW:yRJObLyxIIYMdwuwPYPW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646141162, "uuid": "54a802f5-ea59-45ae-b01d-729263d21051", "value": 4766, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646141162, "uuid": "47f7a797-8075-4c5f-8e14-39890abe1792", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646141162, "uuid": "5eabb774-a3a1-4b2b-8305-18d220dbe98b", "value": "1c2d3545e5214cb2efe1a614d1daf6d07f4f2a07aec5fe162b4e2553a28927e7.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b89dc46a-996a-11ec-9275-42010a9c0029", "comment": "Malware payload (Hydra)", "timestamp": 1646144418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646144418, "uuid": "7ef8efec-d432-4d7d-bbe2-c0ef81475388", "comment": "Malware payload (Hydra)", "value": "423566623868a27aaba992afdde2ffe5", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "tor-hydra", "colour": "#10AB92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646144418, "uuid": "af474787-5673-40f0-a2c6-3eacf468ca1b", "comment": "Malware payload (Hydra)", "value": "1c6ff4c48a7506facfcc0f82164eeac056318c263b6ed61ae02019871cbd928c", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "tor-hydra", "colour": "#10AB92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646144418, "uuid": "47bb55dd-4c1e-4dc4-9b6e-a5f280708448", "comment": "Malware payload (Hydra)", "value": "99a515661d24ef2fec8406c31bd91d36602ed7cb", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "tor-hydra", "colour": "#10AB92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646144418, "uuid": "7b2bcdd9-abba-477e-ac37-6b0a9fad8acf", "comment": "Malware payload (Hydra)", "value": "67d13813504b722850d8b2462bf634349e18691c3a76b4bdcd57130acdffce69512428c6de91feac54707709347c19df", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "tor-hydra", "colour": "#10AB92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646144418, "uuid": "d5e313c7-1edf-4e64-8fbd-a78aa58322d7", "value": "T18C4633C5D9C691E2CE71617CEBFB85B96014BC23872A84972938B3EC14BB5CD83C7199", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646144418, "uuid": "10b4475e-6bd4-467e-adc6-dcbd7636d459", "value": "98304:yGUuEYUzoyuhjgWfJLhuy+4ySdMf0ptVmxAmMvHZnX/jxMoJK7kWuh6FHvU:yGUqGoy8xfvuL1SdMyPJfZnX/jjBkNc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646144418, "uuid": "4a86ddfc-07ed-4e5f-be67-8bf4fdf0c642", "value": 5426030, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646144418, "uuid": "fabe98cf-877f-480b-b2f7-eb9aa8b67490", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646144418, "uuid": "3845f2c2-6ec2-4c17-bc44-09e02a7eaf8a", "value": "bawag.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f05ff2ea-996b-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646144941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646144941, "uuid": "57e06e2b-9154-4da1-a3ba-a8db8a2f7c19", "comment": "Malware payload (AgentTesla)", "value": "e63e2a062cabbe3cf3e48b0a0ba439bf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646144941, "uuid": "3cd876b8-04bb-4ce5-a623-502a5494463c", "comment": "Malware payload (AgentTesla)", "value": "1cbc1cb8db2cdc7f0b66d9fb603ff28e89c0e4d930b9cd094bb59ed3f2fdd177", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646144941, "uuid": "e78efc6f-55de-4932-969e-7bfd0efbabe0", "comment": "Malware payload (AgentTesla)", "value": "9f0b9436f53b8a8edc146ffa7be550340e018bbe", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646144941, "uuid": "cb725c0c-6e60-4c34-9c03-1e7db4476a4e", "comment": "Malware payload (AgentTesla)", "value": "b198db9fbed5d25a17f6828adbbaf8a635cd716f09a9c4db0ec3e8b32572af5ca3a691edd5e6256c8e4d626b068ea017", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646144941, "uuid": "4b240de6-3930-4daf-9de7-b32c55ec9b39", "value": "T15105BF0438E65038F93A8BF2DBC4EBF19B6EF261D48970F554000E555A46BBC894AEFD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646144941, "uuid": "35bcd77d-0a49-4e92-b5dd-d175bab342c7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646144941, "uuid": "57c7510f-9903-4e87-b4f4-21577d0341dc", "value": "12288:lEDiR/IO20gI+CG/Nla6Ia53HpPpliOtuQQx127kHrbGzFuIl8Tpp55:H+CmNcyHpRliOtIcKPGzB8b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646144941, "uuid": "674c3238-636d-4335-96a0-ed03f035a266", "value": 835072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646144941, "uuid": "7a96a81a-febc-498a-966b-716864747288", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646144941, "uuid": "44a320ca-5fb8-4ca4-904d-2b4c590ccf01", "value": "payment receipt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77b6b19c-9984-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1646155476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646155476, "uuid": "6825d90e-0e80-4774-81b1-52981981450e", "comment": "Malware payload (SnakeKeylogger)", "value": "afe390abe16f621e2c5e366c7b1cc1da", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646155476, "uuid": "9b635b84-0937-44ba-b7a0-e2d97aaeb3cc", "comment": "Malware payload (SnakeKeylogger)", "value": "1cdc2ee2eaf1ef6c460d7f0cfb14bdb3ccf4ca6a8f5b7aeecbc06c87ab38082f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646155476, "uuid": "dfe64838-adc7-46a8-88dd-c7668fb5dafa", "comment": "Malware payload (SnakeKeylogger)", "value": "80461a4714081be6f024b1197ba42edc87e85fa6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646155476, "uuid": "f4329345-0942-4f35-accc-89b9199c4ed2", "comment": "Malware payload (SnakeKeylogger)", "value": "3f83e816cc90772de3a20186e3e3ec1a1602cef467e3f33bb5bc591aa890da4e26ad9aa3e0ba8c577d40f47f814a6aaa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646155476, "uuid": "e6ae434b-8361-4007-a556-9a1ab30edb51", "value": "T1D505AE4834D6607DE8368BB1CAC4EFF0DB6DF222D54A61B250020E59960DBBD8E45EFD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646155476, "uuid": "9b4003d9-ac57-4a80-9c45-e5f1f8caeb24", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646155476, "uuid": "647d1dd2-c808-4174-8840-64d34235b891", "value": "12288:6b54wPbvFS12gIMxefyiEX2P68eagSivP6f2uVy59z60I3121MLHR/T:sXgIMmkGy8sSCCfZVynzi12", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646155476, "uuid": "8c4f4779-1d84-4f5f-8b55-3f6d16384f2f", "value": 843776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646155476, "uuid": "b9724879-1276-4e19-b598-cc411c14c4d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646155476, "uuid": "309f3eef-efa6-43dc-9bb3-70ecdd313207", "value": "orden de cita.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7367518-996b-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646144845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646144845, "uuid": "f95c570c-9d65-4e77-9e51-6a01939796b7", "comment": "Malware payload (Formbook)", "value": "954684547cc2fa7a70f3ce469a87c8ef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646144845, "uuid": "66105eed-ade2-4df1-b0dc-d6894dc5637b", "comment": "Malware payload (Formbook)", "value": "1d58f3eafaaec4e9307ac99a4964f15e5bce27e7ab879db3ba08f1bf6866f171", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646144845, "uuid": "af51c6bd-9beb-45dc-a6c6-6a27999bb71a", "comment": "Malware payload (Formbook)", "value": "7938951e055faa42c8df366e5a30ca49b9196a2d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646144845, "uuid": "6d9b308e-1609-448b-bb57-8d3414d901ec", "comment": "Malware payload (Formbook)", "value": "b3deefd96d301c8dcf6e81e68ffc0b4c2663fc3841e95b66b3607ab23d50da278ffd2e3ad54e5b25426748692fb4467b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646144845, "uuid": "a89fdd6b-f8df-46d2-8371-4b7194e4c5ef", "value": "T1D16413C0338195FFEAD509321AE6AFFED7B3930101009A011BD53EDF75E1AA2571E59A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646144845, "uuid": "d4a52204-412e-4419-8413-8db6256c527c", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646144845, "uuid": "0a9f838d-7104-42b4-b821-3ebae0159c4c", "value": "6144:rGinPNq0HodPzFW+abqb3QMBFdz7nYnZE6zfnbv0OCwkrhd2E:bNq0IdPzFFaa3QMjdz7EBfbDCwMjT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646144845, "uuid": "b6149345-f9df-4278-9468-527571631946", "value": 320113, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646144845, "uuid": "8efe31d4-1d8d-4976-9546-6e1fa22f1d7a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646144845, "uuid": "6d20a8f8-cac9-4012-b213-7372409e2534", "value": "77709MAR.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d9dc436-99a1-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646167807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646167807, "uuid": "dca7f6a2-7f95-4c75-98c2-f86a37fb6b89", "comment": "Malware payload (Formbook)", "value": "19db2c87ba7651c9cd36d9a661bb4c63", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646167807, "uuid": "4be01560-64ba-4d70-b850-24bd21ae0ade", "comment": "Malware payload (Formbook)", "value": "1d9895e03278d784a5e0a253a67e85822f9915f8b0a137308785f47772be9bba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646167807, "uuid": "f726096b-b222-481b-bbda-15f883452c38", "comment": "Malware payload (Formbook)", "value": "8beaa2843ddf1f06ccb404f89531fce78de103ba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646167807, "uuid": "d98f7877-a700-414d-b1ce-b4e160b1cec5", "comment": "Malware payload (Formbook)", "value": "0d4dd01e027fa7efcf5a666b9d1ff7fd9cb7741c65d9774239d0b9ca5309da75417740abee434d8e46a31f233bfde639", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646167807, "uuid": "7405c524-d655-4bfc-bac1-a94e231c6a44", "value": "T11EA4F1D2908106DAECA84B75643B4C250277BE7EAEB1E68E6B5EB5712FB33C30117417", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646167807, "uuid": "9a1c8fb0-d7a4-470a-bd82-1204ab5dad6f", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646167807, "uuid": "232778f1-1856-40f3-a9e4-bfe7a83c168f", "value": "12288:C/8WpZAmDb79liost4nVPui8WEIeQ+7UE:C/LWmD34y0inf+f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646167807, "uuid": "85d7dcf1-d55a-4bec-b816-4e416c2f3b48", "value": 473167, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646167807, "uuid": "1c824c8a-d96e-4f8e-ba56-47b90f73101e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646167807, "uuid": "989d2cd0-ab15-4dd0-a70b-009dbf32a690", "value": "Swiftmessage.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ebb1cb2-995a-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646137261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646137261, "uuid": "40772528-a16c-40b6-ab66-45e3735cf2d6", "comment": "Malware payload (Formbook)", "value": "a22d4d60e8b841971ed356767e922a3e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646137261, "uuid": "02064702-9b62-4432-8126-a5602b10de16", "comment": "Malware payload (Formbook)", "value": "1da98c2ee11e4f3adcb1cc4486f4e74c50b925442896a29890c3b525a186f7c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646137261, "uuid": "1b9bebe3-e0e7-4072-a208-26a80d27b922", "comment": "Malware payload (Formbook)", "value": "fe4add1fc3ba1f9e11fde8a421187d0d9de9d344", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646137261, "uuid": "7e9bfc58-19f4-478d-9141-ecbcada1cbc3", "comment": "Malware payload (Formbook)", "value": "eabccf3eb7f3eaadbaa66b61122c81d61e5eefca93f4d134cca0157b3356e819a66976f6ce8d5c7efc1f91327bca0926", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646137261, "uuid": "078fdb0c-9a95-425c-8abd-77ddc4cbe21e", "value": "T19115AE4835D6607DE8378BB2CAD4EFE0DB2DF222D54960B250020E199A0DBBD8D55EFD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646137261, "uuid": "72eda736-7785-4995-973d-b384b37ebd09", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646137261, "uuid": "61fac97f-1977-4590-8364-3de3d1f8f450", "value": "24576:21EGjgA065JdNW4rQf65IStLIhqL2bb/:KEc15JrprQo1tLIYqbb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646137261, "uuid": "31348c62-376c-4068-80d6-2495dc829c7a", "value": 888320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646137261, "uuid": "9bb0a53f-8666-41cf-974f-a24784488772", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646137261, "uuid": "858da2ff-913d-42c1-8b0b-8982a9fe6f1c", "value": "vylVpID8OZOylu9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f0e7328-9956-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646135785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646135785, "uuid": "0bb4920f-30f8-42e4-a68d-be933ce93303", "comment": "Malware payload (AgentTesla)", "value": "d1e2aa18d3641801b89b15e0efe08be1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646135785, "uuid": "1129b436-5871-4214-a566-42faf7d47a64", "comment": "Malware payload (AgentTesla)", "value": "1e2f9505b7c5e1f5ba7d77baa04a39fad5cdb85751670ac177356ab91cee96c5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646135785, "uuid": "b4f13264-e8bd-4019-91b6-bc7604c4f7cf", "comment": "Malware payload (AgentTesla)", "value": "8608ff2eb8a4892c68e95287cdda56fdbab90db1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646135785, "uuid": "166f3516-d14e-4927-ae77-f3de558d2f00", "comment": "Malware payload (AgentTesla)", "value": "306fc0fee9d33aefbd4a0127f39697b452dd3096e51f30199c6aa01615bcceefb84beb11152cabaea26f07013b292842", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646135785, "uuid": "ac5acb46-32fc-4cd5-bf63-429a92f9ebae", "value": "T10674235523C0A9B3CB5705738537A278DABE44CE01585D9737620FF706BA4EA6E06CB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646135785, "uuid": "63021be2-30bc-48e2-a59c-6a2c2f2bc08a", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646135785, "uuid": "2160cfbc-7f76-4889-afc2-71e354819195", "value": "6144:rGinQCQGGwxJqRWxg6UpPr179fIrmCvQZsssVhplyV3sZPOTx2trIhql:EQxJBg6UNrD++uLy3sZPO0Kql", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646135785, "uuid": "d3dd9faa-a2c3-48f4-ba6b-45b1c3ccd060", "value": 368335, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646135785, "uuid": "e7eb4297-661f-417b-8f51-08f219fcdfb0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646135785, "uuid": "8d386b5e-0ed9-42ee-b9b8-3ab5fa116efc", "value": "Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2e57048-9985-11ec-9275-42010a9c0029", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1646156085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646156085, "uuid": "d319e095-18e1-44df-b407-ab6325600378", "comment": "Malware payload (AveMariaRAT)", "value": "b5e852de292e2c3e706b12360976cd1c", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646156085, "uuid": "23d97775-f6d6-4805-8992-159f055b7c6d", "comment": "Malware payload (AveMariaRAT)", "value": "1ea1fe28d656dc5ce38d6d29ef9fa0e1db982fa3f075f3680dd7cdfac17950cc", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646156085, "uuid": "38328719-4e51-43b3-9192-8ec59f0218d7", "comment": "Malware payload (AveMariaRAT)", "value": "add7414055f4790c099cc5934a3d6fcebdcd88c2", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646156085, "uuid": "9b300b8f-f5ab-409d-8e40-018e05ed44c7", "comment": "Malware payload (AveMariaRAT)", "value": "3960fa7a5ce6a995e22d34ecac74fb461c4ba4b19de61b1aef55695782529e7d3b7041953afc20da6c2d441d1628f009", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646156085, "uuid": "0b735eaa-8e44-46b4-8c0e-0c2409b90de0", "value": "T10C15D002718898DBE4132AF248AFD53021A57EAD9475C60E3987F72B95F335210AFB5F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646156085, "uuid": "2c8c3ed2-0376-4543-9aff-804871571b27", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646156085, "uuid": "f86148c0-681e-46d2-92be-658fc6d1b663", "value": "24576:GKuLG/CBEH+Woh9shjVx1JUmY5vgOF19nFuaoo+80d:NuLG/uEHnMshjVKmEgA1Th9Ud", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646156085, "uuid": "05b51bb5-95eb-4b0e-813e-02c514a8cddc", "value": 899072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646156085, "uuid": "70e92e71-526d-42b4-83d0-b500d22289b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646156085, "uuid": "c097fb20-e51c-4fd9-bf47-5a780dc4ca68", "value": "PO#5509126990 Sipari\u015f Ver,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8bb30aa-99b9-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1646178402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646178402, "uuid": "c4f57e7d-a61a-4f83-aa55-9637afa8144b", "comment": "Malware payload (RedLineStealer)", "value": "c16db5eb6fbfc65a8068f6ffa2825034", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646178402, "uuid": "0590c609-5f36-433c-89ed-509db16814d7", "comment": "Malware payload (RedLineStealer)", "value": "1ebca558d1885771267fda311073a6af58efff709f94aa27a8f9084c74af0c80", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646178402, "uuid": "29625b36-593a-4f82-bc02-1afda3e03d6c", "comment": "Malware payload (RedLineStealer)", "value": "425942f1e0c24212b3882ecf880f52da1c00256e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646178402, "uuid": "c8642f3a-0286-4f85-bbe8-75d8224c7ed9", "comment": "Malware payload (RedLineStealer)", "value": "86138a5e9a5113749445439d771059d935171befe57242f7f06674f30330fcbdac8ea6ae2dd28650a70186585b8c2a17", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646178402, "uuid": "8fb494e2-fce4-42b3-a2f3-0301de2b8955", "value": "T11026333775B85A9FE4CF2A796219EB23EF054C4E19DDA547C04B0F6251988F0F2388A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646178402, "uuid": "e8868e59-4169-4d0a-8087-18ff60228329", "value": "7dc28ef949f54ad98c715895ecc34cff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646178402, "uuid": "5ec045cc-9746-48ca-89f7-ef5987bcd68a", "value": "98304:k7qp0HYi6hdqgX+KiXVC0pbkKyxkJ9ScDUx:k7W0HpeNOD80JkkvScDc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646178402, "uuid": "5e8ddac3-7a37-4266-b63f-637700f928ae", "value": 4436992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646178402, "uuid": "7d60a846-f735-4c1e-a263-a410cc63c014", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646178402, "uuid": "2a118616-9197-4644-a43e-6d46958663e3", "value": "c16db5eb6fbfc65a8068f6ffa2825034.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b90f9512-9985-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646156015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646156015, "uuid": "92b7abcd-9fa0-46d2-97fd-d9ce2a87b312", "comment": "Malware payload (AgentTesla)", "value": "703df0d180c50d4417f849564520fff0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646156015, "uuid": "ff626e7a-23b7-4753-9cc9-f0ec7377253c", "comment": "Malware payload (AgentTesla)", "value": "1f5b8502acd1682caf54644dda1a4aa88e29418f863825e58e328ec533f57a1e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646156015, "uuid": "a341a6e8-c5e0-443f-8f64-f968033b5a98", "comment": "Malware payload (AgentTesla)", "value": "805a3e5a8afe3a0778413b2a9a99d56b89dc1dc5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646156015, "uuid": "25ea8c3c-a317-4907-be96-0bbe88ae3c00", "comment": "Malware payload (AgentTesla)", "value": "667173e6f15073cf59a2f99b3e3a332e625f12a3c7fa2b09f46bb8ed9ef770b8f9fac4b3b3fb91eeb082eab02a0fedf7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646156015, "uuid": "f3d1d82f-e579-43a9-8f38-40ef5482f70d", "value": "T1EB14026337A4856FDD53A9FA5763B9113528FC188C07852539833A0E88B96BEF51F2C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646156015, "uuid": "78767df4-fd9b-4a22-98b3-66d633a414d8", "value": "3072:/IcQ3Z6M1O07bA4Og9xqZbKiYnHebnnQQvezyyb8mf7bynXqvh/37Odcv:pQMMV4419xqZbhYnHerQdyyb8TGtadcv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646156015, "uuid": "e6def5ff-e6a2-4786-ab3f-a346d4000a5c", "value": 191096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646156015, "uuid": "f144b67e-291c-46f7-b9fa-9b4f598b9c62", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646156015, "uuid": "c338fc87-aac1-4edf-b41f-5d503e2fc876", "value": "ARYA SASOL ORDER.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d2215ae-995a-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1646137285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646137285, "uuid": "ffb6bcd2-986e-45f0-8b4b-7bf7e68d599a", "comment": "Malware payload (SnakeKeylogger)", "value": "9076e280d257f5c2461789cc82898a3d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646137285, "uuid": "4f4ebd7f-e7a4-4d3f-9323-48935544873a", "comment": "Malware payload (SnakeKeylogger)", "value": "2018179ddf6050a5e3eacd311f6f4ecf85543a0113529a241086246d01f6a9ba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646137285, "uuid": "6cf9dfd6-1962-4781-a1d7-d9c9815f3406", "comment": "Malware payload (SnakeKeylogger)", "value": "3a07c82480dd42e201b1bb40be02ea649686705f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646137285, "uuid": "c66f78a9-eb27-4b90-901e-2990bd93004b", "comment": "Malware payload (SnakeKeylogger)", "value": "a36d32ab55ccf5cde8d546fa86fd20caecbbab6410fd830863dc984ae01b504caa368e218dd4ff3c6190c24464de46be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646137285, "uuid": "a336eaae-ac44-4929-9f25-56a532e5164e", "value": "T187356C80B0D084BEE83B4BF1ED59EB701796BE5CD494403D555A3F1A66B337A108EE2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646137285, "uuid": "ee0e3fd2-0d4e-4beb-9b77-ed3c99b0f175", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646137285, "uuid": "b820a1a8-3afe-44fb-bba9-193a98dbf4e3", "value": "12288:Kbs6FxfstbBzTYu8mjxfsYcIZCUgY9Pn97NuKvIS5qOT9Bh7GiX4Irp5Quawn5CO:jMxstlzTYu9jpgOR97rIS79V4Irp5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646137285, "uuid": "c84ae464-3ffe-4b43-bb7f-003a8cf7902b", "value": 1144832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646137285, "uuid": "59db09bc-4718-45d8-81fc-615537229037", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646137285, "uuid": "e103a6fe-53f0-4458-bfa0-93f032524a8d", "value": "Hesap \u00d6zeti.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd00f4c0-9974-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646148747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646148747, "uuid": "4609b595-c86a-4ea1-a503-1d4754d1afca", "comment": "Malware payload", "value": "03f94cadc467d052b068046fdabe5c01", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646148747, "uuid": "a3409c80-79b2-4228-ae17-875d3359ec95", "comment": "Malware payload", "value": "20788688f2d63f1ba855dde1e928df863a8a57d9227f977cf6407df67c7033cd", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646148747, "uuid": "84789dd0-b5c9-416c-b79e-e93805345f4e", "comment": "Malware payload", "value": "f45740a0aa497ea327a884a37015867c373b47d9", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646148747, "uuid": "773f6e5a-ec2d-42b8-9e37-fb9907f8e9b6", "comment": "Malware payload", "value": "40c424aa87e68acee769e89821a85ce46e810d3710c9f317a0d377c04ee205da30a0f98237cadf5ecb5b0a9b5f399e8d", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646148747, "uuid": "39088e7d-f4b5-483a-a2b7-6a9ccb195d5d", "value": "T14422F87CD0B782E18F8A62E8BB299F0C12F87A5D93C5A15377BC63741796E39910B130", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646148747, "uuid": "bfa80f14-44c2-471d-bcb9-f845735a9bcf", "value": "192:lJQhK6F2oBVLGeyQICT+mIEV6hfG/1Bk2aWIWztoKs5y/nwcY61W:kbA6JGeyQICTpl6VGzFBrRs5y/w20", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646148747, "uuid": "0e875984-7f04-491b-b7f9-a75db5eef995", "value": 10896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646148747, "uuid": "c3a3d05c-b4be-4b10-b89f-949b8679d71c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646148747, "uuid": "f4034c62-f0f3-4752-b57f-c6f39d4bf83c", "value": "NEW ORDER.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6100bf57-993a-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646123655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646123655, "uuid": "0f0785e1-1bbc-4191-a464-d8065ba1437f", "comment": "Malware payload (Formbook)", "value": "fc84f61e4257bb5d9bb5063b3ac502da", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646123655, "uuid": "5e013428-e0cb-40a4-a622-dc92be6eb690", "comment": "Malware payload (Formbook)", "value": "208e7ad8dab4aee54a4d2a5e7be5f2c333855856fa4a433461c1ef55b101ec0a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646123655, "uuid": "701d18d0-34a0-49e4-9e3d-89a50ab748b5", "comment": "Malware payload (Formbook)", "value": "d2b4aef5d21378c3c1e91871f2aa6915427d9450", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646123655, "uuid": "1dc128a1-eef1-4f31-ba2a-c42a0b787610", "comment": "Malware payload (Formbook)", "value": "ea3742bdbde355178b6144d3c437250fb315c0c846dbb581ccbc30a465a673240e683c587c7bf95115bb809a965b66f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646123655, "uuid": "09a14f4b-e73e-44a6-9d4e-6193ebadbefa", "value": "T1B9359D543756E0CEE1639DBE5DC4ACF09BE4EC261E0EB1A620933F4A4A79C93CE51172", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646123655, "uuid": "c5f93cec-a426-48d3-b912-56fcc6819bcd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646123655, "uuid": "a7800e12-0a4e-4313-b6a6-a6e8ad9cf59c", "value": "24576:FpRnyWq22MzXntPOtbINY0NOS1PhigpjX+mljtbUPpU:9qtMebKY04SJhiIjOWtbG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646123655, "uuid": "68a23166-1562-4539-b66a-05e1f3d5d30f", "value": 1146880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646123655, "uuid": "80a23b9e-f2d2-4694-bc95-d9b5fe9baa98", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646123655, "uuid": "747c094c-baf4-4459-8592-b183d2ca14b1", "value": "Purchase Order..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d673cb29-9933-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646120846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120846, "uuid": "2c331779-f97d-484e-a3e2-569abd8f2428", "comment": "Malware payload (Formbook)", "value": "2276bc027b7d8e221ffb56c4c604726c", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120846, "uuid": "339e341f-0d97-483f-87e5-cc439f7ce0f0", "comment": "Malware payload (Formbook)", "value": "209b21ee253ee9790b2503d5231e7107775159b0bbe1eec8150f7e4f45066144", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120846, "uuid": "05a71d85-5a77-4326-b034-69528f5a20d8", "comment": "Malware payload (Formbook)", "value": "852ab39493803b77f3581735a3b00b197354adb5", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120846, "uuid": "adff5977-8b90-4bd0-bbd3-829aba3e7816", "comment": "Malware payload (Formbook)", "value": "fef6bfb6a2900f7e653a3346214033eddd3ad3d4c9700906b92a94f585e77c18d2d4e94fe7d8ed99609d197f4f6ff9cb", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120846, "uuid": "bcbe2d17-153e-4f91-a469-8e98fc9f17b2", "value": "T1D414023EB9624487E6568475C7AFF2DD0811EDE2AE98860F63F7339CEB7EE424410016", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120846, "uuid": "664f76c4-4844-4980-86c7-8ca4323438c0", "value": "3072:W2CJD6gEIOUUUbUNr0o4lGy4Xf6o5SOAX/7BRv3T82Qiz:zWWFIOUUUHo6LCf6o5Sd7rTzz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646120846, "uuid": "05936eef-a78b-4d6a-8d70-46888e72ee1a", "value": 191096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646120846, "uuid": "293b5bea-25ac-4759-9b6a-ddfc883bf211", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120846, "uuid": "e67dbe33-cbb1-49f0-bbc5-c735b41dd6ce", "value": "Quote JQ122474.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a88344d6-996e-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646146109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646146109, "uuid": "947e6e6a-8ee0-4db9-981e-85973efbd990", "comment": "Malware payload (Formbook)", "value": "95e5c69464c08745b0614e08be90a68c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646146109, "uuid": "4779c1b5-ee3a-4862-a12a-7bcecc4d8b05", "comment": "Malware payload (Formbook)", "value": "21118d784e7664abfb9b3d821f3cf76a6a0c352729695a933cad8acc40c38499", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646146109, "uuid": "60254d74-686d-4416-864e-1fa3fd985163", "comment": "Malware payload (Formbook)", "value": "01c84483ba2d19e3fafa164671a076f08c2a2b7d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646146109, "uuid": "db81f358-fd81-43f7-92ad-b9c9303d69c5", "comment": "Malware payload (Formbook)", "value": "56efec076816170a2f64d2b1111a1bc3e6936c73d9fdffba02e0e8112db9d01e3195c4e9257ec736449a67a52efdcb54", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646146109, "uuid": "3f3333b8-674a-4bd0-bb1c-58d3b48e3504", "value": "T18564228F7EC385B7D0E34131A6B6DB2FF2BBC7805253628F1B481F5A0D508D74A19AA5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646146109, "uuid": "de7db590-f8ba-47ee-8870-5224bf5eb9b6", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646146109, "uuid": "21d3a913-758a-4974-ac3f-11f0a84621a9", "value": "6144:rGi1gEW9KhbzKkRLNG8ocwx+CTcZZTovVl6:CEAORLN3W7sT+Vl6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646146109, "uuid": "a3f47ded-d967-401a-8b22-1b8dc7c207b0", "value": 315660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646146109, "uuid": "8674e621-ddf1-442e-8dce-6ae9aa7d7647", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646146109, "uuid": "9f4311fc-54a7-4549-9038-41a9461f7220", "value": "TT Copy 94596 USD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc114763-9986-11ec-9275-42010a9c0029", "comment": "Malware payload (CryptOne)", "timestamp": 1646156450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646156450, "uuid": "4e8efecf-a7a6-451a-af06-548fe4334d9e", "comment": "Malware payload (CryptOne)", "value": "01860a632ca394b9612a3de797441ec7", "object_relation": "md5", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646156450, "uuid": "5f3b9aba-aefa-4bd4-bb13-8c18b0ff286f", "comment": "Malware payload (CryptOne)", "value": "21a0f3536653eeaf96882f8b0ae61f7c203c57dc63da796dea0e8c43b47718b2", "object_relation": "sha256", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646156450, "uuid": "ee12fe54-ae2c-4e5e-991c-a183c238f631", "comment": "Malware payload (CryptOne)", "value": "5c130a57cad3926dabbef61e5a266ef71026c2cd", "object_relation": "sha1", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646156450, "uuid": "a1e38b2a-1fe9-45b2-bac3-8d6c735b4226", "comment": "Malware payload (CryptOne)", "value": "b9cd1f13c78320be04c1db469bda815f95dd6b474bdb5552f11a9734f72bbaf07c8f8c9858de955c65147ec0a2b98ff1", "object_relation": "sha3-384", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646156450, "uuid": "64ce02c4-3e46-459d-83e0-a901e2e094b4", "value": "T18355CE027395C076FFABD2739F6AF24156BD79294133892F13982D79B8711B1232E623", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646156450, "uuid": "d4a67359-43e0-477f-870c-7dd95d33a068", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646156450, "uuid": "a8acd4b7-1591-4ca6-9831-04a3036330dd", "value": "24576:fAHnh+eWsN3skA4RV1Hom2KXMmHa96HE3a4F8T0HL1VoQwUj5:Ch+ZkldoPK8Ya96HEK4FhL/otU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646156450, "uuid": "5700545d-4d8f-4f4f-b82b-e22a2e3335d2", "value": 1326592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646156450, "uuid": "ac59815e-74bf-47c5-ac75-ce49408c3881", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646156450, "uuid": "a5a22bae-e3be-4c34-a71c-fe741faf2671", "value": "01860a632ca394b9612a3de797441ec7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ce1a7d5-9961-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646140425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646140425, "uuid": "1c127f2f-b881-461e-afbd-4956b2cb031f", "comment": "Malware payload (AgentTesla)", "value": "78af045fb103afd87808f18247ddb683", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646140425, "uuid": "10310a8a-f4c3-4c25-8753-72a31e02d372", "comment": "Malware payload (AgentTesla)", "value": "21e8f320c4de087f2cf76595ea4c3b705c0d80fa537ebd8584e4d66b495181d1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646140425, "uuid": "d825b543-22e2-4f06-b017-7c8882aa1ea6", "comment": "Malware payload (AgentTesla)", "value": "4922cccaf0c19fc82520b4fc8bdd3c62a3dd4576", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646140425, "uuid": "49f03d9c-a989-494c-bb3a-86e96fd872e9", "comment": "Malware payload (AgentTesla)", "value": "9372944cf5056642045d737ce57c626863b16fa7ffb80a4330877e00b3fb27352a2cf72684633832e993227563c5e00f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646140425, "uuid": "ba8b5237-5b87-48de-ace0-90027622fb90", "value": "T14325BF4839D6207DE8368BB1CAC4EFF0DB2DF222D54960B654020E595A0DBBD8E45EFD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646140425, "uuid": "ca0f86b4-77da-40a1-9b1e-b96dd87973a3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646140425, "uuid": "9d8f73eb-2e51-4459-81ac-524e5b98d7d8", "value": "12288:8UwTx01QSmslSZ4zen195qmDfh0AyQcH99sREOS90H1JYQs/QnXhWGAwqHiFnaTD:WgSZ4yEGe7d9YqCLY10XoiA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646140425, "uuid": "2ead3ebd-5c14-4794-8af1-52a97e5dac5d", "value": 966144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646140425, "uuid": "82ac5897-56c9-46fb-b27f-4a1a7aacdbe6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646140425, "uuid": "970514aa-15aa-4ed4-b159-d6142e8b8aeb", "value": "SecuriteInfo.com.W32.MSIL_Kryptik.GSK.genEldorado.3962.10457", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0740d98b-993a-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646123505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646123505, "uuid": "9d4e772b-0cf8-44cf-a0ab-23ef07f00382", "comment": "Malware payload (Heodo)", "value": "8d5c52cf69658c3327ebd0321e4f6764", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646123505, "uuid": "a0f28b9c-058f-419c-8d8d-d6d97b6b7650", "comment": "Malware payload (Heodo)", "value": "22192eb987d0d5bc2d9148441ad300fc8fa01bf85cd30f44ce6a53a744479d74", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646123505, "uuid": "10d5e2ba-c08b-4604-85a9-877c0d2ad79c", "comment": "Malware payload (Heodo)", "value": "e7d22173b250dbba14f746af64b88a615f4c8937", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646123505, "uuid": "33e8f9de-e5f6-48d6-8da4-334d0e086b9f", "comment": "Malware payload (Heodo)", "value": "bcd677204c8dab0e32338a56e11ef91197580191b869b0bf9e534b6a58f9f4667540e53a1f9163fddf64afe7a301e899", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646123505, "uuid": "af71003f-93db-427b-89b1-d82b83dc5b7e", "value": "T15FC4AF12BFD39072CE2F293C503DA77413A95C65971A8863979C9BBE1D3F9428B3190E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646123505, "uuid": "31919890-47a1-4b52-b147-9b8574c3e176", "value": "e0b213ccd96f46d30dcd8e225f4e9fc9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646123505, "uuid": "9a0646a6-7097-4823-a961-cf7452ad71e8", "value": "12288:onEtDywy8SYlHD70WychG0QOCM8T9xvC1yDyPgyQz/VDNeg:onEtDywy8SYdnhG0QrM8hxK17a1Ne", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646123505, "uuid": "2329b690-0323-47eb-b77f-71ad83021f45", "value": 585728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646123505, "uuid": "68e0d3f9-aa81-4bf9-8177-54bead5bb84e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646123505, "uuid": "62c05287-255d-48af-8418-28442ddda72f", "value": "8d5c52cf69658c3327ebd0321e4f6764", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd02e637-9942-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646127272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646127272, "uuid": "0827fb80-7d76-4a8c-a556-bc1f0db3c7ff", "comment": "Malware payload (Heodo)", "value": "913e36e17fc164247b7cb7fd5f42fd37", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646127272, "uuid": "00855b73-0f0e-4665-b175-0e83338d222a", "comment": "Malware payload (Heodo)", "value": "227f1a41d352f28df22b26c27fc0f65ba5a7f9938dad321dffb40c22bb826dee", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646127272, "uuid": "70591e0e-8ac3-4459-97ec-b97207db42a1", "comment": "Malware payload (Heodo)", "value": "67f7e3a3058251294ced426f68a7cc01a9336798", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646127272, "uuid": "070718f3-db7f-4134-8ab8-0d38f20b388b", "comment": "Malware payload (Heodo)", "value": "9bbd91f2cdfb83fbd6d67173d2aac50d7ee83ff2a978a81abc7d546b043a8d2cb78c99147d3760e71f4a9efe465ae96e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646127272, "uuid": "2f197e4d-9f84-4bb1-b6dd-426c6b789962", "value": "T1B5C4AF12BFD39072CE2F293C503DA77413A95C65971A8863979C9BBE1D3F9428B3190E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646127272, "uuid": "6646d419-e999-40f2-9441-d86bd12ec86a", "value": "e0b213ccd96f46d30dcd8e225f4e9fc9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646127272, "uuid": "d99c3d6b-7a39-46e4-af6d-6dda649df21c", "value": "12288:onEtDywy8SYlHD70WychG0QOCM8T9xvCEyDyPgyQz/VDNeg:onEtDywy8SYdnhG0QrM8hxKE7a1Ne", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646127272, "uuid": "1d45da06-bf70-492a-a0e2-cdce74d0ccad", "value": 585728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646127272, "uuid": "fe386fa4-84c6-4cb5-acb1-2d3e6a040289", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646127272, "uuid": "0d32586f-573f-4791-93b7-5f5a064f0690", "value": "913e36e17fc164247b7cb7fd5f42fd37", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53978ef1-9936-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646121915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646121915, "uuid": "18509855-0ffc-47d3-91e6-02850e09f6aa", "comment": "Malware payload (AgentTesla)", "value": "7687db2b5f67da3bb3f577654eae3aad", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646121915, "uuid": "2e1c6648-a4af-451e-8727-6076af05edda", "comment": "Malware payload (AgentTesla)", "value": "2380754c1b393e4ad154fe9f568f940a47bae3b006784ba8ed57380989cb71b1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646121915, "uuid": "f6258df6-6aa7-4f69-9af0-f4042057c7ca", "comment": "Malware payload (AgentTesla)", "value": "407f7dd686e625db2c15a382b3c539158d9cd2bd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646121915, "uuid": "969bb1a7-d633-461b-8344-bb44487ea6c6", "comment": "Malware payload (AgentTesla)", "value": "2d1cf702aa3b27636591ba0d289cb9e99d9742546e1d1180abc0c1ac757d3c1425398ea4981b41cdc0dbcad88262e4d4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646121915, "uuid": "e6ef4413-62a5-49cb-ac81-424435a0958b", "value": "T152B1C73ADDE1FE61511F68928CC446FEBA912C61127500CA0E89EA7F5276EF50983CFC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646121915, "uuid": "24e9ffd3-1910-4a96-8df7-be44fb88293f", "value": "96:Qum4xtYqMq27VFqNQqqmPmHmkmobm3GmJmN7Vdm7t0fm8tmYsWX2I21C:nxtSVWmeMVkuX2I2A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646121915, "uuid": "840c6e96-b655-4a98-82f9-22abf3a72a01", "value": 5098, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646121915, "uuid": "c7396158-5139-400e-a3cf-53213040b4bd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646121915, "uuid": "f8dc9e0f-a43e-4908-b71c-82f48166d60f", "value": "IMG2_518876978.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e293d2f2-9933-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646120866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120866, "uuid": "d2325dd4-edcc-4278-a0cb-7208c7188006", "comment": "Malware payload", "value": "abbd57172bb228ccbdfcbc690a4a31cf", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120866, "uuid": "47d89f7f-47b4-4959-9b92-210817104235", "comment": "Malware payload", "value": "23c1c05ebbfd754612bf1b48f4010a19a9b67e4bf21cbd2f0437b8ba2e9e2f04", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120866, "uuid": "e045767a-c142-4915-a424-245dea3e6b56", "comment": "Malware payload", "value": "bb148dcebc1be54aeddffc602b1d87dc91b11354", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120866, "uuid": "c8c141f8-34bf-4a01-a7b1-2d8d1d1da3b3", "comment": "Malware payload", "value": "5bdad6db3283cf423546644a3b9063609ea81155b0782b1c032a3ee4d90147c8d04394c7977f90edb6b0f041ebe05213", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120866, "uuid": "b3ed9da5-16be-4620-8a3e-18b5a995631a", "value": "T19214020471B988F9F07136FE16DDDAB18B04EC44283FA527625C3D9CCA799D0C92A4ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120866, "uuid": "10a19ed1-8eb8-4c26-a3f7-aae875c270f4", "value": "3072:48pvWKb106jgH2/tkWqx47KDI8/JzbUTF3yRdJ0Ern3WA+CzKMwZsNogsl:/tRC6jU5z5Im9UNpELQ27w0ogA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646120866, "uuid": "ad5d0196-e8c6-4464-8424-136dc3b84c6a", "value": 191144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646120866, "uuid": "03811914-78a2-4aec-8dcb-f93d865e2d23", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120866, "uuid": "ad0ef650-b1eb-4d7a-b882-6c18e82811c0", "value": "MARCH_ORDER_01.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dc9a2a4-999f-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646166975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646166975, "uuid": "96591ac2-00db-4658-a880-4c2b3b7eb64e", "comment": "Malware payload (Heodo)", "value": "d8fab6ea073250a84c489fa444d93f35", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646166975, "uuid": "1fb61294-9f17-49ca-bd03-f21cbaf75aab", "comment": "Malware payload (Heodo)", "value": "249b0128d9d39c5302fb40c117626068ff5ecf3f936543a719d840107f1e3aec", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646166975, "uuid": "09500110-8252-4739-b15a-2dadef1c0e05", "comment": "Malware payload (Heodo)", "value": "9f2c725b89254c207a3ab62d541f21581b58f873", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646166975, "uuid": "9681e473-af71-4e9f-96f3-893fafcd817b", "comment": "Malware payload (Heodo)", "value": "38421a2914a1a9d9a9f5bf9cc9fce7981d6cf007f5ae882e6b57755b548f7398008ababeebde725ad093b5f01cbf3726", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646166975, "uuid": "05e6d2c8-736f-4672-a6ad-01d68fdc8e7e", "value": "T15C23D025C1607828C73E8C759200EAD2720A7D04D9D5EF893585BB4C3B96BEB57AF9CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646166975, "uuid": "2813b44a-2bb4-4423-ae59-8d984420847a", "value": "768:Cio9DOevZCwrvtD608zdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Uh0VPWft:Cio9D7UtT5fTR4Lh1NisFYBc3cr+UqVC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646166975, "uuid": "bdc12060-27d0-4ec9-93ab-a689b5f5deed", "value": 47699, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646166975, "uuid": "9248df84-6e0d-4a61-82e3-0e5bc67a9594", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646166975, "uuid": "ebc386c5-0ad2-4adc-a538-f9a3aa86f5cd", "value": "OPAST GROUP_1.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81423fa0-99ae-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1646173531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646173531, "uuid": "a068a5a9-19a7-4431-86a5-e014e53cf526", "comment": "Malware payload (Mirai)", "value": "10140bb4dac0a0b2b4c8676d67ad4168", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646173531, "uuid": "f9f16f32-5464-4acd-952e-18d741913acb", "comment": "Malware payload (Mirai)", "value": "25fd1de8085fbcded3f92a67271724052ba4fc7616bc0c66738fd3eddfe9759c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646173531, "uuid": "52159b15-3108-43ef-a66e-2bbdb1f71a67", "comment": "Malware payload (Mirai)", "value": "b2a8ad2fec6b604848c7e86e0c988d2c5da9c95e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646173531, "uuid": "fa4365ea-17ef-45ce-b61c-275d991571d9", "comment": "Malware payload (Mirai)", "value": "ba2acf4473b0c62b816fa534508cc1a83ddc5e2c5ad6383b2e99f21fca12024f08ba8e6ddf70f5218d1d0c81d1c2f160", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646173531, "uuid": "f0bc0dbf-5e5e-4845-9904-0153438b4983", "value": "T1BB03E128120838D8FF16C4FAD3A56FA446B10FEE7033FC8765A1FAE40E25475B19A794", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646173531, "uuid": "ae923aa2-7ad4-4699-becf-94e312769032", "value": "768:6xGZESnOzHUlF7Fz8Q7GGEjzUSJIlUicGIZJgGlzDpUYsU:FpTA8bsUSJtTGILVqY/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646173531, "uuid": "52a9c97c-590e-407a-bc20-39da5165fb82", "value": 38040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646173531, "uuid": "c0d149a0-3cf9-4802-a938-8df044912456", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646173531, "uuid": "38cbc0a3-00d3-4c95-813f-f14293b5fe5b", "value": "10140bb4dac0a0b2b4c8676d67ad4168", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "475a642b-9940-11ec-9275-42010a9c0029", "comment": "Malware payload (STRRAT)", "timestamp": 1646126189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646126189, "uuid": "08a4dce8-b2b8-4c6b-b40e-495712c78520", "comment": "Malware payload (STRRAT)", "value": "0c08cc90dfa99c3f52e79f281158883c", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646126189, "uuid": "0694e2e3-204c-4f0f-8370-aada5b1f4c3f", "comment": "Malware payload (STRRAT)", "value": "26104fcd8de196afcbaf13b7a6aa150855ee64060ec9e9444db0448b3524cf80", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646126189, "uuid": "c162df75-d7f1-4578-bfca-48f406c20b11", "comment": "Malware payload (STRRAT)", "value": "d234e46d1ce7dd25b17a981596f61b33921a55e3", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646126189, "uuid": "512b14a6-2d46-4b21-b244-f1c2361d6169", "comment": "Malware payload (STRRAT)", "value": "38aca8914cdc4684676335b5d2941bcef74b5fb33ec70f875cee3a0458454991016ad1ea31be17248acbb4b78063f830", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646126189, "uuid": "d5d4382d-9ad6-44c8-87c1-2c957d9e067e", "value": "T1BAF3F16B3D6A88D4F04B4973601182733E5D81ACD619901F36FC89561E78C9B2B2FADF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646126189, "uuid": "1fddd8f8-a237-4942-bd34-e8ca7f8ea659", "value": "3072:1/qT51UQOG5bMjsZOvln3xwpyG71D9heYmXjTUs5FKUB5lrQWDjbNRp:1/qrUQOeMjsZQ9BlIBIYSjTN6i5lBjx7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646126189, "uuid": "cd62935e-cc25-492c-beca-57f0318ba36d", "value": 164920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646126189, "uuid": "3b9f9b8f-10b4-4d71-85e2-8490b0310ee9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646126189, "uuid": "f97242d0-f9c7-4dc2-a306-2f61954b5ddf", "value": "01.03.2208.20Anruf.0613259177.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0c849d3-993c-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646124702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646124702, "uuid": "8582d884-8bf7-4b0f-80f8-160fb79293dd", "comment": "Malware payload", "value": "a61512f2aa7e3718d871a78fee069689", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646124702, "uuid": "13ac6094-4d2b-405b-94c2-920f7b8f0970", "comment": "Malware payload", "value": "2685b19cb67ca3fdc57aa106377c854082f6d476e598f60fed4ece89d7ebfbec", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646124702, "uuid": "6c7c0ecb-a917-43b1-8ad2-759562db740e", "comment": "Malware payload", "value": "6b47f327a1cc2c719c3dadd5cd7cc3b6224634af", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646124702, "uuid": "27b24dc8-a14c-4c21-b288-a3626c506866", "comment": "Malware payload", "value": "e31ae5a5d05c3f40a9b011760f3be052de72fc262b0dafdd13d7de7a8fc490562a0a0ef518c047c6ee425a229383a2fa", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646124702, "uuid": "b479ed11-92ae-4587-bc9f-87e3ae59c303", "value": "T1FE5533F64F2CA691BB14591AC18DAFAED726A388A4019D54F073013347CD1A25F6FBF2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646124702, "uuid": "bda8a2d7-91de-4332-a36e-bba22bc4cc89", "value": "24576:Ge21yATXNDZUiMA8yCSXh2xqckEaDuQO3AK1beNREarGfWzbrebCQ:yNTnsLzaiQOwK1ikoG+z8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646124702, "uuid": "d321d246-aae1-49d2-a5bd-9b3ef4ed25c7", "value": 1303316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646124702, "uuid": "d682b335-1405-453f-bf55-8a8b35ec24bf", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646124702, "uuid": "f87540c7-5564-428a-a986-1bd012f859d3", "value": "RFQ-55014CH.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97303b4f-9913-11ec-9275-42010a9c0029", "comment": "Malware payload (DCRat)", "timestamp": 1646106996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646106996, "uuid": "be8d34dd-def2-4a52-b9d2-eac5d15affe3", "comment": "Malware payload (DCRat)", "value": "a898b0df0aedfcf0b59f6ca4cab02c17", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646106996, "uuid": "1514f332-a86a-479b-8baf-15c91740af17", "comment": "Malware payload (DCRat)", "value": "2701305f449b538bba0045dad8faf41b794f5c752f450e356154060cb5e61095", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646106996, "uuid": "a99ed31a-4200-47f6-baa7-06b0fae9651f", "comment": "Malware payload (DCRat)", "value": "fa8fcdd48618f5d7494da3e150847d159bf3aefb", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646106996, "uuid": "d9d57cba-876c-48fd-99d2-dc50a2dc331c", "comment": "Malware payload (DCRat)", "value": "b67078629d5a2b095d5a40e53bae2385fd85719b4e7cb0a8cfcd6ea803ee4205c68582e5b862529d653b16fa356c84a8", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646106996, "uuid": "789d1c4f-9ce1-47d6-8471-628fae61266f", "value": "T18F557B027E65D912D0251B33D8EF981843BCAE033B26DB5B7A8A33AE25513E75D091DF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646106996, "uuid": "d9b3b3ae-94ba-4f4a-868d-b472c2ecda8d", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646106996, "uuid": "ecf60bcd-7f16-4f8c-9fc1-afe776989aa4", "value": "24576:H2G/nvxW3Wl0osy2wTueISLBHXxrGZLl0kvz8D/Bb+COTT6l:HbA3Dfy2u1XmFYF9eT2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646106996, "uuid": "b1cfcc2e-730a-4dc1-9682-5618102ee3fb", "value": 1319123, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646106996, "uuid": "0b4ac6d8-39b2-43aa-a027-909c39c8daf2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646106996, "uuid": "b008c6e5-0bf9-4b9e-951e-43429b6dcec8", "value": "a898b0df0aedfcf0b59f6ca4cab02c17.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a349aaa-999f-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646166969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646166969, "uuid": "84329b8c-3a0c-4b41-b725-a929342df4f2", "comment": "Malware payload (Heodo)", "value": "e3dc67480a920f5ccba0b26082374aa1", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646166969, "uuid": "123e9c38-c17a-48d3-9058-cffc74d497fd", "comment": "Malware payload (Heodo)", "value": "2745c898635477ad9e1b0a21be80f0f92519e17c62938254892b676199ad10b8", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646166969, "uuid": "c918c269-6f65-4a1d-8823-c6fb2e7267de", "comment": "Malware payload (Heodo)", "value": "ab35418febba671ac7f6aff56d52df87acd6ad53", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646166969, "uuid": "0e0377a2-1345-481e-9187-14507a8632db", "comment": "Malware payload (Heodo)", "value": "bb9045b2a380ff8bf6bfe5d407863926d27e44d906ffa475267c1789434b0ab65f19c5b963b20f72ab2e762f68e69527", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646166969, "uuid": "817c8533-89a9-4e7d-99bf-de66494a6d26", "value": "T16423D025C1607828C73E8C759200EAD2720A7D04D9D5EF893585BB4C3B96BEB57AF9CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646166969, "uuid": "6c38c525-eee0-4882-b924-6b1f43172691", "value": "768:Cio9DOevZCwrvtD608zdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Uh0VPWft:Cio9D7UtT5fTR4Lh1NisFYBc3cr+UqVC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646166969, "uuid": "830acdb2-537d-4ba8-932c-8fb4ec249486", "value": 47699, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646166969, "uuid": "96992062-1959-426f-a973-cf7b63dc14d9", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646166969, "uuid": "c9e9bec6-36e8-412a-95ae-e1d6e58c826b", "value": "Ommega Online Publishers_1.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4333c050-999f-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646166984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646166984, "uuid": "dc8bd361-5ec0-4928-80ff-bae08033200c", "comment": "Malware payload", "value": "740dfd3854ae8857a873b8cb4ccb63b8", "object_relation": "md5", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646166984, "uuid": "b17d4427-5dd1-4d8b-9ac4-788743c8c335", "comment": "Malware payload", "value": "282f05f5a9e353a2a7cbb4ea2d2afba64a9a1a1b1b41532a95b5cdbf97cd2c6b", "object_relation": "sha256", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646166984, "uuid": "9b2788ea-0256-47b8-85d8-b05df61b4261", "comment": "Malware payload", "value": "312b2ff517314dbc4ac5ef830b4d4415b9e1f84b", "object_relation": "sha1", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646166984, "uuid": "275877bf-5594-454d-8add-4e928390a815", "comment": "Malware payload", "value": "93a35195ab60ccc587ae545fbbb06523aacd7ce014e6505a80148ec4ac4bcfa534f6efe4c12733a1ab1eb5cd5ec77dec", "object_relation": "sha3-384", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646166984, "uuid": "d13a7406-348f-4c25-a085-e494be09ef70", "value": "T18723D025C1607828C73E8C759200EAD2720A7D04D9D5EF893585BB4C3B96BEB57AF9CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646166984, "uuid": "37e85f0e-5dbe-4ab2-b820-ded1d6ea802c", "value": "768:eio9DOevZCwrvtD608zdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Uh0VPWft:eio9D7UtT5fTR4Lh1NisFYBc3cr+UqVC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646166984, "uuid": "9f470d89-57f7-4568-8fc2-d4b469ddd6f7", "value": 47699, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646166984, "uuid": "68d4ff56-6dc1-49f9-a891-a295f647e31d", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646166984, "uuid": "cf105c27-6ee6-45fe-bcc4-9fbb4614fdb6", "value": "openaccessebooks.com.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c499f26-9933-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1646120614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120614, "uuid": "bf9786b0-e345-4aa4-b281-a520c58f8e37", "comment": "Malware payload (Loki)", "value": "501752e021ec2a2e85caa311c42e7ac4", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120614, "uuid": "f86231fa-2a96-4064-a6e1-5c7fa31c12cd", "comment": "Malware payload (Loki)", "value": "28b45151223054cce91b265d42272ad7936fe91c5910a1ac6b97519dbeec0d61", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120614, "uuid": "e0ffcb52-09ba-4ddb-89b8-8343a024f4a5", "comment": "Malware payload (Loki)", "value": "63a8ee3056cb9923da40465ea6dbecd370cb90d4", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120614, "uuid": "3ef89715-04a7-4fc2-86fe-ab0997cb2172", "comment": "Malware payload (Loki)", "value": "c498431aafb78690d94bca56e766cf46038d58714cc3517151ef8beb60088a061498eb2bbd45e5658aed1fdfc8484fd6", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120614, "uuid": "12330a27-9ef7-4f46-9df5-f6cb372fdb75", "value": "T17A04125637A499C8D507E736B44B1A10BA1A9C8C6DDA920C6FC37F6D983BC8508BC8D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120614, "uuid": "7c3334fe-f1ad-4500-8816-7c03d626d7be", "value": "3072:AI+TAsW9tzH/OtYSMpZ/U1LEmAtshAU3EkXzKiLEpWvm11bDQbShknhoW:uytzH/7614GSUBKiLOum11bsUCWW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646120614, "uuid": "61a84d25-ec71-4864-8a14-407d0a79ec97", "value": 190312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646120614, "uuid": "90002402-8f0b-495c-9f23-a9eb64f70201", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120614, "uuid": "e01c5bcd-0a8f-4afa-a68e-7de7aea94e31", "value": "REF202202028.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2807db3f-9933-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646120553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120553, "uuid": "12707456-995d-40f2-98ee-a0e5222fa255", "comment": "Malware payload (Heodo)", "value": "c7fbda5ce36820006c006840d73af76d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120553, "uuid": "74939d73-7882-4b71-b084-c287a3ce3de7", "comment": "Malware payload (Heodo)", "value": "28b4c1d96e70220c71bb27444584a7c4c6ac2c02ed41b9aa72d3af994df85755", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120553, "uuid": "b6b0e6f6-1567-494f-8e1a-e1993f9dc910", "comment": "Malware payload (Heodo)", "value": "70ec9f641cf60b2594297707bf00e6aa22ceac1d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120553, "uuid": "b8697635-8b65-457f-b7f8-3a68f75eee76", "comment": "Malware payload (Heodo)", "value": "d497c6ef34bd0e50bcd5053fcd2d93ecfabef1c839a77b391741ed7399ae6f05507db0339e46aec5733f912fafb32b7d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120553, "uuid": "96e1040d-4636-4f14-b905-736ec2e19206", "value": "T100B46B992251F077D11B503D0BCC2AAD7EEB88F09A6DF27FD2A3558D0F31190A62D993", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120553, "uuid": "15a1bb39-5675-438d-b368-ae59024172f0", "value": "42fe0d732d1bb90c6a7a1bcfb8ef88aa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120553, "uuid": "55373a7d-a992-408b-b09f-68431fccf17c", "value": "6144:cH4C1DzgG1GCQw2HOOnPE10JQNqNtvrC4cHV9jp6YagzSAIVCL4Ry:cYC14G1GUgOOs14QkNtm1xpdIVCLqy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646120553, "uuid": "e2bd1db5-0c42-4674-9f55-fca7f4c82097", "value": 528384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646120553, "uuid": "2cd9793c-2e82-4cb9-b6ce-eab652054602", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120553, "uuid": "0828b1a4-9593-444c-b368-1eb69f99a1d1", "value": "c7fbda5ce36820006c006840d73af76d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "754fe90c-9945-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646128414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646128414, "uuid": "fc308f87-e22b-49b4-b200-5ad7c4861f35", "comment": "Malware payload (Formbook)", "value": "f63402c23009b6157d0177fad81eb47b", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646128414, "uuid": "cc627077-9385-4169-b66b-715498f36ff6", "comment": "Malware payload (Formbook)", "value": "28e74906a6a882a1bd1a8c978bdfcf88461ccc1b1a2ba2d0ae5e3ec058b58b62", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646128414, "uuid": "ff07afa2-e7aa-4170-adbb-07560ad2678b", "comment": "Malware payload (Formbook)", "value": "088f6d8333e8d1e8dc15b304edfb4f2dc787e274", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646128414, "uuid": "71c705d3-646b-4421-82d0-9138f4452059", "comment": "Malware payload (Formbook)", "value": "81b213378e2156d4eebebe468d0ba6651691ab2623d638cac7e8cb7b1cf231189cdeaec47139c529bb0da3df3defc4f7", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646128414, "uuid": "2c702709-4923-455d-a19c-4004f7eaa87c", "value": "T1749423F34936F24EE76B5F6034DC661ADE927113A3F4D2C750AAF0E0AC606E76842949", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646128414, "uuid": "e7c04b20-b7af-4952-b9dc-09cf7e8fb187", "value": "6144:CRD/8SJb59fmtkIyN5k0HzmwAu6Moe/K9qnM7RpAz+1MMOaqi8zZCs1Af11AKxQ:CRb8UnMeNC0qwuMS9RQgnOaqiAGf33G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646128414, "uuid": "ec9156b5-e6c5-47c7-88e9-9f0fb4868a5e", "value": 444986, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646128414, "uuid": "14ae2486-3e0e-4ef0-b09b-820c1c4e03a6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646128414, "uuid": "90e274af-c2a2-4e1f-a98a-70339ce71bdf", "value": "TELEX.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1705e5bb-9938-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646122672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646122672, "uuid": "83161d60-bab3-4daf-82a5-611bab04954f", "comment": "Malware payload (Formbook)", "value": "939beaaf41452bc48bdc4737a90db225", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646122672, "uuid": "bcff04d9-fb30-4983-83f9-9707f605b006", "comment": "Malware payload (Formbook)", "value": "299bd5c5737f88aa34da96ad50ae5323e3b94a1f6de8e539502ef8427812c734", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646122672, "uuid": "3a56f235-6c4d-4b5e-a4cc-bda6cd264eb2", "comment": "Malware payload (Formbook)", "value": "463f5c3ddf67d989b41aaa0d0ba552ad92f4058e", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646122672, "uuid": "45ea48c3-85a3-4d44-9387-023e3d275730", "comment": "Malware payload (Formbook)", "value": "c545a8ce32b70d7e762284763fbe1b04404c32ab15cb5d5f299b35eed4451f6ac0f97dbe9a9d6105f1712a16d54e1d3b", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646122672, "uuid": "32990bfa-ff9b-4b77-b2d5-855a918004d7", "value": "T144C2C0EA5F131A64C346083B1925CC026B203057DB82B9479F2C2F7C95C1ED42BAFE8E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646122672, "uuid": "41335e79-0dee-48fc-9c22-6203a7476bdc", "value": "768:G2si4p7RHizQYeHeCBcaC34jImh7LKMi2zW:DIeHezsKti2zW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646122672, "uuid": "f7fdc423-7e28-411f-8a32-87a23eda484a", "value": 27917, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646122672, "uuid": "24b1272c-8cee-4fc4-a86b-db1968a977e0", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646122672, "uuid": "68bacfc7-49df-4a27-95fc-ca8b6a0a3e54", "value": "MV HAI PHUONG 87.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2f04b8c-9942-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646127255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646127255, "uuid": "5aa9cf93-3886-4266-b915-47b20c67d62e", "comment": "Malware payload (Heodo)", "value": "4a427685812f82144ccc253e6bb09f96", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646127255, "uuid": "7e0ae5b0-ed77-468c-a863-544e26409add", "comment": "Malware payload (Heodo)", "value": "29ce9a0cc106cb2069ddcf16efc9a1a013efa0a8d54b51c8b2bfc49e40af545f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646127255, "uuid": "0343ee94-3ec6-4aea-b4a5-e94d4f3509b1", "comment": "Malware payload (Heodo)", "value": "a7735c6711b08b8b857d32e02ae352a7f3ec334d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646127255, "uuid": "aa7e47cd-b50f-4f69-b3be-b24864c18c5f", "comment": "Malware payload (Heodo)", "value": "bc334763dca44e43f24182197352b9b2557066304d4e6ac27bf25b33a77cbd3f1334b636dc776b0db9cd47a70b720e05", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646127255, "uuid": "536d85c1-9830-422e-9d52-9da87de7a32e", "value": "T132C4AF12BFD39072CE2F293C503DA77413A95C65971A8863979C9BBE1D3F9428B3190E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646127255, "uuid": "06df0964-7882-4227-96e3-2632940c0ab8", "value": "e0b213ccd96f46d30dcd8e225f4e9fc9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646127255, "uuid": "28661429-574c-477c-a096-ac7c39710f85", "value": "12288:onEtDywy8SYlHD70WychG0QOCM8T9xvCayDyPgyQz/VDNeg:onEtDywy8SYdnhG0QrM8hxKa7a1Ne", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646127255, "uuid": "3df759b4-0881-4027-8f47-9d94e8c8c743", "value": 585728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646127255, "uuid": "ef7e5c69-6ac4-44a6-84e0-0b9adad1b3d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646127255, "uuid": "005a1425-a842-48bf-bb1c-9d48a063bfba", "value": "4a427685812f82144ccc253e6bb09f96", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a543dfc9-9933-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646120763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120763, "uuid": "e6682975-8880-4982-b2fa-6369aa23de6f", "comment": "Malware payload (AgentTesla)", "value": "3e740b9359b8a1c9553c064d204f86d0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120763, "uuid": "93251006-0310-42db-aadb-e435adb11de5", "comment": "Malware payload (AgentTesla)", "value": "2a5027d7c3bb309150598f506bbffcc1b0a7d94a90056d865b3c715d0932f852", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120763, "uuid": "54f33079-8a3f-409b-9d99-9a95aaaa9490", "comment": "Malware payload (AgentTesla)", "value": "c1709cf8c16d87f7bd037edcdb1722b63777f04c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120763, "uuid": "da8b61f0-1824-4048-83e4-3fb16cbf25f6", "comment": "Malware payload (AgentTesla)", "value": "dc536b4f6ef09821617bf9a1c3d16e78b5761ca0b0dc519dc22dea5e6b1e6436c6846b6fba2dcc401724cd0773152a76", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120763, "uuid": "72c41f28-0507-4f33-9e79-f8bf92409b7e", "value": "T1371412ED72C63BA8ED5CD5F19A128FB45047DE30E9C6DC0EE19FBE2AD4334825212568", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120763, "uuid": "b3ea0f43-8de5-4d0f-af9f-52d07b9c7e11", "value": "3072:hpogfjIvGKzh6LQvyODC3n53N/aWSLjHDg0IlLSyL1r+5aT24LXaUYRzsV57pVMy:vogfGGKeojDC3B1aWSLjjg0U9I5a6BUl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646120763, "uuid": "85646d7d-3621-4278-9ec1-95b105d30792", "value": 191096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646120763, "uuid": "1ee210a1-0dff-415a-b2c4-7f3af62b27b6", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120763, "uuid": "c57cd5f5-ab3a-4844-8afe-6dcacaa7bab6", "value": "quotation G009RE00018.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b6dbc6c-992c-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646117499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646117499, "uuid": "974f7c90-437f-442d-8aa3-f351ccc183e8", "comment": "Malware payload (Formbook)", "value": "5fd75c7c969b7fafda67d1b9041a048e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646117499, "uuid": "6e52a706-3a41-4fa9-a4d4-0271d059bb0b", "comment": "Malware payload (Formbook)", "value": "2a5fecaa7aa29ffedca8d999e1868afef3a14ca955248b617d3445ea239186e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646117499, "uuid": "575680a2-c0c0-42f6-ae64-05d57db8954e", "comment": "Malware payload (Formbook)", "value": "50218d269c41104b344af5ba268bb21ed2918832", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646117499, "uuid": "b0edcfbf-5ae2-4df8-9012-8f6c079b1127", "comment": "Malware payload (Formbook)", "value": "46c4ebf693a8bc3f3906070f0383dd44f64cb98fde0e5103791ce9e5362023620d851d0d391b3fc84c83b0bd0480f63d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646117499, "uuid": "236821bc-1194-4dab-b3dd-590991d88641", "value": "T1A7C4D08B3A355796CA3D9B346425120CCFF6E972C35EE2A97CC6B1CD0072F474A2691B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646117499, "uuid": "f3040e3e-aab3-4a44-8daa-a639270dfb2d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646117499, "uuid": "a96849ac-78cf-4a8c-81ff-b2eb347814ca", "value": "12288:MVvy6zEGRUcZ64HcRm00dTcM+NC2qMusM9BagnOEqiQG17:MucUNRmZdTL+NCzM8JncM1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646117499, "uuid": "a92e14b1-d100-49b0-97e3-87d962d46492", "value": 544256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646117499, "uuid": "bdb151ea-a75e-4ccd-b835-e6e373affea8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646117499, "uuid": "7f3289b8-78f9-4cb0-b450-eeb98a6ef219", "value": "TELEX.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a924d9b9-9932-11ec-9275-42010a9c0029", "comment": "Malware payload (RemcosRAT)", "timestamp": 1646120340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120340, "uuid": "ad96c02d-4b5a-456e-a777-aa8f6dbf180b", "comment": "Malware payload (RemcosRAT)", "value": "e402d325370fb69d5163909b64c70bca", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120340, "uuid": "2b344aae-544e-4d71-9b4f-e01be1468a6b", "comment": "Malware payload (RemcosRAT)", "value": "2a69de4e898f9ed85e6e6375da8605830b6cf0a7c8cde4288a4d58b5c6fcf385", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120340, "uuid": "6e92a8fe-cb54-4492-996d-9209274c44d7", "comment": "Malware payload (RemcosRAT)", "value": "91d37535ca57ccf5815e4420863770e10d7d79e1", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120340, "uuid": "a74b82d5-59fc-4a7e-b2d5-d70d37078936", "comment": "Malware payload (RemcosRAT)", "value": "022f8d196de9556fa7c61ed19ccb7fecf246f4ac6435b30db2d0c79f290f773200e48c8056334bcf80e259342c24502d", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120340, "uuid": "18690114-1595-4901-a63c-8f4e74f4530a", "value": "T123F273A2B3D5E80AD99A077A4CE7C7E66627FC615F53834B3285F70E1F71A808903617", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120340, "uuid": "1df7eb48-900e-4b19-8f37-9137455459c1", "value": "768:FjYmk3hOdsylKlgxopeiBNhZFGzE+cL2kdAJUWgLQNs+Ze23D+YKx:Xk3hOdsylKlgxopeiBNhZFGzE+cL2kdm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646120340, "uuid": "95107689-64a8-424d-99bf-b29c69a96e47", "value": 35328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646120340, "uuid": "df68a016-baf3-453b-85cd-513642fe1b0b", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120340, "uuid": "733cd16d-4654-4204-b374-f6cea4697ecf", "value": "ACH Remittance.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa7f77a1-9986-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646156554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646156554, "uuid": "98111d0d-7d1c-4f48-8a33-96a0a0c13338", "comment": "Malware payload (Formbook)", "value": "1ffd86f16e4530213e2e95c65763acdc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646156554, "uuid": "8efd6eba-8cd4-44f6-8ec1-694952423306", "comment": "Malware payload (Formbook)", "value": "2af6b1cfe8812e9e1679f3a6a58a158420e771341dbea64f4853d6966bb589b2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646156554, "uuid": "8c2eff4f-7230-41be-9763-39f8315129e3", "comment": "Malware payload (Formbook)", "value": "5aa30911a8e7a2f3791061c866da3303464e3d86", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646156554, "uuid": "2807f54b-b3a9-4c8a-94ad-32ff66709424", "comment": "Malware payload (Formbook)", "value": "ed4558d9548d0d6618e30dc562f771003014305a65426aadb1f5205a0a7cb06a54d53bfceb1f611977cfd9de406b85f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646156554, "uuid": "070b0b0d-6bc1-47b7-a2ba-ee4c89ddee35", "value": "T15EF4BF0838E65039F83A8BF1DBD0E7F19B6EF221E54870F558000E559A15BBC895AEFD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646156554, "uuid": "324ddb4d-64ca-4718-a7aa-2b56d93d5e4f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646156554, "uuid": "5d9ba4d8-4002-4d5e-a771-e4dcbc4d83f6", "value": "12288:6EyDR/IDCb3C0XwjAQQSsiHKw02YqxdIpcRjmffehom1LUbad2Ppm7uyptK:tCb3C06UiHKH2YadIpcRjmf5gLIad2xR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646156554, "uuid": "27c69934-8d1f-4f7e-b232-921c007918ea", "value": 774144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646156554, "uuid": "8fafee8f-5a8b-40c3-a345-cc285caea94b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646156554, "uuid": "07e9302f-2af0-4c10-93cf-8e5aed1f472f", "value": "1ffd86f16e4530213e2e95c65763acdc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8b10a0e-9975-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646149143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646149143, "uuid": "71e58364-9375-4004-9280-c3e00f9ce14d", "comment": "Malware payload (Heodo)", "value": "e11f34e039ce54ab08f21fced52e2871", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646149143, "uuid": "8b3dc3f6-e419-40bc-b58d-8932877ba318", "comment": "Malware payload (Heodo)", "value": "2b986dd02cc452d60e34f86bd16d14aeae11f3fd7e7c12230cb151dd88acc66c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646149143, "uuid": "be5f6f00-aee8-4bd1-aa0e-f32df6cefee9", "comment": "Malware payload (Heodo)", "value": "b5915081886729485ce35804ae4c616e8c8f56bb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646149143, "uuid": "3ece04be-55c2-4430-bee5-0c859db14ab3", "comment": "Malware payload (Heodo)", "value": "e52793f9518199a9f4b73eb07574da513a71880ab21d57f9553bfbef765804bfa85867d7ffbd89fb07635444f251d1bf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646149143, "uuid": "f1db6cd0-7d9b-4224-a54a-bf3d2afc4bc6", "value": "T1B8B4AE11B790C076D2AA36342512E3B51AEDBC709AF5838B7FC07B7E5E315918A3835B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646149143, "uuid": "d5fb1e8c-706c-403c-9dfb-afd73d1648e1", "value": "f08242131de62ca6d7c4b2727b491b3d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646149143, "uuid": "d9253786-f872-4732-b408-6c44d200473a", "value": "12288:dbFLiEzuSo9guqHuWjr2pyP4W6SpktSuHE:5VWSo9guWH6ZE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646149143, "uuid": "40fca8cd-a87c-4e31-b04d-c97f716e994e", "value": 500224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646149143, "uuid": "d69a7154-21de-4f21-b63d-36210a0edca2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646149143, "uuid": "a2b669c2-5a7f-42c8-993c-1f19620caf65", "value": "e11f34e039ce54ab08f21fced52e2871", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8a0dd23-99a7-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646170644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646170644, "uuid": "029b3460-2514-4ed2-8ae7-2dea6326a2e4", "comment": "Malware payload", "value": "de2d2274807487326d77166c12958686", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646170644, "uuid": "b2f5cbe0-cd82-4ce6-8d02-01d89847131a", "comment": "Malware payload", "value": "2c05749165d621d101d78166e7291aaa35c03385481b44d4a198778cfb7129d7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646170644, "uuid": "838d3bcc-7763-4f03-8dd0-c245c89c1d9c", "comment": "Malware payload", "value": "b6ba35dc0fc2df0b40915a3ba2825cce510ff9da", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646170644, "uuid": "d5d9206a-adb0-4e00-b204-4dd36e47364f", "comment": "Malware payload", "value": "461fa4f9521f4c75988ba2dfd9edbec01d946cb8e4625d1f80948852ba9502087ac91d5dd6a55f624dd1f4e6b792adbd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646170644, "uuid": "576c4b3e-0f92-4ad8-8834-acfdaec7d5ad", "value": "T1A7B4AE11B790C076D2AA36342512E3B51AEDBC709AF5838B7FC07B7E5E315918A3835B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646170644, "uuid": "30ab91fb-cef3-47ed-a740-d00c618c6790", "value": "f08242131de62ca6d7c4b2727b491b3d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646170644, "uuid": "50e01315-0dca-45d0-bc12-be387ae21cd1", "value": "12288:dbFLiEzuSo9guqHuWjr2pyf4W6SpktSuHE:5VWSo9guWT6ZE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646170644, "uuid": "040b2a7d-becd-45e9-98cc-b566e07363ba", "value": 500224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646170644, "uuid": "b2342292-b9bc-43d3-acc6-1e90e6b89735", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646170644, "uuid": "7f798996-2112-497d-bc14-5d9024839cbc", "value": "de2d2274807487326d77166c12958686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfec0046-998b-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1646158604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646158604, "uuid": "b33aefcb-5516-47f2-833e-043b69bc4673", "comment": "Malware payload (Loki)", "value": "41abe0b38d0cf717f7e3e43b144932d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646158604, "uuid": "6f44a429-e87c-41d0-b68a-924a94e903ac", "comment": "Malware payload (Loki)", "value": "2c1063160dadb13dc41ecae40fb716705cc76cf8d557633a97540897ccdf07a3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646158604, "uuid": "a1b6b9ef-1664-4a66-b1c3-c76525473038", "comment": "Malware payload (Loki)", "value": "2ac3fdda2681000e38923a2a46f60629bebdf949", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646158604, "uuid": "990b3220-6323-48b0-8bcb-eec2bac81760", "comment": "Malware payload (Loki)", "value": "653aac7edcd0404fe5e65cc4d3425d2f09fa067dc454483c2947b44e2bdbe33b5e1ecbd2310b1ebbf61fe6947ad91711", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646158604, "uuid": "bd5e86ac-38d6-41a6-9f52-23e10feabd46", "value": "T1BC258D9435AA74DEE423CEBECDD8AC70D925F53B630BE26B20031F598A4DA42DE11573", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646158604, "uuid": "2f360d00-fad2-47d3-9665-8cf53bdba2cb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646158604, "uuid": "f30abf44-f704-42a2-9f4b-8b17142ac3d5", "value": "12288:/oka1BXhFkKLK1PIhzcGRPK0px7GtEQvIdFtbYYrwHI4H1nN967SaFzRyGNvUnVs:Kb3PK1wC0K0fRQvI90HD4fp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646158604, "uuid": "5476133a-a824-4ff4-ad46-3c62d225f0f1", "value": 966656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646158604, "uuid": "a5b7cf36-be03-41c4-930a-658cc873b67a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646158604, "uuid": "c4293977-392c-432e-8473-cb150d839dc8", "value": "41abe0b38d0cf717f7e3e43b144932d9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21a502c2-9939-11ec-9275-42010a9c0029", "comment": "Malware payload (Smoke Loader)", "timestamp": 1646123119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646123119, "uuid": "5fa69ec9-27a9-4b48-ad6e-c4fbdf8297f7", "comment": "Malware payload (Smoke Loader)", "value": "5797927d3ea2d6ebaf117313c3101ead", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646123119, "uuid": "f921856e-b093-4106-b33a-5540d9dcbde0", "comment": "Malware payload (Smoke Loader)", "value": "2c52014ce36c8ec851ec96f8a4aaf656c80b250c1f66aca1e685ca7b1be0c4bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646123119, "uuid": "aad024b3-4489-46f3-969a-a4efd27353c4", "comment": "Malware payload (Smoke Loader)", "value": "16613db865d587aa73d25d6fc8b8ffbc434acaff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646123119, "uuid": "43b01079-0a27-41e0-ab22-5dc808ab5601", "comment": "Malware payload (Smoke Loader)", "value": "75b755166fbd9750435ef753597e02980dc806a4803e3847ab791d8aaf8a8b0eab132483ae0401a0e1393fb7ad8854c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646123119, "uuid": "1f1a6b1d-cc81-40c2-b552-eec545558a15", "value": "T10664AE10BB90C035F1B712F8497A93ACB63E7EA15B2460CB62E55BEE16356E0EC31357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646123119, "uuid": "2a9c0d8c-2d3e-48c3-a172-2c0bea51f1df", "value": "571651a80e4ab2d7da8009fcddc6a93c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646123119, "uuid": "0315a18f-8c4d-4f2e-a694-5af9efbfa69b", "value": "6144:NX1CXg15hfh8KmMNA9Ep7KknofoAOXUk3EfXh:p315hfh82y9Ep7KknMoHch", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646123119, "uuid": "fa38744b-84d6-4ed2-81f1-205974ea5824", "value": 333824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646123119, "uuid": "ad0be86e-fe4b-4561-8b63-58d2b14a1869", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646123119, "uuid": "70a44a06-388f-4b84-97b6-cb27578740eb", "value": "5797927d3ea2d6ebaf117313c3101ead.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe0720b1-999d-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646166439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646166439, "uuid": "afb69c3f-193d-434f-9e01-92df25ad9ec7", "comment": "Malware payload (AgentTesla)", "value": "79942a0285232633c42e484862f87632", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646166439, "uuid": "3d3f3cc8-fe44-4622-b24c-d8cbec2f8c97", "comment": "Malware payload (AgentTesla)", "value": "2ca70c02e662335ebc8f1a81d6de1f6dad3e0ca57bff4c9dffff8cea856cde56", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646166439, "uuid": "3c0403cd-e157-43e5-818c-c5682ff05aa7", "comment": "Malware payload (AgentTesla)", "value": "79050a88119aceca5ffd96460f18266bdd5f2888", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646166439, "uuid": "77f3c567-75c0-4624-a38d-e3b15b9e06c9", "comment": "Malware payload (AgentTesla)", "value": "2177da094f0b1a5aee7aedb6f39f79f0bf8358d34813c126a1884b7147a507a81e60f35eee97001930fec6ff14d2d0f5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646166439, "uuid": "c516b802-1538-43a9-8a00-7ac0463fa6a4", "value": "T11A741209B1C4258BCBB7013205BDA2B5477FDBD609A4D2072BB62FBB4D895C37742E92", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646166439, "uuid": "795527ca-fc90-4168-a184-6d47c24e3020", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646166439, "uuid": "ab40a1b6-61e7-49d7-89d8-aa080ff0185a", "value": "6144:rGiTrGiQGFW+EKv24LcB75O/8kKJ4ep7fYE3SjdPAXo:/rG7IEcABwIVNiR8o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646166439, "uuid": "46b58fcf-e9ee-4e3e-8eea-e17747853549", "value": 368660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646166439, "uuid": "381746b4-80f3-4777-b09a-25082be431fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646166439, "uuid": "8fa1af7b-1ad4-4514-b3f0-4d0efef65f77", "value": "SOLTEX ENQUIRY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3b34d08-9985-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1646156006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646156006, "uuid": "37d61573-501f-4b00-aa9c-fe2b7c53ff22", "comment": "Malware payload (Loki)", "value": "7d0a1e63f2e48792fc2a69f9799a8624", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646156006, "uuid": "f1500b02-0f1f-43ef-8cf3-63d06d61128b", "comment": "Malware payload (Loki)", "value": "2d07fc700c12199bf702a2d9a4e0b8542122a4201aa4b76eea922e5b7c286c07", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646156006, "uuid": "bb794b1f-e1a0-479d-b822-8d89fdf5eaeb", "comment": "Malware payload (Loki)", "value": "14d0b11c8497951e2fe805c5e4cb9dc2711fe904", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646156006, "uuid": "3b4dea2d-14e8-4e01-8ba8-b78b08e0e6c8", "comment": "Malware payload (Loki)", "value": "5098dccc8c12c584f60de90832321eb2fe26dc59a3496221074262b0c709a05da42ee22e1162d6ba697efaa88c6288d1", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646156006, "uuid": "42648cb9-6253-4578-b0b9-5e4e879eb752", "value": "T18F141204F6805BA3E66AF1B4DFE04CE5286DFD541CEE5B16924134A83DF48368EB9723", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646156006, "uuid": "0ff3a793-6030-4ce1-b198-aef123905d8a", "value": "3072:txorlYTwOKczND2V8YBxmaSQsYmTO/M72uyRYLm+555nnZZjpF6KmNOZcEbQ78xC:8aTwV8nQYL72uyUm+5dZVFFccNk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646156006, "uuid": "12b4788e-f329-483d-965d-6dba0e31897d", "value": 191304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646156006, "uuid": "8d7c7e78-c8db-4f46-967b-fa0dce671e22", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646156006, "uuid": "b8f0059e-642c-4447-9951-7b38c04c305f", "value": "ZAHTJEV ZA PONUDU 01-03-2022.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3859b70-998c-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646159012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646159012, "uuid": "711d3383-5de6-4875-b33a-0dc0ffb5825b", "comment": "Malware payload (Heodo)", "value": "82bd202a46c35ddbd82179c6d1d877a5", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646159012, "uuid": "32302c4d-5810-43cf-83ab-bd99d4be8569", "comment": "Malware payload (Heodo)", "value": "2db07e768cf8e3e81ad1d27432777c58df33984426aa16dcb25a6b37c1291f2f", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646159012, "uuid": "14b219d8-b3ab-4bec-be22-f1ca6f74ad05", "comment": "Malware payload (Heodo)", "value": "767f9ed4dd9f1c301f638ec09315d8b29ec6d894", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646159012, "uuid": "7e396192-5702-492c-82ce-a20f9381a6ec", "comment": "Malware payload (Heodo)", "value": "267c355110a54f9ff35be17374445670ebd4fbe6f817007a782758b8c2df5d7d63aabc190d453a52064f6e40d52aff37", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646159012, "uuid": "03ec91f0-5f19-404d-ac95-be5c62ed1c70", "value": "T1F623D025C1607828C73E8C759200EAD2720A7D04D9D5EF893585BB4C3B96BEB57AF9CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646159012, "uuid": "055aa24e-bef0-4446-a398-1b1282a93aa3", "value": "768:eio9DOevZCwrvtD608zdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Uh0VPWft:eio9D7UtT5fTR4Lh1NisFYBc3cr+UqVC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646159012, "uuid": "adfcbcf6-6ede-4261-a225-87e8919e1ef5", "value": 47699, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646159012, "uuid": "2a96890e-06ae-4046-a958-d322f64377a1", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646159012, "uuid": "68d2ddfc-3527-4ac8-8599-5a32913c96f6", "value": "2022-03-01_1111-Statement.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "504d6abe-9985-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646155839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646155839, "uuid": "ff0df40e-02f7-4eb7-b847-84c4651142a2", "comment": "Malware payload (Formbook)", "value": "df240f089172bbf7c714d306e6462029", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646155839, "uuid": "62ccb748-6332-4a50-8170-d3dfa6d66100", "comment": "Malware payload (Formbook)", "value": "2e001012ab1536c57accf0ab426e7d162217c603ef8b1c274a079a387c2d8302", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646155839, "uuid": "27392426-e2f6-4f6b-bb9a-123756738578", "comment": "Malware payload (Formbook)", "value": "f226c3f48c0841fa6a6b3bec06b0f9d440983f24", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646155839, "uuid": "103cef2a-dfde-40c0-8678-1fe0d3fcd6f4", "comment": "Malware payload (Formbook)", "value": "b3a6aec2e109f4ab8b2a16aac4cd4a18b1ad6b51d9761207ee4e8e67988e103e0ef827b4bbd97e9741162e31496ac5e2", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646155839, "uuid": "30265987-a02d-40fd-a92b-2fa8c418fb60", "value": "T13A1209EC925C4FA8CFCDA3B8B72B7E58109EBC5923D2E0A33ABC3391135217D590A550", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646155839, "uuid": "326068a7-0bf2-4222-a2b7-215fc2bd3083", "value": "192:IGa9Ywfd+BoJjjaujZy6BRunEqhrLwXzJL0LFyEUhqgGF/t1uh1j23j2Dhn:J4Td+BoJjjaOxOEWrLQzO5yEAzqy3jQy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646155839, "uuid": "ee4d2093-d5f4-4f6e-8f9e-f42f8f9a0582", "value": 9786, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646155839, "uuid": "f345d48f-8374-495e-b7ad-0b39b1de2b8c", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646155839, "uuid": "538efa59-a4a2-460a-91cd-e6438da2bc0a", "value": "206983475.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "292345c8-996f-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646146325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646146325, "uuid": "f88bbe7c-5002-4ba7-bb93-6ca50cd2fd4a", "comment": "Malware payload (Heodo)", "value": "551016385e478c611a09f33a64bb5a88", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646146325, "uuid": "c20e33cc-21c7-4504-9b3f-b4a951e87d38", "comment": "Malware payload (Heodo)", "value": "2e3390d884f9a79b27be7d617805dc348c2c0e0270d42578390b7613335fa7f9", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646146325, "uuid": "aff70dcc-cbf2-48ad-b909-1e46ebeaabd9", "comment": "Malware payload (Heodo)", "value": "496aacfdb47d2456a518961bbd17fe2c7c8e82f7", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646146325, "uuid": "ec7fe5b9-023f-48fc-b298-0d1dc0de7844", "comment": "Malware payload (Heodo)", "value": "ead94b764363d0c031960672d98db16594765a04f206aee28906ec17b880c0885675aee8d032ec320c3a853dc513d104", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646146325, "uuid": "654f138a-d9b8-4200-8310-077774dae4fc", "value": "T1B713E029C4961A9DD737293DD6148EF4124C0E4A96A0FD8F1D44A3AC276A1FB0B4FCB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646146325, "uuid": "9856e032-6d09-4811-95db-3caf92d9e8c6", "value": "768:zomihd8DOevZCwt79yKfcrND59V+L9Rw4eWrXcTqZ0VfEw/5:zom8eDNylND59V4jwmXc2CVfEA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646146325, "uuid": "4e96a3b0-1156-4457-b666-e33ea54b6485", "value": 41813, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646146325, "uuid": "d55c7bc5-f042-48bd-806f-99d58a3cb148", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646146325, "uuid": "53f2965b-4b32-4813-9a85-a7f543457c99", "value": "Dettagli 01032022.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf5b48bc-9975-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646149154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646149154, "uuid": "d943ade1-c2b2-40a4-af0d-94bcc10678a4", "comment": "Malware payload (Heodo)", "value": "e94a55862b7d0432b8daa73c89d90d28", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646149154, "uuid": "fd6ee9fc-cd4a-4b5d-9f28-afbcf0a7f1ce", "comment": "Malware payload (Heodo)", "value": "2f085a844cde912ab736cec044e119a6f0f2e6dab1b3f84e1fbbdc758a33ae8d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646149154, "uuid": "a06f5e27-71b2-41d1-8303-666ed264f64c", "comment": "Malware payload (Heodo)", "value": "4bea9cb7905e4d483fb9c397d9099364000f74f6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646149154, "uuid": "ab6a6552-c13a-4bb1-8e93-8e333487af2a", "comment": "Malware payload (Heodo)", "value": "1655fce6eebb58efa62d9df749d60f2424de8ad3047d6aa4c0f217c7b959db6c9946807e8bd87f9d75830b6bfad37e90", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646149154, "uuid": "99ca4829-231d-481b-8d9a-b48a787a5c05", "value": "T1E3B4AE11B790C076D2AA36342512E3B51AEDBC709AF5838B7FC07B7E5E315918A3835B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646149154, "uuid": "341c234b-ab02-4bd3-9629-c3b5f6d4da02", "value": "f08242131de62ca6d7c4b2727b491b3d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646149154, "uuid": "875a72c6-b731-46db-b02c-b8e30b5b969a", "value": "12288:dbFLiEzuSo9guqHuWjr2pyc4W6SpktSuHE:5VWSo9guWw6ZE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646149154, "uuid": "fe5eb282-e006-4b53-8a71-b9d3225f361f", "value": 500224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646149154, "uuid": "1a0026a4-82ea-402a-aeae-119697a43a66", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646149154, "uuid": "417c04df-94d6-4282-b70b-83a9ef4f4cc2", "value": "e94a55862b7d0432b8daa73c89d90d28", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64ecc25d-9984-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1646155444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646155444, "uuid": "e6b3e43d-3a9d-4437-8cf2-52ae884d52cf", "comment": "Malware payload (SnakeKeylogger)", "value": "e3316d5b978192795cba4257c53fbf18", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646155444, "uuid": "e6f757a3-c74b-4147-a622-e754d9fc74d2", "comment": "Malware payload (SnakeKeylogger)", "value": "30c81f7a6cc4b095285e4329219ffea1ffa10f8e5cdb4d00c702e16173b2d93a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646155444, "uuid": "c63cb9d6-157d-48bd-a7e5-17f8b2e70725", "comment": "Malware payload (SnakeKeylogger)", "value": "7f55289f7a5e0af1ede0cc12fa7401575caa513f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646155444, "uuid": "6c19e778-5b73-44c5-97f2-6e2f0c4260e7", "comment": "Malware payload (SnakeKeylogger)", "value": "c957157cd735a9ed2dc9b5b21da7c52e1c704f76fbf4a6b65b50c347494a1845f4bc425e66dc362b6d28e53af8452a42", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646155444, "uuid": "8d2f333c-3fb2-4982-a390-9ede559fbc7e", "value": "T1FC820792E3E57A22EDFD06368772D9304BA8FE07C86793592DC8354A3C7321189A1667", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646155444, "uuid": "e90837eb-af83-451a-a8d9-a18b654ce318", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646155444, "uuid": "04a15d51-218b-48a4-a573-1422c07b6074", "value": "192:20kasvERRpvAbN9ZSesTWXUu8QqvFUg1R8kEdcEWtuLqo/bv6eY4iAbbVJss:DkasupvAb7ZSesSUxd187Z/bvy4HXns", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646155444, "uuid": "2b764bbf-f343-4925-bc6e-0270d5378d5d", "value": 18432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646155444, "uuid": "ae10effb-577c-4163-89e1-d8774bff6205", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646155444, "uuid": "0d433f02-6838-4c2f-80fb-fc8f8820a7a2", "value": "POR015409.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "184c3b7f-99a3-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646168630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646168630, "uuid": "a4ab1c82-6cad-42a2-bd3f-6b148eea0749", "comment": "Malware payload", "value": "cd8303eef59d164499f8a906162ea6ec", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646168630, "uuid": "be29034a-6a2e-4e77-924e-8649dc061523", "comment": "Malware payload", "value": "310a0c2a2edb611878fe1a935b24b9ca4c15d6534fe615b3a6ace358f7b82952", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646168630, "uuid": "bde8f463-9b47-4f9c-bfb5-d75c5df25b10", "comment": "Malware payload", "value": "002239cfae92c6a12a6374e496f978784fc6dc8c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646168630, "uuid": "a147f30d-10b9-4f5d-af89-e73830479393", "comment": "Malware payload", "value": "e5435533a715fbb687bd6f5f56fcd732441cd7c455a564a1a7f85d23c961cb97bd21f0f65e80ed3ca5b07cb7736bc080", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646168630, "uuid": "f0cd1150-821e-4934-844a-11f441101d8e", "value": "T190B4AE12B790C076D1AA36342526A7B51AEDBC709EF5C3876FD03B7E5E301918A3C35A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646168630, "uuid": "65905fcc-3767-4315-81fc-17518f003681", "value": "f08242131de62ca6d7c4b2727b491b3d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646168630, "uuid": "dceb0f24-89c5-4137-870e-5fc48a1032f1", "value": "12288:jE3TMKM/JjdkdO4+BNhOwyj4h43JopSz/o:jE3TM/JjdkS23Ko", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646168630, "uuid": "cc43f439-680b-455b-8d1d-1717ae365e89", "value": 505856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646168630, "uuid": "49976ebf-6a8a-47dd-ba4f-9d014de26861", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646168630, "uuid": "72d93008-4310-4f44-b259-536e31513558", "value": "O9GOUJ.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d52e68d8-99a0-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646167659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646167659, "uuid": "7d160a80-aeab-447c-a121-3296631e5680", "comment": "Malware payload", "value": "ccd59c166cc7dd619ebdcbbd732be7bd", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646167659, "uuid": "561bff62-dbef-4e98-ace0-3aebcc729a0d", "comment": "Malware payload", "value": "312a4967d801fd31aa5c4c9543f72c73ab01d71e6056bcf4c65e78e22ffdddc1", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646167659, "uuid": "0bc07acb-8fdd-4a5b-a2f7-960fe6136937", "comment": "Malware payload", "value": "c73760ff53ebf165939edf1ca5dea6b8f18b2828", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646167659, "uuid": "4e679bf5-e5d4-4765-8d18-9c66f3f9d25c", "comment": "Malware payload", "value": "4e80c484aa0789ca22cbc0d28a4bf33772ec26580fdfa2f63de56615fcadeb1f10009c339abd7fa91f8f4e03bdc198bc", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646167659, "uuid": "da41aed0-a6e8-45fc-a3ec-21b3d09afbed", "value": "T1BFB4AE12B790C076D1AA36342526A7B51AEDBC709EF5C3876FD03B7E5E301918A3C35A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646167659, "uuid": "df421a82-d025-45c9-bdb1-c882861dfc1e", "value": "f08242131de62ca6d7c4b2727b491b3d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646167659, "uuid": "b93e790a-77da-4cd9-92f0-fc7685a50280", "value": "12288:jE3TMKM/JjdkdO4+BNhOwyO4h43JopSz/o:jE3TM/JjdkSV3Ko", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646167659, "uuid": "7ee4b6d2-ff1a-448a-892b-43ca62d58f46", "value": 505856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646167659, "uuid": "ce591cdd-a7e4-414a-988c-335b8c2e9f1b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646167659, "uuid": "4c56f3c6-89fc-4ac3-a6f6-c8b1c2b1ffb3", "value": "t3N93FpDOVNsv2.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b66d2375-996e-11ec-9275-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1646146132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646146132, "uuid": "aa5cba49-296a-485d-b874-66068c9cf7ef", "comment": "Malware payload (Quakbot)", "value": "7adcf98526037b61f74a5e413d3e1846", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646146132, "uuid": "ff2ac168-fc63-413d-bf85-c7ed86fbc260", "comment": "Malware payload (Quakbot)", "value": "31c403cea645f5385ccf3a27ae7e6df604adc0ebecdd865ab11f0fdcba191f3c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646146132, "uuid": "9e262782-5f6e-4648-9bf3-645f2bf692e6", "comment": "Malware payload (Quakbot)", "value": "29522e49041d2d2a870c20ebe9c6528224f999ef", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646146132, "uuid": "02fd4412-25f0-4f69-b23d-520f005d4815", "comment": "Malware payload (Quakbot)", "value": "d595e4fb81310716f28de8f310607e659bde123f93258dd361d3f42cd5e6a07264206f7db309dad38b02884b61980e41", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646146132, "uuid": "2eb9293e-a5ee-44a2-91b6-1e377d074127", "value": "T14325BE71A2E115BFC1733B7DAC3E6198CC24AE512D14DC4CB7DD1E8E0E296A227251BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646146132, "uuid": "6ecb5b71-a785-4e45-8f89-0b476246ceb1", "value": "39e575b47547313526712cf504793169", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646146132, "uuid": "a4515309-2ed9-47a3-b22d-fa4382d0f65b", "value": "24576:cSdk/wBjirEIzNbNsdU5xB31FFbDt3xywiDSR6b/2+:cSlmg2NbNsIxB3LZB3Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646146132, "uuid": "acf68c15-e875-4755-9e2b-9ec11b84d942", "value": 1056776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646146132, "uuid": "3933ac0e-44bc-44f3-a574-6040f0e247c8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646146132, "uuid": "fd1c23fb-5ebe-4a58-bbbe-fdc2a2b27728", "value": "fn.png", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ed82fd0-9994-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646162199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646162199, "uuid": "8af5e147-22df-4953-8473-144797de6278", "comment": "Malware payload (AgentTesla)", "value": "30e47f6a1cc237c78eecab3ec106fdb3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646162199, "uuid": "c7273c3d-ae6d-4a50-b11b-ccee42587a57", "comment": "Malware payload (AgentTesla)", "value": "3226b44835eae78f666155d3ee6a4af642015fc1a0bc61aa32bdec0bb0ed4481", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646162199, "uuid": "fd8c33a1-87ca-4a20-b8f1-4346d78fe2a1", "comment": "Malware payload (AgentTesla)", "value": "15eaf28cfe114faa408ec3029639d67ce4b7c584", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646162199, "uuid": "cf68b8eb-3a97-4d3b-b615-5cbce890a663", "comment": "Malware payload (AgentTesla)", "value": "a0ba64e3580083529ab59c9768e5a4fd2402bb03f33212f71d76ed68fb5507d75a39ae146923314ac23b400fdcbe4356", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646162199, "uuid": "b07e5322-ce0c-40ed-a70e-3e42b3defd1c", "value": "T10E05BF4439D65038F8368BF1CBC0EBF19B6EF321E48961F568000E558A56BBC8956EFD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646162199, "uuid": "e63cdc58-85b1-440a-b019-2b13aa6cd99d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646162199, "uuid": "8006949c-e1be-4311-924b-40267a74f807", "value": "12288:tE1MR/Ik9YBOkjHSfjVptbwZ5S0SiBThsW9I33BUZLIIOZTtGffqOoS4EcjQS:p90RjyJnwZQ0SixhsbQkIOZsfSOP4sS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646162199, "uuid": "7dd02e98-08af-451a-af6b-303aebb90109", "value": 836608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646162199, "uuid": "191b580f-02e1-4b95-bac7-eab26c7b3b8a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646162199, "uuid": "5b8aab30-0a42-49b5-83ef-b018cfd51dbe", "value": "Items required.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14dd6453-9943-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646127393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646127393, "uuid": "93740b33-c275-4691-b9c4-d812b807d62b", "comment": "Malware payload (Heodo)", "value": "7a1ce54c51baac7a477c413843e9204e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646127393, "uuid": "62615624-31d9-47ed-a447-8761d1a7f9db", "comment": "Malware payload (Heodo)", "value": "32ef028b2e99fb24ef94aff64146be956152bcce5c1ab8af91f5023f89e71f56", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646127393, "uuid": "d4f86332-bcbf-4e83-8c1e-912a5957dfe4", "comment": "Malware payload (Heodo)", "value": "a9c7eeed3433e519fd747d78693eebaf3c0d9dc1", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646127393, "uuid": "8f209024-88ac-431f-bdaf-b09ba45a0fec", "comment": "Malware payload (Heodo)", "value": "2765ee0c549319ee38d85f6a1397fe1f2e90ee70db74459f75e2ff8c0e0e5c04e362ecb7c907bd99ae951ee989ec3553", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646127393, "uuid": "6b4f034d-2e0d-417b-8c0a-010d24ade44f", "value": "T15FC4AF12BFD39072CE2F293C503DA77413A95C65971A8863979C9BBE1D3F9428B3190E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646127393, "uuid": "ac1a8bf5-92ec-4271-ab6b-64a4a672eee7", "value": "e0b213ccd96f46d30dcd8e225f4e9fc9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646127393, "uuid": "f52c42bc-59f8-44bb-9a1d-adf77e4cd55c", "value": "12288:onEtDywy8SYlHD70WychG0QOCM8T9xvCByDyPgyQz/VDNeg:onEtDywy8SYdnhG0QrM8hxKB7a1Ne", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646127393, "uuid": "bd062a74-5b67-46d1-8885-b4b26701bd8b", "value": 585728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646127393, "uuid": "553ca3b2-98f1-4032-ba13-8a1cce401ffe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646127393, "uuid": "868c96f7-356c-44d2-837d-eb43459b0297", "value": "rll6NQLTVIi.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ece4bb6-995b-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646137717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646137717, "uuid": "51972cc8-42bb-40f5-afb2-1f8025c0fd0a", "comment": "Malware payload (Formbook)", "value": "4eb483aec602641bfc0b789f0b2d9f88", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646137717, "uuid": "207f3b82-455f-46bf-969b-c17cfb743708", "comment": "Malware payload (Formbook)", "value": "335c4cb2547fd9964721978dbcbf752d86c4a46ef6e0860fd4e6d7f149e23f71", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646137717, "uuid": "63544060-6ce8-46b8-a874-f3b345b3cc92", "comment": "Malware payload (Formbook)", "value": "07d065d6879e63d4c541a0d1d9151c0999e77d86", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646137717, "uuid": "8408a058-de14-4a4f-b94a-b8b432a88610", "comment": "Malware payload (Formbook)", "value": "12eebe5b5e1c105ffb2dc4010e8c2f383fa0acac4c152e358534aeb128ba40aa8656e7216240c182aad9aa47d15d239d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646137717, "uuid": "5a997ffe-a2f7-4d34-aa99-2244838225af", "value": "T1F115AF4834E6507DE836CBB2CAC0EFF0DB69E262D54961B254020E19960DBFD8E45EFD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646137717, "uuid": "63af419a-51c5-4d7e-8ef4-7b6a2e549e80", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646137717, "uuid": "f3e8720d-88aa-4078-855a-bcfb637f5676", "value": "12288:VX5Gfb8iWJ2sxPjPMXeoWM+hZF2Eq4HoOtDtdQSpwXnt3+Q7czYR//g:XCPWJ2sxPTwDWMer/HoOtRdQXu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646137717, "uuid": "b0f5660c-61c7-4c8e-9eb1-4c1cd65c7ecb", "value": 888320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646137717, "uuid": "571010a4-7d10-4c25-ab11-20d2f4b8f7b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646137717, "uuid": "5db4146b-1ce5-4f97-b793-2fce32e6c632", "value": "SOA for Jan.2022.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3726da60-9933-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1646120578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120578, "uuid": "628ca4d5-889f-42a5-9840-4bd5c143c6ad", "comment": "Malware payload (Loki)", "value": "987b802a5e877bb1e17c67580342b596", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120578, "uuid": "64a3c038-ffba-41b8-97ea-f8c3e36f3425", "comment": "Malware payload (Loki)", "value": "337e03344b6860d782ee123673f7b6b0faa11ae0b9c17ea6983f2add9e7d5a6f", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120578, "uuid": "44747be3-8651-49d9-a24e-51d8072956c4", "comment": "Malware payload (Loki)", "value": "f267335674c0d8381bec2206368032cb92e4cbca", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120578, "uuid": "a5828465-ba42-4a78-8f99-d174472a4320", "comment": "Malware payload (Loki)", "value": "6abb0e706b3a40c02b8a9afeba9b846ba42956403098a5aaa71ed63fc84ee47c6a6f523c5340e615e2aa3da3779151fe", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120578, "uuid": "84ba7c80-3756-478f-b5d4-7d15cfe42bed", "value": "T1231402A17681079DEC5EB6B772F9484A523FDC2C5AA4142409E83F76283637D20F267B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120578, "uuid": "5f52fb08-c7bd-45d8-8e84-cdf7dc1c8ee6", "value": "3072:XjqO3B9b3KfI9IAiMRImHxVguECB4P1zYPc9GVj+VmqWbO/Z8GaJ+KMNY78i:mS9bwI9d9RImHvgts4P1V9C+VmZO/ZFa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646120578, "uuid": "d2edd5d8-51df-42d3-9f9a-d018c762a6fc", "value": 190968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646120578, "uuid": "9c49df76-fd5d-4232-af23-3379cf0bd11f", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120578, "uuid": "5109c677-1853-4297-90df-c3f7b41c9763", "value": "FRT_MV_BALTI.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed08fba7-998f-11ec-9275-42010a9c0029", "comment": "Malware payload (RemcosRAT)", "timestamp": 1646160397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646160397, "uuid": "1b8de7b3-91cd-4191-b517-67836b5a35f0", "comment": "Malware payload (RemcosRAT)", "value": "59484a399cabca72694b1725a17afb73", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646160397, "uuid": "3b18deff-f715-4301-bf6a-c5a2354aedc8", "comment": "Malware payload (RemcosRAT)", "value": "3428d76b19aead29d804f6959520211224f9c52c9a96a64e50dc852f34faa760", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646160397, "uuid": "45ca647d-6dd3-43c7-a74f-8bf91073c2d5", "comment": "Malware payload (RemcosRAT)", "value": "243f43a6f89298354fff193a6234cef3cae642fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646160397, "uuid": "b0804f04-1756-492a-89e3-b95a6dad615e", "comment": "Malware payload (RemcosRAT)", "value": "2e591f71e2519e91478aa13b2f5c296d3d3688411d3ca442f8af6b62603a406cdddade3511065a863fd89ef98840d924", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646160397, "uuid": "381b0536-c9e1-4e2e-98a7-4a4b45ae94a7", "value": "T15C651A912198E3CDE9602F320244EFF666675E399523E025C1C53F87767FB5DA8332A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646160397, "uuid": "7e1ffdee-fa25-4deb-91d2-690e490611af", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646160397, "uuid": "e1ed7bfd-a5b4-4be3-91e0-d0d54a3f6f4c", "value": "12288:8wP1tF/xPF3FkfjDkx4/fS+IzHV7AVmgisYeg6AKRO0BSjtp7WKZ:8wP1t9pF3IDkxISBomgi103BSf7X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646160397, "uuid": "4dcc7dd2-883c-47e9-abdb-62bdd4cc79bf", "value": 1484800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646160397, "uuid": "1704ca60-43db-4a8f-b8fe-ba909c0188c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646160397, "uuid": "b1f55d47-f68c-46dd-937a-49ee61762bf5", "value": "59484a399cabca72694b1725a17afb73.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8595171d-9903-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1646100094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646100094, "uuid": "30aea324-b9e9-4cd9-9e87-995ecea73ec4", "comment": "Malware payload (Loki)", "value": "a69ee3f102bda35bf4c12a89c1557b09", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646100094, "uuid": "9ee34101-236e-4d19-a5a3-8a02830e3e33", "comment": "Malware payload (Loki)", "value": "34ea1e95f74e1948ee2e8cf24ad7f9d5621032bb05b9fb419c57abd4d671d937", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646100094, "uuid": "48952527-2bdf-40ac-b399-6973ef39eccb", "comment": "Malware payload (Loki)", "value": "6ce3c27b204e594ac81bfdb421fd7205d28af504", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646100094, "uuid": "f2eb56eb-7dac-4300-9077-db55999a0a36", "comment": "Malware payload (Loki)", "value": "51c5a57a832a86df0ac25d8471d0eb575ad5eba85af33ce8413909dcc32223d227aa3d88185469a3a4caa4131fc901e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646100094, "uuid": "937de0fa-4bd9-46df-89c7-3cacc755af9d", "value": "T1AF64220234D249FBC6865A711E337FFAD7FBA06D1A454A83DF708FFA71221434A59682", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646100094, "uuid": "2c9b9ef2-9cf6-4574-9666-78408c6e18a5", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646100094, "uuid": "12befa1a-e79a-476d-9662-c522c3fb5ca8", "value": "6144:rGiTun3zGW8f5/AQUcfOTRPI7gWgAhlkbWnTTHEu5wGInVOcP9od:G3zGtAbgcPI7gWgm2bWkuWVR0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646100094, "uuid": "b50ce0d5-2cd8-4856-9fe1-80bde566df0e", "value": 314912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646100094, "uuid": "5db44b9d-d3f8-4c5e-863f-95eb21005fd3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646100094, "uuid": "bee188b8-f9fb-4870-af4b-0dd730885d07", "value": "PaymentCheque.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ba0670a-9939-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646123082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646123082, "uuid": "f8a307f0-3321-40be-a395-6cf74ca50c82", "comment": "Malware payload", "value": "b76ca06e73c4b70fcd0b4a116ff4e018", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646123082, "uuid": "1569fa3e-1065-4a21-baa7-a666c9b9ee54", "comment": "Malware payload", "value": "351090b760bf5996e038f8e71273e6d7d91ea128a477618e1a6ade448ec6a0eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646123082, "uuid": "aa216436-581d-4c65-8c43-2c7c527b6bf9", "comment": "Malware payload", "value": "d595755ffef9618fcf6eb833b38ff52afb0c0c64", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646123082, "uuid": "dc1d6a52-fa76-4b03-b831-c78af6ae138e", "comment": "Malware payload", "value": "14e5a3b5fbf073e19ce105b10fbd4b857314286e3659691f88682b837c17ab8f0ee94d345ef591dfe84ce351adbb410c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646123082, "uuid": "0d69de95-cf2b-487a-be28-8d3c6dd8d863", "value": "T1B906017C266E5E4CF784947CB1794EFF27A2B82F05A774F7900CB2D70AA9BD05502226", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646123082, "uuid": "8c2d6382-d854-45a6-8b7d-62b6f18702ef", "value": "4443ba86c457722dd58af4e4410113ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646123082, "uuid": "ee0e5b2e-babf-431b-b532-22c30ac8c95f", "value": "98304:XpEdtLiNZG93jfpSP1atPI/nRl+WY05grrYyp:XpETCZ6TA1oPcnpcrlp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646123082, "uuid": "97c1a8e3-a71c-4eac-a842-d78db56ca225", "value": 3859280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646123082, "uuid": "bcbec2d4-6945-42a6-94c3-135437ee3bd7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646123082, "uuid": "6925f3f7-be91-4380-94f7-d51951e6a620", "value": "b76ca06e73c4b70fcd0b4a116ff4e018.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbc9e037-9973-11ec-9275-42010a9c0029", "comment": "Malware payload (NanoCore)", "timestamp": 1646148396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646148396, "uuid": "6bd7bb8b-09ea-4b05-886a-e941e190c625", "comment": "Malware payload (NanoCore)", "value": "1e7a9a483a9956c5c5f1700079c8386b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646148396, "uuid": "a228fbb3-fc05-4d74-b6fd-d14c2ce0da2c", "comment": "Malware payload (NanoCore)", "value": "36003a145b08aba4b89f9c43f5edf99e600cd280fcd763ba880687ec706a83d2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646148396, "uuid": "d73db550-118b-4ef6-b2b7-04c3eefa7501", "comment": "Malware payload (NanoCore)", "value": "1517f7ee0e8edb47eccc8297d13661b59b1da0bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646148396, "uuid": "d0907211-2e12-4e3c-91f4-5a89deb0bdc1", "comment": "Malware payload (NanoCore)", "value": "ae6219cf30592a26d3a66244448b8af247c82bba8a5e780df968c9e592699893ff3b4bb0d18563940a63dae8d7b3d6d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646148396, "uuid": "9eaee6b0-bcde-495e-994b-74499d0949d1", "value": "T1190523113748E265C3F887BBE96204462B318D23601AEBD98D98E1DE0D337E159DB76B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646148396, "uuid": "265d5e12-b36c-4da4-878a-1df566a2b953", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646148396, "uuid": "758eb8e1-e0ed-410a-be44-87d38b098ac1", "value": "24576:FtLf0tzamiRrzKMifei2+u8afMhmUYb4NHTW1AbK4r:FtLf0tzamiRrzK+yutfMbbNaE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646148396, "uuid": "4f4e3199-0803-4377-885d-06df2ce7c116", "value": 871936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646148396, "uuid": "4f80d841-b0af-426d-8bb7-8a9e9443c403", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646148396, "uuid": "b0381600-db42-4696-bfb1-417da69d3e0e", "value": "eVoucher.pif.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "572ea05f-9938-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646122780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646122780, "uuid": "92ea695d-70f3-402d-a377-fab1348ce36d", "comment": "Malware payload", "value": "3b39ae424375b22a92f280882e129312", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646122780, "uuid": "0e76163c-c161-4ba8-90e6-bc9026bad2e1", "comment": "Malware payload", "value": "36499553b69370a4e20c15982d9fa8b4008654c06817dfbbca78bd4f0d2283d7", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646122780, "uuid": "d03f1795-4c88-49f2-a2c1-4f9bc79b7900", "comment": "Malware payload", "value": "e0195e5002d7e36687d32b5dae23029953f28cdf", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646122780, "uuid": "41448057-765b-47ad-8ae2-33c9b8113005", "comment": "Malware payload", "value": "32dd8b313efdb8cc3b65b0a6f9985aa02bc3531136357d1ff340dc28df49cd63326bc895902cb90e21dd214b8d50506e", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646122780, "uuid": "96e0f414-8433-4f16-9ac9-bdc714458ba7", "value": "T18C65E085B3C8BC1FCC7384364FBA8A2A94864C56C646D31759B4B52C9EFBAC44E45FC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646122780, "uuid": "aca02f89-88de-43d1-b06d-96dc9567d773", "value": "24576:qfuzTSul+C8MRqfEkyhONgyuyKOhfLT9KUSTPpIlyCgno3ePq920qsrbGgvP0gXS:qfIOulN8MRqckyhONkyKUhK/TBdouS9a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646122780, "uuid": "968ba17b-0cf4-4989-975b-f0d929425042", "value": 1493788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646122780, "uuid": "9d34be0d-b20c-4498-adb6-97489cde6961", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646122780, "uuid": "4a9abc31-ea5f-4823-bf0f-c61dcbb0d166", "value": "postbank.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bc8b67e-9924-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646114305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646114305, "uuid": "62748e75-3cea-4e0f-a2a8-279eb2244e0b", "comment": "Malware payload", "value": "bfec0343099a9aa2cbf1c400fdb87f8b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sytro", "colour": "#0AE180", "exportable": true, "hide_tag": false }, { "name": "worm", "colour": "#D3BF90", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646114305, "uuid": "4213da37-b72b-435b-b1fc-2cd1d1946d37", "comment": "Malware payload", "value": "36b57273f6f34b2e7f80a120dbe82c3ee9e08f871f73b49c2d258f641056eba7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sytro", "colour": "#0AE180", "exportable": true, "hide_tag": false }, { "name": "worm", "colour": "#D3BF90", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646114305, "uuid": "911cff7d-b77a-495b-bc4e-08cd867b8b67", "comment": "Malware payload", "value": "9a26b998cb09a374ebec09913ac8b6580d2d6540", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sytro", "colour": "#0AE180", "exportable": true, "hide_tag": false }, { "name": "worm", "colour": "#D3BF90", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646114305, "uuid": "6f8d9854-23fd-4f9d-b1aa-6d53e550250d", "comment": "Malware payload", "value": "64b34725cf2d0803be8a001c265ce8228a1fe919b0d6cadd42ac7d3d7b4b7a3abfd742f15883347798d5a7d65ae1c075", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sytro", "colour": "#0AE180", "exportable": true, "hide_tag": false }, { "name": "worm", "colour": "#D3BF90", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646114305, "uuid": "515df054-f674-4efe-9d1e-18d0ab986769", "value": "T103F37C63F2D08873D1732F78DE168198942ABE642E6914567BE88E4D5F3E7C1681E3C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646114305, "uuid": "49d911d4-cb9d-4945-a186-1b46e90fdfe0", "value": "700e5c09ef1924c7531712f6fe894f1c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646114305, "uuid": "8e5def45-915e-4d77-bd05-9e957dbfec55", "value": "3072:HxTqpdA3f6QNf2IPO4DpmWpAsfYbTOBoefYi6a9k20tA3ZCqkz1Mt1cPnS7:R2pdqfv2IPOGfXf5ovWJCN1McPS7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646114305, "uuid": "ae23ad76-e761-4210-a34c-cb09567327f0", "value": 170807, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646114305, "uuid": "118ea078-fd61-4693-a08d-6219d6867eb1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646114305, "uuid": "15a6c015-5925-4f9a-a0cf-9dc91aab765a", "value": "worma.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d0ad971-9956-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646135782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646135782, "uuid": "150ab6b5-d130-4bf3-b601-3c6226abfdc2", "comment": "Malware payload", "value": "f59bfa7f1f554fe5034c8d7cdd07b7e9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646135782, "uuid": "d1ea5dd9-97f2-461b-ba54-c1843afae2c5", "comment": "Malware payload", "value": "36fe716b7f13417708c7de36bfc1354325009788399a5d7bd0f973c4a319ecd5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646135782, "uuid": "f2c82700-324b-49ad-abda-324ca2705898", "comment": "Malware payload", "value": "dc63c704ffe6addb082706eb1f9f36d7182ce37d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646135782, "uuid": "8017deef-d58b-4a7f-bdc3-0e2c044997f5", "comment": "Malware payload", "value": "80cdec0042962e876be4b3bdec39c8a1c3488a06124495f31e6100eda6b3f8744d27f5fb4539d68fe233ca3f833a2ff8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646135782, "uuid": "5c40d211-c997-4366-99ef-8df631f8fec6", "value": "T1FF148C55D1D4480FD3735D35C8B1E70352ABAD8B2A12D6DA93F83D2FA33195BA3B20A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646135782, "uuid": "1de6dd18-6dbd-4130-8e0c-14d886cfa3ea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646135782, "uuid": "458ee9d3-709b-42e4-b726-7b6b8961c895", "value": "3072:UnQ3nPWlVy9CKQ0UUVUUXjNBvvthD1fKL2:DnEsgKNtK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646135782, "uuid": "93413da3-c72f-49da-8e7e-fb194a976261", "value": 194560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646135782, "uuid": "a667e121-9b8a-4413-a48a-29aa55996012", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646135782, "uuid": "68769bf4-ec47-47df-b975-348bd3b9c9ad", "value": "cotizaci\u00f3n_______pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34b6327b-999f-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646166960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646166960, "uuid": "806c3f64-2f3a-4393-80dc-b0d27f6b53a2", "comment": "Malware payload", "value": "fcd748520eb91360fd080c68a60f51a3", "object_relation": "md5", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646166960, "uuid": "39b40f9a-dcf4-4a73-b3af-2458aec4a520", "comment": "Malware payload", "value": "373a484fb4744908f19db0a0e1a90976dde45c5df2a31564386598ea04f46aff", "object_relation": "sha256", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646166960, "uuid": "2b9020a8-0f59-4651-a278-0afdaa24afa6", "comment": "Malware payload", "value": "8952767e0ffd72ff208b5c7a1e706fc554d814ba", "object_relation": "sha1", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646166960, "uuid": "5acf403d-1202-447c-85ee-a1e9ce4bf8d9", "comment": "Malware payload", "value": "a559aee08fc78b36a77d362c327d54a7f80c43e1ac1b16a4da217916cc28961ca6dba8c5bc557078e961c38458b82324", "object_relation": "sha3-384", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646166960, "uuid": "7d60cf39-5dba-4f7e-bbb0-e8dc73eea8d6", "value": "T1FF23D025C1607828C73E8C759200EAD2720A7D04D9D5EF893585BB4C3B96BEB57AF9CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646166960, "uuid": "2e82e91a-5184-4aa0-b054-43e737b5f441", "value": "768:eio9DOevZCwrvtD608zdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Uh0VPWft:eio9D7UtT5fTR4Lh1NisFYBc3cr+UqVC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646166960, "uuid": "eaca37b9-8ef6-404e-bfca-0e49b49637a1", "value": 47699, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646166960, "uuid": "dbe8784d-c54d-47d2-8d65-c10ee3bb93ad", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646166960, "uuid": "d6eb75c8-8822-4c1c-bcb1-c69316d66935", "value": "eBooks.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6c7778d-9932-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646120336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120336, "uuid": "c0bd99c5-3b5a-4675-88fb-82378e8d981a", "comment": "Malware payload", "value": "86f93e8b12d96eb7213f7655ed9e5544", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120336, "uuid": "9fcdf6e0-4cb6-4f3a-a2d3-a74b8d94701b", "comment": "Malware payload", "value": "38628d0efd3cc7f7edf40e9ee61b41df85f85841b2ee096fae0220e2b80740e1", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120336, "uuid": "0322bc5b-3b58-4b8c-bc1d-e6361e5e011c", "comment": "Malware payload", "value": "f8cebfa2bab09f2523a0094eed5e7ea079892bf6", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120336, "uuid": "2bab22bd-f294-41e3-b737-ef4c389f2db8", "comment": "Malware payload", "value": "6cbd7b1f32f542a1087a2cb9d564890a55a15a879643ec1f248e6426fcc31e754ae12baab471bac567c643fa8fa96114", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120336, "uuid": "17ee9f25-f4ba-4963-8c49-f0edccb1e1de", "value": "T1B3B3E0087695CA81D1C54A700DF6D7DBB7A4BE88DE11D30770CDB73E6E3B9D8A682224", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120336, "uuid": "36a12672-7839-4f05-ab56-f20258ad1266", "value": "1536:PdqfKQaRlBjZCsvtZ9WNHSCullT+JDEnLhkTQN+IZ4y6Or1cV0cYVbOd2eB6bBVJ:Pd2K/RZCEtZ9WkCuGELKN7yDrnVSd2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646120336, "uuid": "91fd724e-f403-43a8-9db9-10cd562fc56d", "value": 115200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646120336, "uuid": "bf8e9066-7565-46c4-9af6-f868656a642f", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120336, "uuid": "87469b41-80b4-49ac-bdf2-1c0c89ccd91e", "value": "Payment Advice Note.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4725b3c5-9987-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646156683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646156683, "uuid": "2d3f7e81-8c92-4c7c-8bae-3a9b6001cc9a", "comment": "Malware payload (AgentTesla)", "value": "20ba6420778381fd27ec6b4bdf206d26", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646156683, "uuid": "e7e5ea3f-4bd7-4714-9142-bf54cf30db02", "comment": "Malware payload (AgentTesla)", "value": "399a8f66fd5665df9e3652208288e44043198e7b5dcc5d03b15c4132b3543151", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646156683, "uuid": "8df225b1-c0db-4028-b84e-70ad37a855bd", "comment": "Malware payload (AgentTesla)", "value": "a66f9c90e56b74c03792230889c63f7b92b03aa2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646156683, "uuid": "f2d5c500-3153-410e-b4db-5bb1d51acd08", "comment": "Malware payload (AgentTesla)", "value": "2521a556c913346dda9f0888676818060bf68a1cc768b52706926b32691d5e2cc53e6204c0fed6646421bc7172e9ac4f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646156683, "uuid": "76661385-98e9-4924-9252-63adcf5b0005", "value": "T19015C04839D6203DE836CBB1CAC4EFE0DB6DF222D54961B254020E599A0DBBD8E45DFD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646156683, "uuid": "2069e87b-d500-49f0-b40e-adc0272ea1ef", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646156683, "uuid": "bfc7132f-d634-40d4-b733-468e31247520", "value": "12288:EITGuxj/cbz/7u5cIoeH4ljDhh76ZDdsDPdxby/7rrCO7ylfJcpK3n4rkUbPZiGT:pCuxjGu5u7l/j6QD3byL57IReKIrLb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646156683, "uuid": "aca03f17-544a-4168-81bb-d130a6155685", "value": 947712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646156683, "uuid": "3f3c4de3-c620-49b4-b60f-d6afcb9c1ea5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646156683, "uuid": "b045dc9e-9985-4ac8-befc-d6bd41d6e92c", "value": "20ba6420778381fd27ec6b4bdf206d26.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00d720d2-9925-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646114474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646114474, "uuid": "c93023c5-9b13-4399-a7b7-811619a95669", "comment": "Malware payload", "value": "e122538ad54510c125aca678b3631934", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646114474, "uuid": "fbc2f889-128c-438f-a46d-1ffcc47e2b98", "comment": "Malware payload", "value": "3a12d024a367be923ad486aab177450984c9fa90ae4d8865618545fb7f67894a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646114474, "uuid": "9b5fc4ea-efbf-405e-855c-2df74aac930e", "comment": "Malware payload", "value": "6fc58cd3764dce7178a395e4ae3eefc3ee28f53c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646114474, "uuid": "6af2a8b0-fe9a-429a-946d-bdfb888a92cf", "comment": "Malware payload", "value": "63fcf55c623ccb0b6fff4172154eca454c9007b309023c9a9fffe1bb405c80ef551fb8a7a50a6db307f023b00e0262da", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646114474, "uuid": "7dffd73b-ffea-4b19-972e-c6b130034730", "value": "T1E4367B02BED2C060D01A56F545FEE676E639BC030F2466CF3E84B62E5E35AD09B3175A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646114474, "uuid": "c4cbfcae-6ea6-4f9b-8244-4e1c86a91be2", "value": "34b13c847810bd6458d17f352a75908b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646114474, "uuid": "decbdc67-dc22-4da8-b085-0db78a45de3d", "value": "49152:G/xSDa7k7e7tM+7k7e7/xSDt7k7e7tM+7k7e7/xSD07k7e7tM+7k7e7/e:UxcadRM+dzxctdRM+dzxc0dRM+dze", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646114474, "uuid": "c591a18b-0089-487a-a3d0-5b6b315a98df", "value": 4976938, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646114474, "uuid": "23023568-947a-4e0c-83b2-d788e3b5efd1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646114474, "uuid": "446cf256-0d47-4c57-9cfb-ddc51b2d1f34", "value": "wormaaa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0d1dd82-996a-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646144459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646144459, "uuid": "07f94de6-26b9-4f53-8cb7-19cb079c6545", "comment": "Malware payload", "value": "786ef432bedbbb020ccbb3e895151c8e", "object_relation": "md5", "Tag": [ { "name": "pub", "colour": "#C85B7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646144459, "uuid": "a10c6342-3c99-4f4c-b23c-672f858154e9", "comment": "Malware payload", "value": "3a6941c2d22da5e11f208d4b9eb4363bcb321881bef0ef72319eb68cdf612407", "object_relation": "sha256", "Tag": [ { "name": "pub", "colour": "#C85B7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646144459, "uuid": "2d76ab38-2118-4a20-a99d-73121327b672", "comment": "Malware payload", "value": "26007fdae978bd87407c89cd6d8c7c5e877801d7", "object_relation": "sha1", "Tag": [ { "name": "pub", "colour": "#C85B7F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646144459, "uuid": "688ec5bc-e248-47d6-8d8d-847bd8f6b9af", "comment": "Malware payload", "value": "a689cd6082d803d9d19c422f6ca82f74071a382685b0e36ed9d946e1c3457db697243b35a54b34ea5fcb20177ef48520", "object_relation": "sha3-384", "Tag": [ { "name": "pub", "colour": "#C85B7F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646144459, "uuid": "584ffdca-4221-43e4-968d-aa5dcad23db8", "value": "T116930110FF92EB12D499473EACA7CBAF99217EE85D21050BF1A8771D1CBB990A454F30", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646144459, "uuid": "db7193db-9a89-4e20-8ec1-ed9c7dd8011f", "value": "384:fmnHNeMlblNLAcOtzb5Q2KeePFeeYSRYT++droq34m0OiqzL65SEMZnAJ2bA1i3s:JMDeWYQq3gqzoHq4fgvTu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646144459, "uuid": "5795b7b2-0336-49bd-a1e2-3065b34562f1", "value": 89088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646144459, "uuid": "4f20fe96-8c10-47dd-ab8d-c4ac96ccb67c", "value": "application/vnd.ms-office", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646144459, "uuid": "31fdc6a1-f1d8-4ccd-906e-4c59d01fce75", "value": "Specification and drawing.pub", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d39a378c-9932-11ec-9275-42010a9c0029", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1646120411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120411, "uuid": "bee4af90-51dd-4701-b5e4-15a300ff6118", "comment": "Malware payload (AveMariaRAT)", "value": "a1c622e1d2598302c332189a6406587a", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120411, "uuid": "365fc52d-f492-45e9-be8b-15585bb5e7e7", "comment": "Malware payload (AveMariaRAT)", "value": "3b04099668e48324b36fc337bfa297ff0119fdda7b0667a53eba4f038dfe701a", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120411, "uuid": "964f7c4c-3a42-440e-9a44-815bd6b47be5", "comment": "Malware payload (AveMariaRAT)", "value": "d924e581c3eed5b8193fd04a0bae518f398f5b4d", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120411, "uuid": "954e5850-0d99-4a8c-9fc7-195117ab2d02", "comment": "Malware payload (AveMariaRAT)", "value": "0b18149beb1e6cfc30f83874864fbc075af785f1c95b04113ac7bc0ebd930196e096c28682c1ed833c7b2daac49c1e7e", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120411, "uuid": "ed551d71-7c39-4041-99cf-539fc1a4071b", "value": "T1825435A0682F0975E748BD0E50E1704A1DF6FEAAB0C19732539FA964DFD46F18EC0857", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120411, "uuid": "d0251b02-44fd-4091-85d4-cc9b639de05e", "value": "3072:iVe9uXcR06QRQe9uXcR06QRQe9uXcR06QRQe9uXcRsiOHnzv6MHdzFtr5RDAw5wI:RLhdzFt1RDAUwI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646120411, "uuid": "98491207-a686-4ca4-bb34-1874022804bd", "value": 293052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646120411, "uuid": "09cb6b29-f43e-414a-a6da-df33ac352ada", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120411, "uuid": "aeabe6f5-9a13-45b8-b78b-9d4d66123794", "value": "Return Invoice for Graphic Druck.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e791f1e-999f-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646166976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646166976, "uuid": "14da84b1-0899-436f-a913-08553eadf89b", "comment": "Malware payload", "value": "23dd5664139d82c8b266f48718235f7b", "object_relation": "md5", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646166976, "uuid": "14d835e2-0e0a-47c6-874b-db8d277fe401", "comment": "Malware payload", "value": "3b0a8eed8733600ca82bb781d75e38181b17bcba56275110b8177ddbf8ec073c", "object_relation": "sha256", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646166976, "uuid": "f08e1166-e61d-4df0-82b3-7e789e7a1696", "comment": "Malware payload", "value": "9747990f07fdf66a47dd1226e0be699444f4f963", "object_relation": "sha1", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646166976, "uuid": "35ef9fcc-9568-445f-b8bf-b4f1f926a1a0", "comment": "Malware payload", "value": "fb8c553e98263eac128d8662b36daa60b1d85bc2bf74c1fb6cd8904af3e8187f14e134565212fe83f0b41e14c0afa790", "object_relation": "sha3-384", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646166976, "uuid": "0bde1c53-b7f3-4409-a560-00a6e240905e", "value": "T1B023D025C1607828C73E8C759200EAD2720A7D04D9D5EF893585BB4C3B96BEB57AF9CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646166976, "uuid": "672c286e-8841-4653-9b75-5241e3abe4e9", "value": "768:Oio9DOevZCwrvtD608zdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Uh0VPWft:Oio9D7UtT5fTR4Lh1NisFYBc3cr+UqVC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646166976, "uuid": "3133d3ea-0b28-4f61-9624-e5eec6281b3e", "value": 47699, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646166976, "uuid": "b81f05fb-0b69-41f4-a5bb-97c308a66a30", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646166976, "uuid": "6c367a66-7b8a-46f6-b43e-6e18819db7e0", "value": "OPAST GROUP_2.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf8f1be5-994f-11ec-9275-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1646132860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646132860, "uuid": "618bf050-b68e-450c-a741-14b0bdc335e2", "comment": "Malware payload (Quakbot)", "value": "57a9bfe6f15e00c02403af50f684a464", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "THE FAITH SP Z O O", "colour": "#87FB2C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646132860, "uuid": "13d3034c-44f5-484f-9cf4-3caa2f1acf85", "comment": "Malware payload (Quakbot)", "value": "3b2eb2cd3cf0a65c1ff286c6c44bb06a30082a9d532832a28c9fca436d998f7e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "THE FAITH SP Z O O", "colour": "#87FB2C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646132860, "uuid": "f55b4fec-70b1-4aa9-a445-18d5b4c1c86e", "comment": "Malware payload (Quakbot)", "value": "718be8f702abb817a095da80978037c7012d6a1d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "THE FAITH SP Z O O", "colour": "#87FB2C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646132860, "uuid": "0d753d60-d510-4482-86b8-a0e84f52b76f", "comment": "Malware payload (Quakbot)", "value": "66698e8e450123af1d4dcd8370138c848ed2637059bbdc08cfe7cc6a2bc1db10320e6d2f0cb3bfadc045d5c32d6f1151", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "THE FAITH SP Z O O", "colour": "#87FB2C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646132860, "uuid": "d662127a-909e-439a-89b8-4f0f266983ec", "value": "T12B25F94286642A0DFD3DCEFB6F3AA3ED40664F70192AB256E350288951B81F1723DF57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646132860, "uuid": "16b32169-f83d-4e34-86bb-128eca721e13", "value": "a2c4c1cc45cf157e67048505a3f85c3c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646132860, "uuid": "c2d27862-c905-4887-af7b-602478380481", "value": "12288:Zg4d/lpygJCNLgUgYUypwKzpVCD2aep4Xl8I1JV5OwBi6fC8a/ZnFH08hXhQrVNP:ZdddhCN3tVwV1Twh/n/qVh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646132860, "uuid": "9ac234f8-ac16-4eb9-89b5-8ce77d669906", "value": 984570, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646132860, "uuid": "1c89a274-a65a-45f1-af84-35d18e9555ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646132860, "uuid": "6cd161d8-69a7-4c51-b85d-74d4171b9daa", "value": "3b2eb2cd3cf0a65c1ff286c6c44bb06a30082a9d532832a28c9fca436d998f7e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "396f036e-9931-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1646119723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646119723, "uuid": "52d0a56e-3864-4737-adaf-8c075145be97", "comment": "Malware payload (SnakeKeylogger)", "value": "651f13baef485987946db5bb10bff190", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646119723, "uuid": "a143f421-5d5d-4397-ac2f-34c0d4bd1611", "comment": "Malware payload (SnakeKeylogger)", "value": "3b61d62bc5309a42e101f9003ea0bc1b530426f78d11a6743f6c9c3511d8de1c", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646119723, "uuid": "e09e1a50-2886-477a-9a99-1162b686f006", "comment": "Malware payload (SnakeKeylogger)", "value": "65f59ee83147b6d8cd21e7bfbfb49847abda6d5c", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646119723, "uuid": "00c7ff19-7a2f-4637-bcca-68b115ce5f35", "comment": "Malware payload (SnakeKeylogger)", "value": "2f10298e8fa321e7a6e2fef0999eaed0d4f5654fd7363ea22c86bdc81c8263cce113dd7a78a7cc44558043f0d184c8c6", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646119723, "uuid": "2c7bdb9e-f434-47c2-80c5-e6d086cab44f", "value": "T115253A80B0D084BAE83B4BF1ED5AEB70179BAE5CD494403C55597F1626B3379209FE2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646119723, "uuid": "754ea31c-c2b0-42e4-822f-01fc74a36cbd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646119723, "uuid": "9ee10156-de6e-417c-8c29-58f64ebceb9d", "value": "12288:0EdMR/IDiEhpKDl6BJEgRjGxmdZX/aoJjkmJokLEbVhTzEU35mPPd:5lPEghGxMXyoxkKo8ELAP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646119723, "uuid": "d80816ea-c748-42f9-a210-229be4c5db26", "value": 1029632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646119723, "uuid": "afa4188e-00a1-4a0f-9eb1-3173934c39b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646119723, "uuid": "7b32a3f7-f556-4d3d-936c-c51757536ae3", "value": "DHL DOCUMENT AND VAT DOCS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38e16029-999f-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646166967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646166967, "uuid": "8f0fb287-8f5e-421a-930c-3c0a93f6f876", "comment": "Malware payload (Heodo)", "value": "4451321ff3c314447cee87f92824c8b7", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646166967, "uuid": "c99a8f65-b559-47d3-a413-a62a7a1d6fa5", "comment": "Malware payload (Heodo)", "value": "3baad076003fe230c793da9635248180af81aa9debe9495986bccbba9130fba3", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646166967, "uuid": "742dc821-29f8-431f-87d2-a7c4644ce67b", "comment": "Malware payload (Heodo)", "value": "e553d47a78cdae3d166f9c943271aac060eb883b", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646166967, "uuid": "72a054d4-0416-43d8-986b-e0fd92e51f76", "comment": "Malware payload (Heodo)", "value": "f517acbd6d85a5c28da587ed01da1edc7d5e474703b6016c4d4377e753b63626a7e99b5491179f07ea80f09f8373638b", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646166967, "uuid": "b56bea05-f7ec-4635-a46f-b8cf8a0eb317", "value": "T1DD23D025C1607828C73E8C759200EAD2720A7D04D9D5EF893585BB4C3B96BEB57AF9CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646166967, "uuid": "d0a17051-71d6-4382-aa8f-1d5260f15559", "value": "768:Sio9DOevZCwrvtD608zdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Uh0VPWft:Sio9D7UtT5fTR4Lh1NisFYBc3cr+UqVC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646166967, "uuid": "154a45de-27d5-4487-8e92-71964ab31787", "value": 47699, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646166967, "uuid": "9dcb6cbf-0cdf-4125-9110-6065ec453f9a", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646166967, "uuid": "760772ed-a199-42cb-8a39-632692e9255d", "value": "ommegaonline.org_2.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42d69b7d-99a6-11ec-9275-42010a9c0029", "comment": "Malware payload (CoinMiner)", "timestamp": 1646169990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646169990, "uuid": "dc5eba13-b4c5-4fd2-9f73-216ebe33b952", "comment": "Malware payload (CoinMiner)", "value": "be21cf068deb2031ddf6d4fea6382108", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646169990, "uuid": "d1b3a235-d284-4101-8f6e-02ee930f0340", "comment": "Malware payload (CoinMiner)", "value": "3be27e6954e9f1ad80c57c82c3f27f2174463824667131d6b5cbdd56a79d32e0", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646169990, "uuid": "9a7cc040-186b-421b-8eb2-e98536c5fd6f", "comment": "Malware payload (CoinMiner)", "value": "43c41e316b2a0f9f3cd07788194e1cd5ca0e0e40", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646169990, "uuid": "9a7da958-fe7f-4d6f-8a1f-2d48613280df", "comment": "Malware payload (CoinMiner)", "value": "8cfc98393e84702f0aed9cbfa1cdac4a2428c7d760c50c94a00d8192d43bb4cf9e152e6fe4396361ea65b33bb0c83df4", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646169990, "uuid": "100175e9-e67e-462b-8bb9-2a2bd6c2eaec", "value": "T1D516228C7264B1CFC85BC035D9A42E69FB61757B470B9307A45786AEAE0D98BCF140F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646169990, "uuid": "160b60f7-1361-4de7-a6e8-f313791f6721", "value": "d59a4a699610169663a929d37c90be43", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646169990, "uuid": "fe62daf3-4825-44de-8513-87553b3b1d93", "value": "98304:qqZQ3c71adx+tb9Dked9lvPl4Px+/WlHT:jSckstbNB3tl4JzT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646169990, "uuid": "91648cfa-1215-43b5-a440-48b97e73bcc0", "value": 4263424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646169990, "uuid": "4ebbbfbb-c39a-4099-977c-e104e1a847c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646169990, "uuid": "10e22794-89dd-436a-b7ef-c41919426e7d", "value": "be21cf068deb2031ddf6d4fea6382108.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "383a4fc3-999f-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646166966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646166966, "uuid": "55386fe7-c011-4612-bc97-0923c30e7c09", "comment": "Malware payload (Heodo)", "value": "d1e492ca7622b2fa18f823ea52101f10", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646166966, "uuid": "f8231e35-689c-412b-9b19-946c5a41d0e8", "comment": "Malware payload (Heodo)", "value": "3c4fff17decee447d82a62c27421d30209d8451ce8b587dfc6ce25c79df420ac", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646166966, "uuid": "08c6fc27-3264-4b72-93e2-98b92f5bd6e6", "comment": "Malware payload (Heodo)", "value": "894ab1f95a91a44b38bdb27d31243cc0c42f7e3e", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646166966, "uuid": "3f9d122b-f0a8-4c5d-bbd9-5b4be79f1f68", "comment": "Malware payload (Heodo)", "value": "af46647cea4b28d883612466673b133123285747543a6cb019aa743f764dca114c9f9aa91bbed34bfb41a9d1c1266b94", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646166966, "uuid": "1ad3d337-327e-47f9-9828-c1011782f708", "value": "T14223D025C1607828C73E8C759200EAD2720A7D04D9D5EF893585BB4C3B96BEB57AF9CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646166966, "uuid": "3f389a34-bec1-462c-8af3-216ddb56f0e1", "value": "768:yio9DOevZCwrvtD608zdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Uh0VPWft:yio9D7UtT5fTR4Lh1NisFYBc3cr+UqVC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646166966, "uuid": "a6febd56-0638-4210-99c5-1ebf50ce44ee", "value": 47699, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646166966, "uuid": "9e716dc1-0551-41fd-8efd-f0b56ebc467f", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646166966, "uuid": "8c082d3e-cd20-42f0-b2fb-8d7b935faeb4", "value": "ommegaonline.org_1.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5769f675-995e-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646139101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646139101, "uuid": "43a146bf-d4e5-4a42-861d-8f23a5040b53", "comment": "Malware payload (AgentTesla)", "value": "42a772066bf04e591d0b1f7227ef3fd5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646139101, "uuid": "3d4f42b9-0ab0-4e2c-a069-2d7cc0710421", "comment": "Malware payload (AgentTesla)", "value": "3c93897e51ce080b52b787feb86a1e195cbb494091617c16871537a096b19504", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646139101, "uuid": "a877f8bd-4537-4ddc-9b75-ee3088b8ee93", "comment": "Malware payload (AgentTesla)", "value": "2b6c69dedc7d395adbc9763e495225c567f73593", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646139101, "uuid": "6f889141-839b-4e63-a746-8193e61cd8ec", "comment": "Malware payload (AgentTesla)", "value": "c009419388d34cda0d3c33c16c09e3885bf764e2af1eae19aa0fd6586a4e7e6c5f2fc5442964d9ea72983b1a49dafdd8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646139101, "uuid": "f296ca0d-c0ba-4200-91fc-8797934003ff", "value": "T1C3357C84B4D1107CEC398B71CAA0DFB08726BD65D528607D108A3E277B7A7BE8415DBE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646139101, "uuid": "718630da-e406-4163-b6fa-84a85aa02b96", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646139101, "uuid": "8487486a-58be-45cf-8656-ee05218fe356", "value": "12288:qF0rlJiCXHR1mDOeAHx+wwqn4fy0NyT35ngfQfwDiF8f2SHLRmy5P7r9r/+ppppN:PVx1kOeCj45yRC91q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646139101, "uuid": "e570f1aa-c527-42c0-9b4c-891e32fe0a1b", "value": 1160704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646139101, "uuid": "7e13d818-07b4-49da-9bd4-78745e1ded9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646139101, "uuid": "bc070c37-2fb3-4a64-aa6b-48c44f8dcee5", "value": "AL0222035CGPSIN.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49ea41f7-98f9-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646095699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646095699, "uuid": "812c4fac-1c5d-4f06-bfe1-4f414e40ed25", "comment": "Malware payload (Heodo)", "value": "53137248a5226eb34b77278c253618ce", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646095699, "uuid": "8ed40cda-5dcd-42d4-9cb7-a5b3c34d82b4", "comment": "Malware payload (Heodo)", "value": "3d0bda55c2e04f4777738db2d85a313a9132f623c0712bf94176b2e1db2e29c4", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646095699, "uuid": "3d33c5b9-c1e4-4456-822d-4b10ca0434bf", "comment": "Malware payload (Heodo)", "value": "563bb0cd736492c45773a9997173f203afafeff2", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646095699, "uuid": "5be2216d-0855-4f93-9656-8d02b3febc7f", "comment": "Malware payload (Heodo)", "value": "4a452a02065609edb573ff3c4a485dcf090417b5f04f251b17751ed39996082d4b89c914562b9794906b665c4d24a9fd", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646095699, "uuid": "75e14733-9657-493d-97ac-87a9515852fc", "value": "T1D113D019C4665ADDC327693DD6149AF4120C0E0A89A1FA9F1C54B39C2B6A1F70B5FCF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646095699, "uuid": "9e41e70b-c7da-43c4-9800-769857dcbd14", "value": "768:6/omdH+DOevZCwttqyKfcrND59V+L9Rw4eWrXcTqZ0VP2HLp:WomdH+DoylND59V4jwmXc2CVCF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646095699, "uuid": "396714c4-6492-4773-8b09-ba80fc4e3bfa", "value": 41827, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646095699, "uuid": "4fe7abca-531d-42e1-88c4-32e54faf1bc1", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646095699, "uuid": "1062d05b-0b97-449c-bc16-1f9280648182", "value": "Payment Report - 2022-02-28_1936.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5d5f0ed-9956-11ec-9275-42010a9c0029", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1646135797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646135797, "uuid": "ba14f68d-b394-4bd7-8244-e145d69d9ef1", "comment": "Malware payload (AveMariaRAT)", "value": "5e98c4949090fa2a1497dc1cb07418a1", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646135797, "uuid": "e39e42e4-7a7c-4a33-9ef6-9aa9e5ee9bfb", "comment": "Malware payload (AveMariaRAT)", "value": "3d256cfde83a4560df279fbe2b4ef03ccd52fa13b31bc1daebcb3bed353c215b", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646135797, "uuid": "041529cf-9cd2-47a8-9596-088b06f6f709", "comment": "Malware payload (AveMariaRAT)", "value": "58d8fabbb73f1342dedf1a7ce94ebbc4212c8d80", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646135797, "uuid": "19bc7eba-4301-426d-9505-6317e5d33bf4", "comment": "Malware payload (AveMariaRAT)", "value": "7f373da945743a5fdecc9205a359aeec1dfd6d5bc3dc673c6a9d984bd7c00cce916f301151d4e84b34bf0442a4ef6787", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646135797, "uuid": "564801a8-977c-42b9-843b-55ef815b7c6b", "value": "T18B15BFE2FDA16133D16313398C6B96B4591BBE207E24644A3BD4FD086F772C1392B25B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646135797, "uuid": "b835d926-50e9-483b-adad-5bed8143e051", "value": "2a35f43fd442d1304c22e57a773b4766", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646135797, "uuid": "88b9f7e2-087a-40fe-9778-a6d9cf993822", "value": "12288:/ZIts3oVYJZO7624TBzer69+yhWj7/bppUHOwlME0WGX/CALdW7dOn3v:/mtsjZOLuo6WjYZME0WO9dCdOn3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646135797, "uuid": "44045570-74a7-464a-9acf-bcdadae15ac4", "value": 923136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646135797, "uuid": "ed5c0f55-93c6-45cc-87de-249af57ea8ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646135797, "uuid": "34600897-90db-49d6-93f5-8a056f96ffc9", "value": "PO400021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dccaa7a-992a-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646116831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646116831, "uuid": "74355bfc-5201-44f1-b895-392a9fe46194", "comment": "Malware payload (Heodo)", "value": "8c175f84c2cb655720af1ca4cb83cd99", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646116831, "uuid": "f99b8022-f5cb-45d9-a0b4-b43924634229", "comment": "Malware payload (Heodo)", "value": "3d35f5abc6f27d5185cd32d6778fa5e8f29e892eb5bdad6efef001539d673574", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646116831, "uuid": "2720fb0f-6ce0-40be-854e-b2fab50a9f12", "comment": "Malware payload (Heodo)", "value": "b4a12215ecc8bfd86cd42605c778eb0bed118f33", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646116831, "uuid": "576354d4-d165-41b6-b1db-14c9486fcbbe", "comment": "Malware payload (Heodo)", "value": "b5ee105abfa96c17a60a00673dd588b818b47102c965a7e683f837f81416da94268da4caf5f965d896a600cb27bde221", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646116831, "uuid": "8c389554-b15f-4ca3-acfb-3b3f435bffb9", "value": "T1B263BD3E57327A2ED6DFAC75C0324BD2832B2342E0ABA565B051F5C71E732A22B45C5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646116831, "uuid": "5bcabf6e-2b2d-4ffa-a524-f59cf1f98ae8", "value": "1536:9p0b/XHTWhxndhjh/VwBpSZobSex7jB0FfuZibVyg:8zWhxHjh88ZoH7juFuZiQg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646116831, "uuid": "7f670da7-c8aa-4a71-8c48-47dd39c3989b", "value": 71495, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646116831, "uuid": "b1108a71-7ff9-4e76-94da-286863ec8c2e", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646116831, "uuid": "053efc39-c4a3-4b61-9d0e-317cdd592201", "value": "77284692206412323.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f1ff593-999f-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646166977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646166977, "uuid": "606fca64-4bf2-40d5-a251-44800b199357", "comment": "Malware payload (Heodo)", "value": "9e39ccbfc9c63896eca1201ec0f178c7", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646166977, "uuid": "70734750-2c68-4947-bd35-852f1b1027b2", "comment": "Malware payload (Heodo)", "value": "3d3c0aba1cbc5073edbeab8e83c6279bc2fb735cced7a757b50115430b3b1c94", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646166977, "uuid": "6b8d8aa6-aebc-4fb5-ac49-2be268580839", "comment": "Malware payload (Heodo)", "value": "819efa9c1cedc88e847b70b24f83bc2db056e8b5", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646166977, "uuid": "93beb4c7-1ef8-44e1-8e38-4b64d76dfe72", "comment": "Malware payload (Heodo)", "value": "ab8c692e4fdf17a7485b1aad856be54a8854d4a38975201863acaed8972ea4213c4c75d519073350c3e87cf3e31e565b", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646166977, "uuid": "b095e43a-fa37-498d-abed-b005ff76a346", "value": "T1E923D025C1607828C73E8C759200EAD2720A7D04D9D5EF893585BB4C3B96BEB57AF9CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646166977, "uuid": "2c34119b-d868-4e40-9d33-082a3ec033c4", "value": "768:Oio9DOevZCwrvtD608zdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Uh0VPWft:Oio9D7UtT5fTR4Lh1NisFYBc3cr+UqVC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646166977, "uuid": "7b6417d1-5416-44e8-bd61-23fa5e1d73fb", "value": 47699, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646166977, "uuid": "ce660267-a0c3-4185-be65-2a3b24f6abc0", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646166977, "uuid": "5a3e0f7f-0ef1-40d5-ac56-d10c2bcfaff9", "value": "OPAST GROUP LLC.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79427760-9958-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646136581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646136581, "uuid": "25d04657-0491-4c21-99b2-515edcf1199b", "comment": "Malware payload", "value": "3f408d4d9c27b174d67c6154f8063092", "object_relation": "md5", "Tag": [ { "name": "Daxin", "colour": "#652B35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646136581, "uuid": "acb0af69-4251-43da-a1e4-d0d9b6617679", "comment": "Malware payload", "value": "3e7724cb963ad5872af9cfb93d01abf7cd9b07f47773360ad0501592848992f4", "object_relation": "sha256", "Tag": [ { "name": "Daxin", "colour": "#652B35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646136581, "uuid": "aa904ded-79eb-4156-9ae9-c4944954b996", "comment": "Malware payload", "value": "dd6fcbe0e3c6997e3358788c156dc937c72af8a0", "object_relation": "sha1", "Tag": [ { "name": "Daxin", "colour": "#652B35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646136581, "uuid": "c86d470e-0cdc-443c-becd-5807c328f440", "comment": "Malware payload", "value": "69fb2a06b5cf0835f2551bc6edd7ccb0b9a80e1b9d3a70324e64bf8bc3ce14e45f3477de745f93ae58929c3ff3f003d3", "object_relation": "sha3-384", "Tag": [ { "name": "Daxin", "colour": "#652B35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646136581, "uuid": "330d4860-239c-435e-99aa-e5f225fc98ee", "value": "T1013423081DA01D8CDFC617B4D54BF96BA4F0728A9FBE961B41548B861A133CE56FCE23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646136581, "uuid": "1d2eba1e-768f-421f-b6d8-aeee0c1a58c3", "value": "ccd66b69c45fc0c459469a0041295946", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646136581, "uuid": "39355a9e-4daf-422b-9ddf-3b8a953235f2", "value": "6144:0vbXlEJktyiYhMKf/jGBjjPXJ+hGBgPRE3U:0vbXlEHTf/mnZeGBWEk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646136581, "uuid": "1c8f17a2-25aa-4b6a-80a4-cf463a9885ee", "value": 241744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646136581, "uuid": "6ef63ccc-df03-4358-909a-3d8a80197d3c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646136581, "uuid": "fb53d799-d49b-4302-badd-2639c1c81fbc", "value": "3e7724cb963ad5872af9cfb93d01abf7cd9b07f47773360ad0501592848992f4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82b96e5d-9987-11ec-9275-42010a9c0029", "comment": "Malware payload (njrat)", "timestamp": 1646156783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646156783, "uuid": "7631ebf6-a188-4f46-ac19-66421f7d58c6", "comment": "Malware payload (njrat)", "value": "0237c92ea3397bb61162d862a4915d26", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646156783, "uuid": "3bf52141-8d3f-46f6-9971-e05e2bebea9d", "comment": "Malware payload (njrat)", "value": "3e78fb7700a1029c2b48ac0014bcc49d0bfffe4c79c0356c4bc813a66771788e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646156783, "uuid": "23c0badd-5a6b-4c1d-8357-2007d525aa79", "comment": "Malware payload (njrat)", "value": "9cd138ada48ae2b99359fc33aaa78c432b870111", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646156783, "uuid": "76e7c24a-e8e8-4faf-84b8-dc24f550eb31", "comment": "Malware payload (njrat)", "value": "8f97e50f3e7afec0faa5599f52d0d7ef0ecf0f369c1481fa7db2a6d492a9fa804c445fce6abbb84d08403d40fedbfa8c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646156783, "uuid": "658f9dfd-bdc5-41de-9247-78223c6bd5db", "value": "T195A3D71B3E00DAEAC87E8A73E46BE5F50B22BDAFC5615347B2C07E157573411C13AA62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646156783, "uuid": "1b06e740-eaa6-4cdc-bfc6-09f7a425ebc9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646156783, "uuid": "a06b2b61-cef9-4119-9671-a089ac9a8e05", "value": "1536:pr+R1CxV6Ab+gRJNesp00liOJcv4r+RvDd52dH0O:piXCHZ+yJ8sp00lHcvdDd54", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646156783, "uuid": "8ca04c8f-2b6d-4dac-89b6-1a88922dc1e7", "value": 105472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646156783, "uuid": "cc4cac29-430b-4424-8a1d-2d3301eb3e03", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646156783, "uuid": "796c11c2-92ac-45c1-a38e-a2cec7832c6c", "value": "0237c92ea3397bb61162d862a4915d26.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4a99bfb-9924-11ec-9275-42010a9c0029", "comment": "Malware payload (Urelas)", "timestamp": 1646114373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646114373, "uuid": "9290230d-3a6f-4aab-9a08-2d054864f738", "comment": "Malware payload (Urelas)", "value": "e29f2c7adf897f54b5fed94c7cd9e51d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Urelas", "colour": "#7F756F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646114373, "uuid": "ab8237c3-b2e5-4483-bff3-adbcc9523667", "comment": "Malware payload (Urelas)", "value": "3e8ecd6f96cfd3752862e715604fe683c243040741abda5ad0223eb5de816915", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Urelas", "colour": "#7F756F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646114373, "uuid": "71bcfb1a-ba26-4a98-83a4-d6dbdfd06a1c", "comment": "Malware payload (Urelas)", "value": "f4beb10b622e64e632447e899e9f7737c689590f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Urelas", "colour": "#7F756F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646114373, "uuid": "7d4c48c0-c058-4160-a970-0f12d381a727", "comment": "Malware payload (Urelas)", "value": "d6bb0d922da8b93dfb086484ab1fb27fb2e85fbc5fc32401d3c935de056a53b1ad094d614ad31430191ddb95f7439765", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Urelas", "colour": "#7F756F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646114373, "uuid": "7d64e46b-cc18-493e-8f72-6568bc54b67e", "value": "T11E849E217640D075E3AA033589A6E6F55A946E391394E48FF37C7E7A5A312C36B3320F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646114373, "uuid": "24ccd486-dcd4-476d-9a9f-075e527ccdc3", "value": "87c5901b2db0c8093ec9190189fecd3f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646114373, "uuid": "e8642ec8-0573-44e8-bf7f-a5d8621b6f44", "value": "6144:e8efQ6QPJGcLbjg08fLsGH+revgLIAP1fXo1Eppt:n6QPJGcE0rGereYdPcs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646114373, "uuid": "1cc28e68-fbbf-4fbc-b64e-91e3c5d44000", "value": 393730, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646114373, "uuid": "e4c0f6f2-302e-4b3c-8d79-9897ffccbb70", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646114373, "uuid": "ae31b14c-325c-45c7-bf9b-dff6d412083c", "value": "wormaa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4df96dd5-997b-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646151540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646151540, "uuid": "ba99fd4f-7c2c-43fc-95fe-f8a62f84aa2e", "comment": "Malware payload", "value": "2e989a0c7984b1f7247269af09b90ab7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646151540, "uuid": "0e0217b1-bc6d-4ff0-9ed0-4fc640c02fbc", "comment": "Malware payload", "value": "3ed797ed5b3deee62dcff60732167720169ddd1c8a5e5401ddd52e9dd8aae614", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646151540, "uuid": "c991df8a-5b48-44d1-90e1-96855c2c922a", "comment": "Malware payload", "value": "0d366b553f385b9db3c333398ec68ea48284da86", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646151540, "uuid": "5d83d6a2-4cc8-47f1-bf73-7dd7a58e87d0", "comment": "Malware payload", "value": "9308e1643abb7d724d10f4be6b5f42c2484843c88490f2881c1e7f4dd5140b5adc5f7cc7a9b082d64c2aed14da418df7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646151540, "uuid": "6690a116-b208-4c78-a470-be16e4a21c48", "value": "T1B8234A4FA39354FCC64BE27451EB5771E873BC3309319A3E87A8E7300E11D519B29A26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646151540, "uuid": "4f7c50c8-376e-4ecb-a07b-a56c9d875278", "value": "70af479f7b4e629c97c1ca727551f680", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646151540, "uuid": "3c1da9ba-4e4f-4989-9153-32137184b4e0", "value": "768:PJa9JEzuEs+UoPhkvGt992srKmVXCEoUG+M9oBBWPHRG1Fl:P6Jgfswkq98sWkX6tcBWvRG1F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646151540, "uuid": "be0f3f34-01ea-4b7c-9039-04ecf9f75ea8", "value": 47616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646151540, "uuid": "d663a6e8-6ede-4c43-9b47-e9445b9e6e7d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646151540, "uuid": "e67b6425-5c0e-4dbf-96c8-e76557c5162f", "value": "Invoice.docx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae277847-9931-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646119919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646119919, "uuid": "b0224963-1974-4193-be65-7479755c5e4a", "comment": "Malware payload (AgentTesla)", "value": "9e12ab5a2ffd30d4a4e079837bf82690", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646119919, "uuid": "a9dc93ae-fa91-45dd-93af-d4df2540c3d2", "comment": "Malware payload (AgentTesla)", "value": "40175d84c12c1cb01125b96524b2ff8fe439dc7ec3e453058176ab4de76697a3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646119919, "uuid": "0aaf68e9-437b-4a4a-8c4c-7680900bf272", "comment": "Malware payload (AgentTesla)", "value": "a904492c07727414a9203dfe58256df980cc1886", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646119919, "uuid": "0d316b96-518e-4a02-9c04-02c11c3b0e95", "comment": "Malware payload (AgentTesla)", "value": "5d2a201f0387112334af019e316b1343a60222ed683f8f2c9ab533ae65c6dbee4b63b4a3553200c40d974ade921244ce", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646119919, "uuid": "4d4c15cb-23da-4abb-bcff-0aaa3193869d", "value": "T13AB25004979B2A27E9760F31596202FD1E7ABE13BC22EB5F9C80733D5972258F751E20", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646119919, "uuid": "9d9f88db-728b-4f5d-a82b-ab091ccd2b8b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646119919, "uuid": "e87e45ca-51a6-4d71-b323-a9f66436d0ba", "value": "192:2xKp5YEhL/8QtDydzm/pDwWK74C3ECNJ8veGco4D:nvYCgcDy1UzA0CNJ8veGco4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646119919, "uuid": "cd6aaa57-7201-48cb-a669-3a3125c87912", "value": 25600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646119919, "uuid": "3ad7c2a5-28f8-49e8-9838-a7141552f003", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646119919, "uuid": "df6196d4-0a26-4d2f-bdff-4c4b121442e5", "value": "9e12ab5a2ffd30d4a4e079837bf82690.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ee281e2-99a7-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646170332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646170332, "uuid": "7d9ab747-655a-4225-a7dd-511eb53b2996", "comment": "Malware payload (Heodo)", "value": "8144aa56b8c2060d4eae0a3f65dc181b", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646170332, "uuid": "7c62daff-70c8-43a5-8009-0f040cb06c54", "comment": "Malware payload (Heodo)", "value": "402d4dc40f512f8cf5d409a8d1148a7fe28be03dbb04c0ceea0b37c49c878919", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646170332, "uuid": "1ba17705-e086-4556-b25d-4827ea04293d", "comment": "Malware payload (Heodo)", "value": "3ef6f1cbf5825fdb3ffcb7a41f5d96e636b81ad4", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646170332, "uuid": "191c2992-3b21-49c8-992a-2ff1f62fff5d", "comment": "Malware payload (Heodo)", "value": "b80e552cc2b8a885832073a1d487eb10d8fe1d03c0ea2f2ba3b2badfe0774f402c1884e8b33028c4ba7286ce497543fb", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646170332, "uuid": "a4e390e1-2014-426e-962a-027374469571", "value": "T10513E02AC0961959D727283DD6148EF4124C0E4A89E5F99B1D50B3AC2B6E1FB0B4FCB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646170332, "uuid": "26109f7d-ffd5-4147-8c1f-c3b7c1515fda", "value": "768:y9oms9O+pOevZCwtxyKfcrND59V+L9Rw4eWrXcTqw0VfWZE:y9oms7tylND59V4jwmXc2RVfW+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646170332, "uuid": "0a456e69-6378-4151-9325-32299a1097ea", "value": 41841, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646170332, "uuid": "d125a3be-87db-4a41-ace4-6ea3671ebb42", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646170332, "uuid": "4f2f9053-4ada-41c7-8796-94794c249226", "value": "omicsonline.net.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7f13d63-9957-11ec-9275-42010a9c0029", "comment": "Malware payload (LockBit)", "timestamp": 1646136256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646136256, "uuid": "9f1acde7-9212-4098-9174-c25b802cf383", "comment": "Malware payload (LockBit)", "value": "e88915755fc23e17693b461a157040b2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646136256, "uuid": "53df991c-ec0b-4932-a00f-5ff963c56bf7", "comment": "Malware payload (LockBit)", "value": "40c436f4ac5193735d05cfe2375d29449a90269a718fba9d7af179317688e2fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646136256, "uuid": "5d0c305c-3283-4e77-89b0-f7540336357c", "comment": "Malware payload (LockBit)", "value": "743c801b172cc10991a740bfe412c55306b4ea2b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646136256, "uuid": "30c0b319-4f37-4d99-8063-1a1b91b681c6", "comment": "Malware payload (LockBit)", "value": "e51cc7310f5bd96126c997454154989a3463aea3940bdf376e11ca5c4ba9703afebdbb355a34ad191de65ec0a5d3a235", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646136256, "uuid": "02a64af8-17d0-420b-9abd-f7eef0555f45", "value": "T1EE253A0593018F96C813207951FE8DB3A877073192BF1CE6A78466DC83B2FA5776B366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646136256, "uuid": "567303a9-8a6d-4281-b620-a3e94d70c62d", "value": "216df81b1ef7bc2aa8ec52bbeef137c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646136256, "uuid": "980cf177-9701-4a69-9c2b-b845add768dd", "value": "24576:uLjr3s2nScu1i1tz3f++5kRzFxk7rMxNeR1R9qpdSF:Ujrc2So1Ff+B3k796U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646136256, "uuid": "eb13ce68-e6b9-485a-8c3f-025548dbea51", "value": 982528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646136256, "uuid": "970f200a-c0dc-4b64-bbc9-8e814fc1b915", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646136256, "uuid": "f53f8bad-bb9e-449d-9f26-57109d2153a1", "value": "40c436f4ac5193735d05cfe2375d29449a90269a718fba9d7af179317688e2fb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a7e4902-9937-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646122463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646122463, "uuid": "c18323f2-cb73-4daa-b51f-341fe4da3f8b", "comment": "Malware payload", "value": "d7028d382df1859b6fd3b694f9283392", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646122463, "uuid": "097fd332-3f15-4974-9452-c3de900be339", "comment": "Malware payload", "value": "41289be9fbde5ede6e85978b73acff78532e6b5ce6af429fae337ffb708d5a08", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646122463, "uuid": "b2fe8b8b-3c86-47ed-ae8a-66763823d897", "comment": "Malware payload", "value": "830cd652bd1c04474fbdc397558f4277ff7a02d8", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646122463, "uuid": "5aca9fae-f7db-410c-b747-a533d59ea2a7", "comment": "Malware payload", "value": "036db22083dfccb8d6dd784adaa1f1213c4414f750bf12d7b364ebc58c70b5cb2103c0bb8aa64c67cde69668a0f26cdc", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646122463, "uuid": "a868be45-0cde-4384-be13-0e06b21aeb21", "value": "T13544D0D43369CB9BE96A1B388953F670463CBFE17C31C90BE45431DB1AB1D08E963926", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646122463, "uuid": "2e5d10c1-bfee-4e95-901f-80e4a247fcad", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646122463, "uuid": "e0e11992-bcdc-4ee8-9280-7bb5c0e26ac9", "value": "3072:9OjFM5edcFpar7OgJ8Pir+mO1+a4rZ33II+g9murvGU56Fw7+GN+UaGZPn7iHZ:0j+5edcze7B2RExTdvGU5UCb+GPnC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646122463, "uuid": "c0cf3f27-68b1-4305-afe3-73337505f2ff", "value": 256512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646122463, "uuid": "01f55db3-3aa1-495f-ad3a-0875d8a70265", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646122463, "uuid": "a025b5e9-c21d-4334-b024-961591719bf7", "value": "DHL_FORM.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60c57284-9941-11ec-9275-42010a9c0029", "comment": "Malware payload (NanoCore)", "timestamp": 1646126661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646126661, "uuid": "ed76b3a9-3d28-434c-bd2c-2d5169bf964d", "comment": "Malware payload (NanoCore)", "value": "3075c05eb24d9a7d9ae3f5ae116543f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646126661, "uuid": "9e507666-3a91-4a69-b624-989eba0d5b20", "comment": "Malware payload (NanoCore)", "value": "412a5c7de65dff76d5b535e5e1340b39b91a986877329196a2cb6b3b027ba2bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646126661, "uuid": "f8643ee8-be4d-4041-a279-523401ca49c1", "comment": "Malware payload (NanoCore)", "value": "40a3efa94a57ec9afd4020f9b3e0414cd9741f01", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646126661, "uuid": "d717ed34-9004-40b8-8e76-bce4851faa6f", "comment": "Malware payload (NanoCore)", "value": "435c1417bc3bc69b91000569aba13b5a9e711500ed19692de513c7217afb7cc1d926aeb88337cdc334f3d9a7bc0fdf96", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646126661, "uuid": "6291dee9-c657-4c19-8bc5-fa40677f43c7", "value": "T138721855ABEC4332E5B04F356C734B8106B4BF16BC22F61F6EA0B61E1FB36A45971221", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646126661, "uuid": "7f0d6b56-1c97-4217-bbee-d41db41d18ad", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646126661, "uuid": "0ae20157-3d55-4904-b1d4-12120f79efd4", "value": "192:3Co8p97CTy9gydzm/pD2HrxK74CB2uftllA5ziir3TkKH5KAWQwoua:Ij7COyy1UIHtABJa/Lwou", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646126661, "uuid": "8ae5e21f-ae50-450f-9e02-29029cb902ff", "value": 16384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646126661, "uuid": "4e4a9b12-bf59-4779-b444-421d300e40f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646126661, "uuid": "3484cd2b-ddce-4843-9cbc-0049df911fa9", "value": "Crude Oil Lifting Contract Offer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb5b6f6e-9932-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1646120371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120371, "uuid": "282fa910-7f4c-4a58-9636-a96840627e5b", "comment": "Malware payload (Loki)", "value": "cedbfa6b445127230d70eb867dacbb0b", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120371, "uuid": "2c5a5bf1-6ea8-4271-95c9-4c43e352439e", "comment": "Malware payload (Loki)", "value": "41adc266015fc564f8b6a06524162fbe667e811c008145321f09748fa901b4cf", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120371, "uuid": "503c3658-70ae-4b2a-b29f-3088e63793f1", "comment": "Malware payload (Loki)", "value": "e70faa7a80736a0a1a6dcad98fe3140321dfa273", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120371, "uuid": "eee345d8-c727-45b7-a270-2e618ad8bc31", "comment": "Malware payload (Loki)", "value": "46920cdc0504424a123579fb8f826be701067f5b57d6cd64839134ea0c82687443096896985f7da1e791faad0672554e", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120371, "uuid": "4a316ff9-606e-4d08-b051-699f93e53018", "value": "T13FD3AE227A51C915D96817360DE2C1F97B27BC416EFA43473591F76E2EB33E48C13A0A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120371, "uuid": "9d3613b5-f65e-4727-9e7b-b27bb2a3a29c", "value": "3072:6rxEtjPOtioVjDGUU1qfDlaGGx+cL2QnARG8yp/u3xHAn0e8wYW:8xEtjPOtioVjDGUU1qfDlavx+W2QnARy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646120371, "uuid": "714201a1-943e-464d-9044-4d51ba42db6a", "value": 137728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646120371, "uuid": "bfffd325-3a41-42a9-8eec-7d67f3abc729", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120371, "uuid": "cea45554-75bb-4c4a-866d-1a094740e953", "value": "Euro35000.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b524ea4-9986-11ec-9275-42010a9c0029", "comment": "Malware payload (NanoCore)", "timestamp": 1646156180, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646156180, "uuid": "8b0b8cea-9c04-4acd-b101-f0831902de15", "comment": "Malware payload (NanoCore)", "value": "f1b4d94174babe468853ccb747ce65cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646156180, "uuid": "75651dea-d2ec-4d4e-9e8d-bb8c1f3a976d", "comment": "Malware payload (NanoCore)", "value": "4204845a7f68623c31fa75489db5a908a22bff4777586e2316ff5136ddaf3ad1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646156180, "uuid": "5fba1f4a-9204-4745-af5f-37add522534c", "comment": "Malware payload (NanoCore)", "value": "1422c14a78735d58f0cd125f41d5d2b3bbabaf0e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646156180, "uuid": "c3e04352-b011-424b-ad05-3f0248fc406a", "comment": "Malware payload (NanoCore)", "value": "589860929b503b83fe15f8b41869f891c47c96615de3b514611f7125ec998c903adabc7198925ffe33bbc0719483e57a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646156180, "uuid": "f1020617-359f-41f2-a73c-3755bf5a9add", "value": "T1EB15AE4835D6207DE836CBB2CAC4EFE0DB6DF221D64960B654020E59860DBBD8E45EFD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646156180, "uuid": "6bc10444-4a83-47eb-b94c-65d15554e68c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646156180, "uuid": "7231b0fc-d684-4458-9195-aeb33249c0c2", "value": "12288:hYSN3pf/zukoGVVAQlDeZXIVPYcOULkFok8eTW7ztguuOm3KXxLJROGMGLFFGO4g:7ZyhGVVlDeZXIVPjpIFo6Tonm3yLn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646156180, "uuid": "8e50b7b8-21d7-4f94-9593-9af2cca83078", "value": 930304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646156180, "uuid": "29f3451c-5d68-46e9-bdf1-bf2c76a2ca2d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646156180, "uuid": "9d9b7395-0be5-4eb4-8247-f87db54d596f", "value": "TNT AWB TRACKING DETAILS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "204ac4c5-995f-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1646139438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646139438, "uuid": "a26fd63f-1454-4725-9a8d-a0f2c5195784", "comment": "Malware payload (Loki)", "value": "be819e6066417b928b2e8c5b60e210ba", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646139438, "uuid": "023bf575-9c43-40a5-892c-50a79d5c7ac0", "comment": "Malware payload (Loki)", "value": "42981776a53c0b27a6fd4b0922c9d458bce23c81b382406dc8bfee53ccd9ed79", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646139438, "uuid": "875861dd-27cb-4d55-8881-3da8ff75d693", "comment": "Malware payload (Loki)", "value": "20de44614e48f114a5880af86f0215c1ebb80a03", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646139438, "uuid": "59c82a7c-cde1-4e71-a049-fccf24f6f037", "comment": "Malware payload (Loki)", "value": "6cf1f0e6fcc3f4831b93c9eeb2ef794f6e6c9016b17feb175c202c18e499ab03e3edf0e3c588148d5f39f8666865dfd4", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646139438, "uuid": "be4f9f67-1c05-42f2-8041-8d5829cd57fd", "value": "T11D0412479012F871C96269BCC5279015E284BA0CE475C01DA674A3FFBBE96CF5F93B88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646139438, "uuid": "802e44b7-f17d-453b-8f23-c080975c2676", "value": "3072:gTFnfM3jQ29jH2tYiUiL4z3o5q1mTBjRDyEwQvqmLGaQutBguM/xSVFW6h+g1n/U:gTloDNMRUiLqx1gBjR1QaBI9/2x1ngMA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646139438, "uuid": "200a959d-1e16-4db2-b387-2519d74709fd", "value": 183997, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646139438, "uuid": "2b097f2e-b0d6-4ec7-8a90-878f22651871", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646139438, "uuid": "6323d481-194a-4119-9da0-fd9f2297d542", "value": "REMITTANCE_ADVICE_REF0000360261.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ef13f00-9939-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646123142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646123142, "uuid": "4cfa58b2-51cf-487c-b351-fbdb963c4d5e", "comment": "Malware payload (Formbook)", "value": "182e201c76b5008e2e53d00f203a99a5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646123142, "uuid": "33755cc3-1a6e-47f1-834f-c3086de89ecd", "comment": "Malware payload (Formbook)", "value": "4362e65d6f2a5101b1f93ff87e77f0323dc58a87b4034fb2fa23fc876742b2cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646123142, "uuid": "54498dee-f16e-46c4-8382-984aa9fbf4ed", "comment": "Malware payload (Formbook)", "value": "468bd0cbb653edbad2e17e8df012b82ff96ca269", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646123142, "uuid": "55eeb011-9c13-4eca-929a-4e2322da0f27", "comment": "Malware payload (Formbook)", "value": "6ad5b90a8605c5be45d07a747aac66efacd85cfcfc245cf815555898ca94edf7434cad0f3be1aacba2a8765000a6c025", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646123142, "uuid": "d63c688e-711f-4d51-b317-b47918571bb0", "value": "T14025E01467F98538F2F79F74BAB649128BB7BD175D31D21E098420AE0A32B10D970BB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646123142, "uuid": "c9a40e46-8634-4f37-b836-9ad6afbc3f21", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646123142, "uuid": "069765de-d13c-4e8f-b3d6-357d542a41de", "value": "24576:p/yiUR90LHEacUFByE3Su8irv9dzBWUMHvgT8mjZYbCL:ByiUR90LkPihLRYHvwqbC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646123142, "uuid": "634c4b62-fb4d-473b-aa1f-e27cc80b4b4b", "value": 967168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646123142, "uuid": "cf83ed97-5138-4f7f-a526-3cda77b13747", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646123142, "uuid": "350d1364-5709-4b5a-9fea-ca9fba588454", "value": "182e201c76b5008e2e53d00f203a99a5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee645150-9902-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1646099841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646099841, "uuid": "a8c75fc3-8c0e-4079-8fe1-88ae9eb591a6", "comment": "Malware payload (RedLineStealer)", "value": "96d2e62308f7e28c24d541a928d78fc4", "object_relation": "md5", "Tag": [ { "name": "crypto", "colour": "#A84A07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646099841, "uuid": "9889126f-a559-42ad-88bb-29dd37d650e2", "comment": "Malware payload (RedLineStealer)", "value": "43af6cbdb4759c2ec4be6716793ea601c72e81b8914aeae414fa398cd425b7c4", "object_relation": "sha256", "Tag": [ { "name": "crypto", "colour": "#A84A07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646099841, "uuid": "2b8b8d1b-59af-405a-a113-f482996d9713", "comment": "Malware payload (RedLineStealer)", "value": "7ac7a0351dfa996102fe08a12cc29e6e0692449a", "object_relation": "sha1", "Tag": [ { "name": "crypto", "colour": "#A84A07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646099841, "uuid": "5fec2166-494c-4f40-b77a-704e8e74e157", "comment": "Malware payload (RedLineStealer)", "value": "2f740923821b47d39482f789a55f0cba97639f457953657ad3478e0a076cb9f83ce36b83c35c478177d179b9ab82b1f3", "object_relation": "sha3-384", "Tag": [ { "name": "crypto", "colour": "#A84A07", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646099841, "uuid": "af798ed3-7655-414d-aefc-04f74317292d", "value": "T18C1633B701E8619CE45624B42BAA5FC00E715F4E46E6A5EFF6050F6BC0A13F2E2345AD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646099841, "uuid": "6bd943c2-93fa-4180-a8d3-ad67175db262", "value": "445554923421947cbff896012e27345a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646099841, "uuid": "22052312-cf18-4d4a-8563-f0ca5bfc6493", "value": "98304:f5yeCS5mKQhc0C4yFm0yDOPMDG0FbC3lQIXPIWXliq:7qi09yFOdtm3Vf5J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646099841, "uuid": "28c9110f-fa0a-4577-9608-22bebc205e21", "value": 4066760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646099841, "uuid": "76499209-2675-4adf-82d4-513b2de2e3b8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646099841, "uuid": "f2adaff2-9df5-4f26-aa47-f56181a4cfa6", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b2630b9-9944-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1646128021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646128021, "uuid": "94bf032d-0c81-4c8c-af3d-de24057334b1", "comment": "Malware payload (Loki)", "value": "ec7ceb99aab334f9985510641789c0ff", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646128021, "uuid": "03a0e460-e29d-433e-ac5f-affb4e6941c6", "comment": "Malware payload (Loki)", "value": "444196dce9e22f023f1c442ed5e12947984890331700ab2339e177796546af6a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646128021, "uuid": "cfe5a265-0e61-418d-b4b5-3e38e6ff59d7", "comment": "Malware payload (Loki)", "value": "db38db9a320a3dd4c5fca94d1760eface70269a7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646128021, "uuid": "75190da8-a323-4b77-a614-33d2b19149fa", "comment": "Malware payload (Loki)", "value": "fcaae953df9b7b30e53daecb7552115d994d8cfc44924cc200ed559156b0a08f441b658201ff7c85f64dd4fcd62f1e14", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646128021, "uuid": "5e21467f-6933-40bf-96cd-ff9eb327dd97", "value": "T1DB6423A839801977F4915AB15FB6E4B9A3BFE2BE6C500C1F6F700F2E2D1B587042E165", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646128021, "uuid": "7ee91267-3be9-418b-a6b0-705894b1f7a4", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646128021, "uuid": "8268a5b7-e612-4764-932d-52b128e026a1", "value": "6144:rGidJYmtf4MYZdLKUYO6qukk69T5pqZxejVu1lhKFN4ohXCShf+nnx46:wmtovJT67kl9Tuy8vmNZXD+nnx46", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646128021, "uuid": "f3bddf38-80c9-4395-96c3-66651eff8898", "value": 311462, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646128021, "uuid": "3c880394-5887-4140-84ca-944e94677865", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646128021, "uuid": "3f3e905b-4e10-4b4e-94a8-da1cf5afd3e6", "value": "ec7ceb99aab334f9985510641789c0ff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6307e78e-993a-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646123659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646123659, "uuid": "15100987-4423-4bd8-9b42-b375336b7a19", "comment": "Malware payload (Formbook)", "value": "9305a502a9989f1d7b68fb8cf0e14f60", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646123659, "uuid": "d5d147e9-403f-4ca0-a30d-d963496cd6f4", "comment": "Malware payload (Formbook)", "value": "44636c052353f293bd3302cb0844e7e3add7a2e929a63e6ccdafb6992eaa3e99", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646123659, "uuid": "dbb7692a-bab5-42db-868c-e0fd36bb8d7d", "comment": "Malware payload (Formbook)", "value": "9e066a8e4e96dc48e12737c0a998bd708bb21713", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646123659, "uuid": "45b59d89-2c1f-42a1-9732-c1dda42ca332", "comment": "Malware payload (Formbook)", "value": "e71e8e9e715438170ba71d13b5f7f9d010ed28e9d587be2b30607c959a83c160ddb96ee441f5ae40d5207737d527cb60", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646123659, "uuid": "e678c899-9000-4352-8e7a-4cc933d37b1f", "value": "T198F4AE0438E65038F93A8BF1CAC0EBF1DB6EF221D44971F964000E559A45BBD895AEFD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646123659, "uuid": "f8f979a4-e737-4d2c-880c-0036187ae148", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646123659, "uuid": "cd4f875f-a47e-4174-b89b-2a403697bc68", "value": "12288:fEbOR/IHyGinQqCIhB0YjBZ9SI7Ki4+EKPnyThg3BVXCVgmoRjK2:ATd5YjH9ZvYhg3BZ0aK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646123659, "uuid": "b1dac3b9-06a8-4357-b6d2-2babf8d80941", "value": 773632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646123659, "uuid": "0d5fcd32-3642-483f-a343-fb4c64918a57", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646123659, "uuid": "e3d942c9-5f16-48d5-80a5-224c35f8a2f8", "value": "RFQ-Bid supporting Documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9340c88f-998f-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646160247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646160247, "uuid": "0860a4e9-5360-470f-a949-e66ad25f03b2", "comment": "Malware payload (AgentTesla)", "value": "1c0aaf7a27c6a5b703e94ea4217a56c2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646160247, "uuid": "cef7910a-b6a4-4b7e-ac13-2b72b1bd7a10", "comment": "Malware payload (AgentTesla)", "value": "453222ff6b7ba97875ec5dc0a8b5de85e71872781dd356a633d7886482fab2a7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646160247, "uuid": "719c9ad5-5900-45a5-a54b-0df405bde601", "comment": "Malware payload (AgentTesla)", "value": "0511b06c661247e09040bda8132297f066ba18f6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646160247, "uuid": "cbc6cad0-7775-480b-875c-e54a6a9aad60", "comment": "Malware payload (AgentTesla)", "value": "121cc3a6b0590e66f140b24a963a503f2465af338e9aa03909f27986aef96984a4eee5bc60bae465c86077c703f346f6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646160247, "uuid": "0eb58a50-f57f-4aa6-8d4d-e5cf526f803e", "value": "T1A305BF1839E65039F83A8BE1DAC0FBF19B6EF231E58870F558000E559605BBC8959EFD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646160247, "uuid": "70e1577e-37e8-4a8f-b05e-2d9a3e140dd4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646160247, "uuid": "f26834c7-425c-443a-ac9a-89f6d38442c4", "value": "12288:MEewR/I+US4n62Soyh2hzVGHZWxLpLR/Yv5q8+n2+yjHg7fxJ1:ESgrSo7pGHYx9LR/RN2VUpJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646160247, "uuid": "f51abef9-c9e1-4dd1-9aa2-21e44bf25d5d", "value": 820224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646160247, "uuid": "ec3ebab1-e756-488a-b459-21a98064a217", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646160247, "uuid": "d6b45742-161e-4308-ba6b-2e87d371bc4f", "value": "SWIFT transfer copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9192944a-9991-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646161103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646161103, "uuid": "e1f28f51-dcd2-4c5c-8343-066786cc21a5", "comment": "Malware payload (AgentTesla)", "value": "b3c753827da2442e76c25168939765ae", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646161103, "uuid": "653bc166-58c5-4a5f-b678-72d1f6f1fb4a", "comment": "Malware payload (AgentTesla)", "value": "45d8ade4dbb0b7a454081ab4813377e96c0b19cb415f27bb4c3514d361079759", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646161103, "uuid": "5f755586-d591-4ce1-95bd-00cbc158005c", "comment": "Malware payload (AgentTesla)", "value": "02c2a7103d805447c3f01200d3c290f54e8c340a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646161103, "uuid": "3fce6caa-3cd9-4e40-8947-43167266b56c", "comment": "Malware payload (AgentTesla)", "value": "59451dd5117193a631cb6117130b26aa62fab3b8b55c27cdd4cf45e882e312e5960cd7bd868c414ac0714bf92269332d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646161103, "uuid": "a7c078e7-728b-47b8-b80d-6fe61b963eaa", "value": "T1E915BF4835D2607DE836CBB2CAC4EFE0DB2AF272D54960B650020E19564DBBD8E45EFD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646161103, "uuid": "fadd637f-3202-4ecd-9cbd-e67fbe22ba86", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646161103, "uuid": "46b857b2-4fc2-401d-bac5-aaf96fc9f73c", "value": "12288:5zvdomFHxkzkozcFOm4/Ad+pZKLM+A+f1fP7m0+0cGF7PVADPR0OHTgI1+Aim72w:XoEHuzxAd0UL/A+5j20UTgINi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646161103, "uuid": "5e98d023-5023-45c1-a1bd-30ea1e01fab5", "value": 935936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646161103, "uuid": "a8d2ba3f-a612-4d26-9245-5059eff8b0f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646161103, "uuid": "efaebad5-c6cd-404b-884a-b1770df7f321", "value": "b3c753827da2442e76c25168939765ae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53d3ea7f-992a-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646116761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646116761, "uuid": "fe830f8a-57d6-4496-801a-da51fa28200e", "comment": "Malware payload (Heodo)", "value": "a4e7a2f9b920d0d859d4c8617b2f5865", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646116761, "uuid": "4c86a645-c26b-44be-9a42-47c0b9646d68", "comment": "Malware payload (Heodo)", "value": "4609c789b8aaf2309c25a27ef91d7df56895085a4494ad7f6b8eb24b5fecbab0", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646116761, "uuid": "caaa65e8-60d5-4b76-89ba-090082e7ee5e", "comment": "Malware payload (Heodo)", "value": "14ab8b83fad91102721656ab79893cf74707fa02", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646116761, "uuid": "bdec1531-ada1-44d5-954b-7a792f5826f8", "comment": "Malware payload (Heodo)", "value": "9eeb9860d2b1d1f2eed58350eef9ab65dff17ab7ed4f9e6270edd06250ef24f125e13c4d4fceea9a53c2e49ffc24d887", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646116761, "uuid": "07e939ec-7d15-4636-8536-ecf041075495", "value": "T18163AE3E57357A2ED6CFAC75C0324BD2832B2346E0AB9569B450F5CB1E732A22B45C5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646116761, "uuid": "d94c6ea0-ce2e-4ed3-8079-7d523352d8ee", "value": "1536:tyBvEXHLWhxndhjh/VwBpSZobSex7jB0FfuZibVkq:q6rWhxHjh88ZoH7juFuZi6q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646116761, "uuid": "13a56adf-b7ca-451a-8112-774a42eeb3e5", "value": 71522, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646116761, "uuid": "277110e1-15ab-4101-9473-3f0f09a0dd1a", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646116761, "uuid": "a3b469b8-593f-4fee-8064-fb6623acc143", "value": "591088564718712.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b161873-994e-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646132316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646132316, "uuid": "f9b6ea92-e5e6-407d-b1ca-ee48f931bdfe", "comment": "Malware payload (Heodo)", "value": "edf57b0bf05feea2df19020bd6766978", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646132316, "uuid": "220e5672-3e6d-4f3a-8e6c-9197625a9143", "comment": "Malware payload (Heodo)", "value": "461eb4b1c0810c43a9d096fa3cbd3441c918ca5cf0e455d07c436c3c7a2b2cbc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646132316, "uuid": "bb0ca1fd-d8c1-44ab-8f51-c47282c681cd", "comment": "Malware payload (Heodo)", "value": "e36a4f668134d0a4d5a526082775c12d5f7cad50", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646132316, "uuid": "76b4a4b7-5f1d-41c3-ad2b-4405054b49a5", "comment": "Malware payload (Heodo)", "value": "bd50a67f1ec8b8d12c69083c2366c4b3fe3e5f4d080b1484666a2223548f3879ff779c9c173238c572b6c3ded73886f0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646132316, "uuid": "b151f5e1-ec13-4ed8-a7ab-3679ad8890fc", "value": "T1ACC4AF12BFD39072CE2F293C503DA77413A95C65971A8863979C9BBE1D3F9428B3190E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646132316, "uuid": "977a2494-d35a-4b22-b458-bdcbf82430dd", "value": "e0b213ccd96f46d30dcd8e225f4e9fc9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646132316, "uuid": "bb7f2d44-80b4-4e49-a922-d5bcd004816e", "value": "12288:onEtDywy8SYlHD70WychG0QOCM8T9xvCFyDyPgyQz/VDNeg:onEtDywy8SYdnhG0QrM8hxKF7a1Ne", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646132316, "uuid": "1e04737b-09bd-4bc0-9a8b-269527a9d222", "value": 585728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646132316, "uuid": "5625dd3c-0583-4786-aa22-6e872e1788b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646132316, "uuid": "c1752344-4c5e-4b6d-b95c-3f5e7aeee66f", "value": "edf57b0bf05feea2df19020bd6766978", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f4fbd52-9931-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1646119733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646119733, "uuid": "c991fbf4-1bfe-4ce1-bcb2-fb41b54d9551", "comment": "Malware payload (SnakeKeylogger)", "value": "cde1af317f16459f6cc2be6451ca63e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646119733, "uuid": "f1c930b5-c5dd-4e4f-83a8-83dcea08a4a6", "comment": "Malware payload (SnakeKeylogger)", "value": "480da47d8efb77dfebdd9efd48ae3c3adc9a632a26532d5b090513b5fbfaaf18", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646119733, "uuid": "3f1e0d47-e163-4ce6-b867-c1b9a3285c9b", "comment": "Malware payload (SnakeKeylogger)", "value": "d91475bc9985a36b2325200ed56b5e11fea3811e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646119733, "uuid": "f8fde0bc-c04d-4257-a914-3c10d1d89594", "comment": "Malware payload (SnakeKeylogger)", "value": "bf8b98d24e3d6c9e903a1166786b57c24daba919b623eb6029ce305b839e785e2900d2d6fb7b0d71e9f4155ce412dc57", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646119733, "uuid": "b3d550fa-7537-4a93-a69a-f600548df812", "value": "T1AAF4AF5434EA4038F8368BB1CAD4E7F19B6DFE21E48960B554003E177635BBC894AEBD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646119733, "uuid": "f3e80f93-77ea-493d-b280-0e11260aaba0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646119733, "uuid": "dc093472-1c50-46d6-a95b-25b791432ed0", "value": "12288:pEvnR/ICJqXpj9coqIas7nCPikyS4A0vom6g04XdswpbmvMUbkNaGeTMS:UJq5j9vnvGzlCtswcJkNaGQF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646119733, "uuid": "0a9da394-3d49-4603-beab-2d80ec00e8b8", "value": 736256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646119733, "uuid": "706e9fca-535c-4889-ab82-f142b8ab6f4c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646119733, "uuid": "c39a0fed-ed87-47dc-9524-eafbae911e98", "value": "Order_TN21635.jpg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18623ce1-991f-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646111937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646111937, "uuid": "b3796221-95e2-4f4a-92b6-6d7679e0069b", "comment": "Malware payload (AgentTesla)", "value": "e3e161dfdc5f47d63714a77639794319", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646111937, "uuid": "39caa313-a4be-41d5-a5ea-2d094e110ffa", "comment": "Malware payload (AgentTesla)", "value": "482402f41bbd029731d340e8540a8c0731b97383ce641dbccbb7ed6549a4822b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646111937, "uuid": "39cda415-74f2-426b-bd8a-1b6425333c71", "comment": "Malware payload (AgentTesla)", "value": "3af412ab2fba9ee74afd377f557295eb61ef8040", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646111937, "uuid": "d9dbf57b-caaa-4122-a0de-66a5ac42b5ff", "comment": "Malware payload (AgentTesla)", "value": "0cca228c54b06180b2cb8a67974dc926b647014e34830fc88ae9cee4c8191c3be1bf021255ce5ab494a4416fddf2a029", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646111937, "uuid": "e4106442-4e4e-4de2-b75a-e3bb3983ca72", "value": "T195141255A226BAC2E0DE73350C35D9223375FD3997CA8AA162B4335F43FD4E24A0213B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646111937, "uuid": "e1655b7d-9cc3-42ec-b274-7377443f991f", "value": "3072:KF8AXLoyh4Can4bd6YDycD2lxEN5X7mIwTLyzcZigPR+3UCNzfK4sdDi:lAXcyh4CamRT2lxEN5NwTmzOR+3UCN+s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646111937, "uuid": "2ac130ed-2b14-4d8e-b10f-c113fb24e7b1", "value": 191288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646111937, "uuid": "d765783c-1476-47bf-ac13-5018b6953cd0", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646111937, "uuid": "be3bb2dd-1e16-43a0-a6dd-121f4ccababb", "value": "PO-27099788_20220118152009.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41f0d396-993a-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646123603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646123603, "uuid": "00d54842-2df6-4123-a5b4-e3b64f0c7202", "comment": "Malware payload (Heodo)", "value": "11cc402177b5211336eb6c8dfbc344f3", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646123603, "uuid": "0f462bf1-8f21-482f-b085-58d397b8ad1b", "comment": "Malware payload (Heodo)", "value": "486c4ace28ffb4b0656de73323cf0ab4702bb52406726c6567a97540366f8e4d", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646123603, "uuid": "82d84d3d-87b5-49dc-9d7a-db926000d303", "comment": "Malware payload (Heodo)", "value": "eac3ce7033788543d4db1a2ca2eef135a0988287", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646123603, "uuid": "602de6e7-679d-45cb-afb3-60810fb33e29", "comment": "Malware payload (Heodo)", "value": "dd7463be977d059adca2e0294ecf3edb3660787912ca5b776fab92670c5133acc49a1add4f01069b2a394c42a882a48c", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646123603, "uuid": "5a500c93-a671-4e2e-90dc-0d57da3ed6ee", "value": "T11913D019C4665ADDC327693DD6149AF4120C0E0A89A1FA9F1C54B39C2B6A1F70B5FCF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646123603, "uuid": "609f05da-d9e0-4698-b9b3-833e7d5c0dbb", "value": "768:a/omdH+DOevZCwttqyKfcrND59V+L9Rw4eWrXcTqZ0VP2HLp:2omdH+DoylND59V4jwmXc2CVCF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646123603, "uuid": "77bdccb2-2cf9-4ba7-bc00-143274ed10d4", "value": 41827, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646123603, "uuid": "90822679-12af-4815-8abc-2151c76f025e", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646123603, "uuid": "f49c03c7-76c9-480d-8b77-68522479c575", "value": "20220301_605021_004.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ea1b0fe-9941-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646126738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646126738, "uuid": "941a63e9-7013-4049-90bb-3e167a9ff4be", "comment": "Malware payload (Formbook)", "value": "8af256b6e67e9beacf9449529f45d83d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646126738, "uuid": "f57a429b-7e3b-4879-b690-b116e8065fa0", "comment": "Malware payload (Formbook)", "value": "487abe718971e8c9415793ffe0c162a4843aeeb5d4667981bb0be983f7710f4e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646126738, "uuid": "d9858161-6bee-4d65-bc1b-3982be7e31d4", "comment": "Malware payload (Formbook)", "value": "a27cacea537fd0e9c0e0a0013ce43844ae0177d3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646126738, "uuid": "3e2c88c5-d2b1-49b6-8ffa-2cfa15996092", "comment": "Malware payload (Formbook)", "value": "cb23698de363124f02209bc849d6a168671f32ff5666826fecd43c0dc78e3d728e7c6d9ea28ce4eb27f647ad2a94a416", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646126738, "uuid": "8348e348-a842-4f19-b5b0-cf3baffbfd7a", "value": "T142642257ACC555B3E4318238987BA37BF6FB9BFA01032A5B0798A8553E115D3D72E0C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646126738, "uuid": "154019e7-190c-406b-ba03-201049eb5686", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646126738, "uuid": "d2377d7e-f523-48a6-afa4-34ad70734682", "value": "6144:rGi7vD00u0BN0GHWt0Njbl6TNN6HBQ75GUZwqVH9DOvvZTBpDpWFxaBEfQd:/D00u0UU40BJ6TeBQlGUZFchbpo4Jd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646126738, "uuid": "e86f628f-bccb-4c0e-9bbd-f563ad3ccb8f", "value": 313836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646126738, "uuid": "4efaa807-a21d-4518-b396-6f5dc4cdc181", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646126738, "uuid": "b3066249-842b-4c40-9613-ce63386b57ce", "value": "8af256b6e67e9beacf9449529f45d83d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2c79368-9944-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646128168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646128168, "uuid": "a2eedd7b-52e2-4c9f-9bae-fc8a02c79156", "comment": "Malware payload (Formbook)", "value": "860dbd83bbaa44e7d790c54effdf1d25", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646128168, "uuid": "680d2486-c1e9-4ed5-91de-d0f7629c0c56", "comment": "Malware payload (Formbook)", "value": "492134acbc33aa2f1d4f14c50d18820ea5c8ade3bc08fc8abfb05d4eda873d10", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646128168, "uuid": "9a67c25d-dbd8-4353-8533-b76bef781627", "comment": "Malware payload (Formbook)", "value": "3cbc797877c619609f54f139a24cf15cd40411dc", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646128168, "uuid": "5f23e736-e61d-484d-aaa3-28b5545e3417", "comment": "Malware payload (Formbook)", "value": "30fa8d25ae71468e63eef69ecd7b1058d019c196fb7944e6c6669eeafad0b5af5dd37ef49c7fd5e21b9c5684935327e8", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646128168, "uuid": "9c2d6618-784c-4058-9973-9dfbd7a00ef3", "value": "T1449423F34936F24EE76B5F6034DC661BDE527153A3F4D2C740AAF0E0AC606E76842949", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646128168, "uuid": "09db086c-852b-4e7b-b427-c320e867549c", "value": "6144:ORD/8SJb59fmtkIyN5k0HzmwAu6Moe/K9qnM7RpAz+1MMOaqi8zZCs1Af11AKF:ORb8UnMeNC0qwuMS9RQgnOaqiAGf33F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646128168, "uuid": "7616e58f-1579-4633-9875-3905f86aa650", "value": 445028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646128168, "uuid": "457961ca-70f1-4d26-9020-8bd64147bc98", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646128168, "uuid": "6b5cb087-439e-4bc5-9b1b-6d8fde27c2d7", "value": "scanned custom declaration.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5124f82e-995e-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646139090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646139090, "uuid": "524b85ec-4c97-45e1-a209-45ad9ed3b150", "comment": "Malware payload (AgentTesla)", "value": "b80e774d97cbb0ec47d18d02ef585ec8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646139090, "uuid": "2d077347-c2f8-4805-9369-5bf747059ea6", "comment": "Malware payload (AgentTesla)", "value": "494d57326f76c2a12b4406117b60cae167d0fafd6b42efb9509d8a74543808b7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646139090, "uuid": "c135d4cc-eba6-41a7-bf00-6d42cd0c3ff5", "comment": "Malware payload (AgentTesla)", "value": "ba3a27d981c44589f6d069023a25aa991ae49372", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646139090, "uuid": "2173845a-6b33-4ae3-ad4b-74644b25ea49", "comment": "Malware payload (AgentTesla)", "value": "4cb920792851a04dd5ea9068b13647bbc9889b6aaf8e1a1c49d1a12a43922b11066e8023ef06141d2f3ec199f286df86", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646139090, "uuid": "05932dc0-5755-4c27-b66a-4928984b817c", "value": "T1A1053392FC21E95C779C80126C5C72DD40FB381DDE7C5AAE749C224E96E50929C8E37E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646139090, "uuid": "3c5191cd-27d4-46ab-a755-ed649abd235e", "value": "12288:Xm7BJhRIOX1DroDSe6nx4kY4pkfy07yj3FN4HUlOD0eTqTuTZ:2VrRrGSeSB6fy3MweeW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646139090, "uuid": "89fb48ba-04cf-46ee-ad9d-de5cef303c35", "value": 849602, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646139090, "uuid": "8ba4723e-9ce9-4b5a-819d-a65184822aaa", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646139090, "uuid": "bc092108-0a34-4a0b-ad6a-20f6603be139", "value": "AL0222035CGPSIN.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b257102-9933-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646120558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120558, "uuid": "2631b37c-e95f-4937-a6fd-3d2485e11528", "comment": "Malware payload (Formbook)", "value": "987787c44f374fb596be98597a69b7d8", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120558, "uuid": "eb5a86e2-9d3a-47c1-9d34-141cffdcf70c", "comment": "Malware payload (Formbook)", "value": "494e7da263d8156b8f764cd9bffcc86113ce12579b656a1ffad5c17a3360e385", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120558, "uuid": "b1308baf-38a6-479a-bf1e-bd3305555170", "comment": "Malware payload (Formbook)", "value": "95ec74de5ec4bef4acc66c71f347755aa311cc41", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120558, "uuid": "2276fd22-d460-4e5e-8dac-3b0b7f9e0c28", "comment": "Malware payload (Formbook)", "value": "e1a57b8957d39c9c1a6dd85c59766569f302a9846e16cad9bbc1f0c06f5af50bdcac65a8f5f3412dd13ed63cfc3274ae", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120558, "uuid": "ce6f21d9-c06c-488c-904d-493ef598ed92", "value": "T134141287BF2509F4CA6BA4F80C4ACC1135B9FF763F5516A0ED207E7989729EC944D242", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120558, "uuid": "66807bb3-bff9-4ea1-ad50-ad51ac0f3e56", "value": "3072:VDq34SKh4nOBo6yjxwEFNE5FedkliZw7Ij/Lb0762C2JbQlD+YS1R+4rg4AzyaGU:Jq34v2cob7kX7OTQ+2CnlD+Nk8g7eidj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646120558, "uuid": "ea0ae46a-67f2-4966-8e9c-c9a920e60150", "value": 191336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646120558, "uuid": "bda3be25-05c2-475f-87a8-6833781f1ec4", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120558, "uuid": "02b7efae-4214-4323-819b-49aef284a96e", "value": "Transfer Scan Copy 8748390.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75f9bbe7-9958-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646136575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646136575, "uuid": "dffa6990-9c17-4f90-b293-727ce20aebc5", "comment": "Malware payload", "value": "62c18d61ed324088f963510bae43b831", "object_relation": "md5", "Tag": [ { "name": "Daxin", "colour": "#652B35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646136575, "uuid": "27345ac9-08d3-42bf-be8d-d32e5a67c38c", "comment": "Malware payload", "value": "49c827cf48efb122a9d6fd87b426482b7496ccd4a2dbca31ebbf6b2b80c98530", "object_relation": "sha256", "Tag": [ { "name": "Daxin", "colour": "#652B35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646136575, "uuid": "d47984fc-1a9e-47c0-9d74-f91e6c038584", "comment": "Malware payload", "value": "8302802b709ad242a81b939b6c90b3230e1a1f1e", "object_relation": "sha1", "Tag": [ { "name": "Daxin", "colour": "#652B35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646136575, "uuid": "47cf9abb-a643-4360-9fb0-f238de95fa49", "comment": "Malware payload", "value": "e9220163ec79269b890ad58983ee18b901d93f73c1d59dd96dfdd47de5068dd3ca6d03cfd9d37e048194130754b69638", "object_relation": "sha3-384", "Tag": [ { "name": "Daxin", "colour": "#652B35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646136575, "uuid": "a6fb2301-13ae-4ba2-8061-df9410c07ba8", "value": "T119534AC6996910B9D8FAC27AC692577FCFB27041531416CF81A146862F13BF4B73D329", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646136575, "uuid": "50d14a50-c36d-4b5c-aeb6-8b78d7918919", "value": "4b47f6031c558106eee17655f8f8a32f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646136575, "uuid": "ba7cce06-36c6-4202-8a27-ab38838bba5d", "value": "768:S1l1z3gUgbjth0lC02LYYS4eUnS8nBzpX+NW7aNTfHskVgeKF35uYC9DEVIY9JOW:ig8N2cCtLZES2JEBSj6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646136575, "uuid": "b055bb46-5b4b-425e-9a66-008e6ea3f6bd", "value": 60664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646136575, "uuid": "1b5cdb56-8ae1-465c-bc1f-4182706b8988", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646136575, "uuid": "bb2de17b-5ca1-4f1e-943d-7323c617f513", "value": "49c827cf48efb122a9d6fd87b426482b7496ccd4a2dbca31ebbf6b2b80c98530", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4342e2a9-9987-11ec-9275-42010a9c0029", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1646156676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646156676, "uuid": "fe8b374a-1196-4ae2-a4b7-842f0a257999", "comment": "Malware payload (ArkeiStealer)", "value": "451b7c5d3b5d5f98373f2c3173e57888", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646156676, "uuid": "7fa06c25-f261-48de-a6d2-edca3bcad066", "comment": "Malware payload (ArkeiStealer)", "value": "4a42f030077cc14c898f88ebe62b8ace05df6bb0c4f610a4d7d3c0610f464bc6", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646156676, "uuid": "3b86b33d-c525-4866-a54d-76b0ca035992", "comment": "Malware payload (ArkeiStealer)", "value": "33c3a03074c6d900b8abf7edf0b19bc718d3e0d3", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646156676, "uuid": "bd87cfa1-e5d5-480e-b02e-37b5e6603963", "comment": "Malware payload (ArkeiStealer)", "value": "ad08469a0d757ea35e8e8cb44c87361f9fe2cbb6f3a5d21dc87a5aca774284dcbeda622551da75316c562df7b30820f1", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646156676, "uuid": "eb55d768-c611-4758-ad9f-8b29ffd7a566", "value": "T1F774AF10BB90C035F1B716F849BAD3ACB53E7AA15B2455CB62D51AEE07396E0EC3131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646156676, "uuid": "c454260f-e074-4d07-9ffe-c931e2072a0c", "value": "803999de15851b525de7455d6fbe3205", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646156676, "uuid": "a4d5526e-7f16-4b24-bb5b-1801e3ff13ba", "value": "6144:Aqs7H3v8SNug6YUmLQbzkApWJZDTfYJDSe/5LXxg:tsLBNug6YDizkCGZDuDSeXg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646156676, "uuid": "a6d0b75b-08b1-4562-ae6b-2e0f0f6f8c80", "value": 345088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646156676, "uuid": "4d9c5d54-047b-45bb-a663-5c0a349be67e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646156676, "uuid": "6a7c1227-6f65-4330-a5e7-9bdbe2788c09", "value": "451b7c5d3b5d5f98373f2c3173e57888.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd1621cf-992c-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646117904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646117904, "uuid": "606ab5de-942f-4d16-81ab-7b75f775a3f9", "comment": "Malware payload", "value": "e27ecef652002ee4d6d971f5541a7025", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646117904, "uuid": "8a0a04c1-9a18-402e-a09b-a0fdc87f3cec", "comment": "Malware payload", "value": "4ad3c49ec5e3297e711734de6b3006b43f61c77cc701cf56f52df179454b0d52", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646117904, "uuid": "07abfdfa-4163-470f-bc0a-73285b5f3e2b", "comment": "Malware payload", "value": "908ef47051d448668ef9a62f27592c02728cf29f", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646117904, "uuid": "4d8a4ae3-74b5-4381-84ee-0b73f7cca929", "comment": "Malware payload", "value": "5b8aa9d4009c58040b50fa8effb38b9ffe16f406659efcbe2a5375a1551607869d764e9ae72a90048dc885f7b8db11d7", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646117904, "uuid": "30790b2a-4c2e-4e3f-ba63-7ccb8dbc14df", "value": "T1BF900225350B8002C7412AA57847AE53141E415D5903660A40B261854001616011E2C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646117904, "uuid": "87f06033-7b22-426f-8a39-d1369c20dc0b", "value": "3:XHPXoh/c07Ijgisn3kFtPn:Xv2E0Egn3kbPn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646117904, "uuid": "ec61f37a-6d2a-4b62-8ffb-3e60ae99bd91", "value": 53, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646117904, "uuid": "5cd2d3ab-e587-40d3-a70e-33b1be716877", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646117904, "uuid": "6a63ab95-08da-48e3-874e-c5e4bd9bef3a", "value": "price list.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1952bbc5-994f-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646132554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646132554, "uuid": "f6ef2793-6723-4ddf-a197-c05a88f11f29", "comment": "Malware payload (AgentTesla)", "value": "f2de420077cde36bee1fcc5d54e28766", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646132554, "uuid": "0570d1f8-a914-4c64-b7bb-04f7b83080f4", "comment": "Malware payload (AgentTesla)", "value": "4afbafb0c40ccdc0709fe9a6b2cfb67bd0b242e781f13b08da287c9ac163d9d9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646132554, "uuid": "e810c67c-ec99-44db-bb50-843202ace6ca", "comment": "Malware payload (AgentTesla)", "value": "eace4efe17e77c2846f43039dc0064a74a492f45", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646132554, "uuid": "a2d59bb2-9433-451f-94ea-ca488786d89e", "comment": "Malware payload (AgentTesla)", "value": "c36863136d361f5897301829d1b1d26fb2ef90786883366698b59f1422d1b27aa9807b719bd79c579b5e07915bb76028", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646132554, "uuid": "6d05a3e5-fc96-41ec-83ea-3dfbd76a1536", "value": "T18305BF4839E65038F83A8BF1CBC0E7F19BAEF222E54971F558000E559651BBC8946EFD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646132554, "uuid": "38d9d54b-ed4f-4487-b596-b9a8f3341dae", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646132554, "uuid": "f61b8c9d-616e-45c2-b9b6-7d481757452b", "value": "12288:pEH9R/IHQOUhRfVoFwSozmLHUigkPYrPqOotC7fhhiZAQgJ3E9SQ7AU9xG1r:AOSf9rmLHUROOMCDDkU3E9SQ7V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646132554, "uuid": "6b61d0ba-2fe7-4b00-93a3-e76ec01c7731", "value": 820224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646132554, "uuid": "2053c3a8-bd07-4556-8ad4-b77b814285e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646132554, "uuid": "2076afd7-2a2a-4521-a2c7-18d01747fb0f", "value": "Invoices.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "477b2ab5-9931-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1646119747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646119747, "uuid": "b2fb71d7-a11e-4bd1-bea4-219fc68d7954", "comment": "Malware payload (SnakeKeylogger)", "value": "4e9598e5b407180b24694d7927b45eab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646119747, "uuid": "9544bec9-a9e7-43a8-846d-27a8f51705e9", "comment": "Malware payload (SnakeKeylogger)", "value": "4c58367c2bef44bbe841f7099f6974c79e9c5c7af23f68c41955b32e880d1c70", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646119747, "uuid": "9ed82769-a803-4cf0-a51c-a5b5daa8c521", "comment": "Malware payload (SnakeKeylogger)", "value": "f65b6d6b023b0b233a73d37b98be738ba51d8de2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646119747, "uuid": "05548853-37af-49a3-9451-d23d033c59ce", "comment": "Malware payload (SnakeKeylogger)", "value": "a99769f0742297c14230c78266722b88a36be591cb02b1c5a3d7ee0222d026d07166cc9e496eba55dc2abbd746ede1d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646119747, "uuid": "8ae6c85d-69b1-4000-a28e-370efee1c358", "value": "T1FF557B8470D054BEE8378BB2ED69AF301766BE6DD098403D50073F1A66B737A544EE2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646119747, "uuid": "4604737a-297b-4ab8-a060-f4f1efda64d4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646119747, "uuid": "03c6c0ce-2945-423b-997a-2508789ad521", "value": "12288:Of1U/QHM2mjou1XoWFDAcBjNS3dl2gghCJmOoWQvL2ucYx1kElG4N0YmwmWdXIjJ:OfK/Qs2mjoYo20wNS+gG+mOfQA0li+A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646119747, "uuid": "96316382-6aa3-4035-b17d-dcd34b93478e", "value": 1292288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646119747, "uuid": "da39f704-e64b-4196-9463-bb387976f170", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646119747, "uuid": "0b6bfe48-8cfd-4916-b21f-0620dc30a88d", "value": "e-beyanname.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58c92d94-9934-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646121064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646121064, "uuid": "08296086-70b7-412b-96a3-c1a901b6b57b", "comment": "Malware payload", "value": "305e21a57c42a6850376cd91a4430215", "object_relation": "md5", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646121064, "uuid": "33bb1c01-d2f6-44ac-925a-9611545697a3", "comment": "Malware payload", "value": "4e1397fff753fe86be50e152d3e2ace6a8a9e0b3f8e63e77c0e0c1c1d6ed71c3", "object_relation": "sha256", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646121064, "uuid": "da001bd2-68c6-462c-921c-b40aa1797580", "comment": "Malware payload", "value": "b624b3bd7a7a855b84c836ab2ffdd9f3d0de59a3", "object_relation": "sha1", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646121064, "uuid": "14c8e4e4-d5ec-4d4e-ab89-50394c6fae6a", "comment": "Malware payload", "value": "aaed380eacbc03b59813398f2628ff4c7f3d047fa2a8a36770d0da7c47df523b93540b3f96d5322820956080f2e54a8c", "object_relation": "sha3-384", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646121064, "uuid": "c0795b89-19b8-422e-b784-147f9ec9f3ef", "value": "T1BD914A07FF3E17F3E83894B401EE2517A9058278BB199E4B1DD90822B815728E2338BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646121064, "uuid": "292d0530-6119-4d1a-b586-26d7152751ce", "value": "96:Z1gPjm3ClUaQBFBOM1CeMxoY4yIlzqRpbUS8:kwClIBF8oC4rqRpw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646121064, "uuid": "97b9221c-17c3-4d04-b13d-044018fd7249", "value": 4608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646121064, "uuid": "8e423356-ed3b-49ae-b9ee-179bafbea868", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646121064, "uuid": "0dd341a0-3d92-4214-8058-04c0b6714056", "value": "DAR_ NALJART TECHNOLOGY_CONDITIONS.xll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c43f65bd-9977-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646150021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646150021, "uuid": "f6cfbafd-d671-46b6-808b-f26bcb6874af", "comment": "Malware payload (AgentTesla)", "value": "3fd38253fc7230ed7e74633bcf4a4b8b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646150021, "uuid": "da9a2171-bea9-40d4-b73d-353635140188", "comment": "Malware payload (AgentTesla)", "value": "4e8c8f98c455a5b6e02cecb44c4239f6173116d8ea694f1bc087db7c3dcdd48c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646150021, "uuid": "51a16113-f5fd-4573-a735-8554771b58c2", "comment": "Malware payload (AgentTesla)", "value": "755fb52437cffeb9514416a44ccf7171aaedb12f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646150021, "uuid": "44c0539b-3862-4eae-a077-fc66db7a0283", "comment": "Malware payload (AgentTesla)", "value": "ebcc3af286e7afa42176f1bc4173418d6ad6943b9304619b1577bb40e9166e15c323c30c5d42874c608d52025ddf26bb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646150021, "uuid": "77006994-22b6-408a-8ad2-1515174795c4", "value": "T1E024CFB4794CE94FD4562A7318A1D2A465B03EADAF1245277D83FFAF703CA051E0693C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646150021, "uuid": "7eebc1ad-47b7-438a-8dde-739ac5d409e0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646150021, "uuid": "dec14a50-b864-4407-81f4-7f40787cc183", "value": "6144:AbpdYme0DML0IwWeDj9KJHxRIKQ8+yl2:SdYmVI6IPFzl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646150021, "uuid": "36a20dac-2d3b-446e-87e9-76489978fb59", "value": 215040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646150021, "uuid": "6747b045-6db6-43ee-9261-1a088c4ed273", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646150021, "uuid": "4710b982-2228-4e03-aa40-a3d0c870969c", "value": "img009.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd7cb0bd-99ab-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646172397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646172397, "uuid": "4018f305-fcd4-4cd2-a0d5-2c74f6af7161", "comment": "Malware payload", "value": "e0fbf8d690a8db2d51f44c28d5883d45", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646172397, "uuid": "7ccc49e7-3044-4ef0-b1ce-cb7a3df9d407", "comment": "Malware payload", "value": "4f50ec6f34b224ecd93051ba9579d1ab450ce5d3e41c230a4452be1924ff798e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646172397, "uuid": "d1c325b1-8926-430b-b948-e61070d23502", "comment": "Malware payload", "value": "4436d75c2fc8d00e4f55f844577f3ce6d2b8b142", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646172397, "uuid": "e779c8cc-c9b0-46c0-9398-0b4010dff1d9", "comment": "Malware payload", "value": "cbfb8a35700d69df6a92de5a8d45d2ffed6edca9a307d9a0c621ddefc5f803a0cd90cb6c61e61d77d2f8950fdf0406dc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646172397, "uuid": "67944931-da30-4abf-9a8d-c77ba94956a5", "value": "T110B4AE11B7D0C072C26A35342926E7B656EEBC719AF583876FD03B7E5E301D18A2835B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646172397, "uuid": "b989419e-8aa4-4a99-9a40-691ffef8ab40", "value": "d02245ac5c961d83d0907c826d8ba5c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646172397, "uuid": "931668ea-9098-45af-b2ee-d24c2ef25b02", "value": "12288:JhC1q3aXOwkiPs2iCtyjBOAIlgOkar//wJY8Itgm:Jgq3aFkiPs25aB2Bkm8jm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646172397, "uuid": "5f49e4ad-a6b9-48c8-9e48-fe50bfd34ac7", "value": 499712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646172397, "uuid": "a2810f2b-c425-41dd-9e19-66f244180761", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646172397, "uuid": "4257dc93-e7c3-4995-95f6-06b42af50b4b", "value": "e0fbf8d690a8db2d51f44c28d5883d45", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d0a7b91-9934-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646121045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646121045, "uuid": "e96b2f85-4ebe-4dfe-83f2-0a7acb81d9f8", "comment": "Malware payload (Heodo)", "value": "e0649cacfd079c785de8a9f6a4f2bd6f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646121045, "uuid": "e3b56887-a39c-4880-8be3-b6f1d552f148", "comment": "Malware payload (Heodo)", "value": "4f5f82923d8cb91644a1f81f96a7cb5be0ff1c2bfdda75644d4fcd1ae2f0ce44", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646121045, "uuid": "de920ea1-ab59-4450-bbd8-583a7bb5e09b", "comment": "Malware payload (Heodo)", "value": "0919ba682ab2a0b0d9ac06243107f6a03a3246f1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646121045, "uuid": "59cfd501-4e42-4e68-9a0c-02b14e351950", "comment": "Malware payload (Heodo)", "value": "19ca342b74bd3ce3bd08c3ab4cb180067806b7e67422f19e2c9118c27ec041dee10c518d6ea6a5f5c5af51a9a2de76c0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646121045, "uuid": "f7490d94-b9b9-4a0e-a518-f82aa7d5a70e", "value": "T18BB46B992251F077D11B503D0BCC2AAD7EEB88F09A6DF27FD2A3558D0F31190A62D993", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646121045, "uuid": "d497e0b1-c591-4725-86dd-14c7fd9b620f", "value": "42fe0d732d1bb90c6a7a1bcfb8ef88aa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646121045, "uuid": "8f0ad549-fc21-48cc-a522-5b5fa237d40c", "value": "6144:cH4C1DzgG1GCQw2HOOnPE10JQNqytvrC4cHV9jp6YagzSAIVCL4Ry:cYC14G1GUgOOs14Qkytm1xpdIVCLqy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646121045, "uuid": "d4bbbbd2-bb8a-476c-bf58-f47582033278", "value": 528384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646121045, "uuid": "ae70ea87-cb68-4eed-aed2-4412076d904a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646121045, "uuid": "fc63115a-5e81-4b38-b79c-22b739444d18", "value": "e0649cacfd079c785de8a9f6a4f2bd6f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78a7d5aa-9941-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646126701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646126701, "uuid": "6fb79a97-561c-439e-a235-28b1f63ab831", "comment": "Malware payload (AgentTesla)", "value": "2ceec6c60e73a6558d0d1cbd3bee1a36", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646126701, "uuid": "993dd662-18db-44fb-8bc8-44f5b9b3b116", "comment": "Malware payload (AgentTesla)", "value": "4f7e03143a97b6fa7f96b4368e9b350583df01cb71e3d8f972c3579c5e913ba0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646126701, "uuid": "b98b8b7a-8236-405e-b2cb-1f391a6576ae", "comment": "Malware payload (AgentTesla)", "value": "a798da4b974fab3c6e6a55193d2b9e70783c15a9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646126701, "uuid": "8cc6e042-5f3e-4d67-bde9-f241bf047d4a", "comment": "Malware payload (AgentTesla)", "value": "60ab09ab1789479378a5539999729a6e1318b8dc6e0f0906d83cd9a39493f361f51bc2d3617ac2cfb0438f74c25f43c7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646126701, "uuid": "422db988-88fd-4ed4-be92-24cc939464a6", "value": "T1CBE4E03927C45B98D53D27344834949053F6B98AFB12CB2F3DE2019C2FB2E96972275B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646126701, "uuid": "787890c2-f810-4084-96a9-b864b834be43", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646126701, "uuid": "f5fbd90e-fe1d-4c20-a49b-92f5805954e8", "value": "12288:iCcVgEfC8r8NeyVs0KBt/4pMwejUcXVkIuO:i/2EfC86VUvGMwGFknO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646126701, "uuid": "4fc34b43-c5a6-4b9e-a275-170c92fcbecc", "value": 665088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646126701, "uuid": "05b83ead-61ea-4c4f-b62c-825b1300d7ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646126701, "uuid": "48fb2f3b-6de9-4559-882f-7a8c6cedc336", "value": "2ceec6c60e73a6558d0d1cbd3bee1a36", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9c22122-9939-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646123482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646123482, "uuid": "06332dff-9e9a-4d4d-a7c4-b197c8f3e301", "comment": "Malware payload (Heodo)", "value": "9579356fe02a362ba9cd31b14d4d730f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646123482, "uuid": "4b93c564-62ab-4126-97f2-f18d6faa2b2b", "comment": "Malware payload (Heodo)", "value": "506a408eb9e84f148cd65dc5d0f851549d7a91495a87f7b905705d3b9d0340fa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646123482, "uuid": "46d36375-1cb1-4cc2-a851-8c02c76bd2e4", "comment": "Malware payload (Heodo)", "value": "fe24f029bc958764a79fc65f10b9d0cea45beb9b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646123482, "uuid": "60e2fb6f-771c-4c07-bb4a-db2484477164", "comment": "Malware payload (Heodo)", "value": "7e0ec0a0e2c80499f60b080cb2c15d32ef45e932b285ea57f85789717a7b8bfd5a1865bc95df7ceca943b14c5088282b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646123482, "uuid": "ef7741c4-67bd-4d05-a9a6-a14b1577a574", "value": "T14DC4AF12BFD39072CE2F293C503DA77413A95C65971A8863979C9BBE1D3F9428B3190E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646123482, "uuid": "554e41ba-66fa-4abb-89a9-4f9ed37c756d", "value": "e0b213ccd96f46d30dcd8e225f4e9fc9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646123482, "uuid": "e0f68b26-89de-4176-835d-e8727ff4ec54", "value": "12288:onEtDywy8SYlHD70WychG0QOCM8T9xvC0yDyPgyQz/VDNeg:onEtDywy8SYdnhG0QrM8hxK07a1Ne", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646123482, "uuid": "c84b716a-6a3c-404a-8f68-7a99da7aaf14", "value": 585728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646123482, "uuid": "f1e2bd6d-df45-4a1b-9f5f-7f3b4e83df79", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646123482, "uuid": "1d16a183-e4f4-4109-aaab-5161e5d4d629", "value": "9579356fe02a362ba9cd31b14d4d730f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09dcbaa9-99b3-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646175478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646175478, "uuid": "fe8844f8-a0eb-46e1-ba5c-b4bd99e77748", "comment": "Malware payload", "value": "ce7c0abca47e98c14ac2289230d5dc6f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646175478, "uuid": "65480202-b3e5-4e42-aa6a-6a8bb3ee16f3", "comment": "Malware payload", "value": "517c4bd8ea50679f80395014adb88b0809172ef7fc804ac9bdc7613a49e45201", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646175478, "uuid": "df06f861-3bb0-41dd-b055-4a13d9f55710", "comment": "Malware payload", "value": "ce9506a6f6cbcdb1b8097d70227424b1e38db2fd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646175478, "uuid": "b931ef7a-548e-4340-8dd6-7831e26a784b", "comment": "Malware payload", "value": "3d99dcf365b71a9c62594da5fe614a3a1fb5832bd25fe6d90889ce587a76956ee7f1b1327f563b8d8b897d801848bdcc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646175478, "uuid": "04ded757-e5fe-430e-869d-d5686fab2cc5", "value": "T1E1B4AE11B7D0C072C26A35342926E7B656EEBC719AF583876FD03B7E5E301D18A2835B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646175478, "uuid": "c7bc05ca-91e7-4ac1-8cd9-c622f3de0d4b", "value": "d02245ac5c961d83d0907c826d8ba5c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646175478, "uuid": "9b5c86ad-1f86-4d61-8d75-6df88acdec47", "value": "12288:JhC1q3aXOwkiPs2iCtyjkOAIlgOkar//wJY8Itgm:Jgq3aFkiPs25ak2Bkm8jm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646175478, "uuid": "b0359297-0751-411c-a5f4-a2acd6391f27", "value": 499712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646175478, "uuid": "3685645c-4f0b-456b-a9c9-a3a9cef86210", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646175478, "uuid": "3993dd95-0d92-49e3-80c4-77fd581195c9", "value": "ce7c0abca47e98c14ac2289230d5dc6f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e8c5468-9991-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1646161098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646161098, "uuid": "8bfd2fa9-0b36-4324-bdec-6a14abc4693c", "comment": "Malware payload (Loki)", "value": "636b4d8dca931ed954254da68aff9cb7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646161098, "uuid": "8944099b-74ec-4511-a84c-eb127d6d0250", "comment": "Malware payload (Loki)", "value": "51c4a9a807294ba857735727b3c3378db60c3bafad52d7cc80538c41ad27eecd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646161098, "uuid": "56a4708b-a4d9-472e-b554-506670b166fb", "comment": "Malware payload (Loki)", "value": "61a1c98d994ab1c9503dcdff32b750dea58af434", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646161098, "uuid": "a779b8a2-df50-4bba-8020-56c51607b4d4", "comment": "Malware payload (Loki)", "value": "0d31d27828c97b5e39e39c6a45df83e22d4005e12267c45a33342181c6be4701e05579a9e09b336ab381102454278c6f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646161098, "uuid": "fd4109cd-557f-460b-b99d-408151857d6e", "value": "T1EA649E10EBA0C035F5F712F8587A93AC763E7DA15B2065CB62D866EE16346E1EC3134B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646161098, "uuid": "71e059af-51b5-41cd-b505-f7b5d81168c5", "value": "070604688899afa7e1438edbf6a9e9e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646161098, "uuid": "9198087f-12d4-42aa-aead-34efd3d18af7", "value": "6144:xADdb7JJW9On7KOzNUpOq9vI6bhEmy4akhtPOs:KFJJW9On7RSpOivI6bh/dzOs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646161098, "uuid": "06062714-320b-4dd7-b43a-9366dacd77b9", "value": 332800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646161098, "uuid": "a2f7f8f6-8ff9-455f-a7fa-0916d542a44a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646161098, "uuid": "f2886d57-6a5c-46b1-bb9c-381efb4dda23", "value": "636b4d8dca931ed954254da68aff9cb7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "390bb464-9988-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1646157089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646157089, "uuid": "3ad11f0f-1fef-4786-a372-f4fac1c18f09", "comment": "Malware payload (RedLineStealer)", "value": "2968347cba50a58ca44d61f4c31553aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646157089, "uuid": "498fb394-b496-4be9-b6ea-5f0391b0884d", "comment": "Malware payload (RedLineStealer)", "value": "527b3ec7f548207e3ef8509973591509e5d61c91d613c232329204dfa35535be", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646157089, "uuid": "cc599af4-3104-4007-888c-6c259eba73d7", "comment": "Malware payload (RedLineStealer)", "value": "0b2ef77dffb63a8682763742e779ebf4515f4679", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646157089, "uuid": "d30a0059-1d8d-4687-98f8-382b7e9d438c", "comment": "Malware payload (RedLineStealer)", "value": "8372af103d765fe76acea68b81a24bf60eb07ac6ca43d001201ad3f2c939ff206c1c36bba72204767a36b395babb25e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646157089, "uuid": "e0a1626f-5656-462e-87ef-28d136c29315", "value": "T160C423BEBB80B23AE28E04B97D5AD1137A6111221BF094FBD2B5DE01D6B4981F52D335", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646157089, "uuid": "5f29fc57-a82d-41e4-9fd4-ada63724977d", "value": "445554923421947cbff896012e27345a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646157089, "uuid": "00e6b98b-55bb-4768-a5f8-ce70745371c7", "value": "12288:mOp1jpYqocfy2M30APQS03ULaHNqrxlKIQNoXsCp/Ckgchy/05c8:mOWBcfzuPkEaHNYK3bch75c8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646157089, "uuid": "3e8263a9-8d9f-402e-8bef-32bb45c098d0", "value": 579584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646157089, "uuid": "64189ed0-9f69-431c-94a5-6b32fc17c22d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646157089, "uuid": "8ff2f328-29a7-4462-85ac-26a56b91af9f", "value": "2968347cba50a58ca44d61f4c31553aa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fc3bcd2-992b-11ec-9275-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1646117211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646117211, "uuid": "f2d27df1-e135-4d6f-950e-ffe650915f2a", "comment": "Malware payload (Quakbot)", "value": "561ff2fc08c88b446fc5f8ecd35b427c", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646117211, "uuid": "72101ec1-6299-4ac3-bf9a-cea80f923314", "comment": "Malware payload (Quakbot)", "value": "538852c75f21017cf11add669dc4d9ef298ab1002be67dccfcc5705a0f80a1af", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646117211, "uuid": "2d9bd875-356d-4a24-baa6-90e3eef660b5", "comment": "Malware payload (Quakbot)", "value": "d0eb82cf39f64555faabed8ae97c476cb2fff10f", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646117211, "uuid": "8e53ce1a-43e5-415a-9301-37bc3c11af11", "comment": "Malware payload (Quakbot)", "value": "2abd92dca66ba31f6634ed4cb8b2a0568247c32b624377d5d5e78cdda076ea9c4b176369a9c0fcd7e758159dd5f01ea5", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646117211, "uuid": "2d694c1b-5ee0-4e79-bc78-151356a0ca12", "value": "T1E274123CE1265806C758E83DC61E4AF8EA0601CA3892FA1B56D4BA1D7DB65F34FDC1D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646117211, "uuid": "b3f13b24-45b1-45ea-80a3-5fec966b2d91", "value": "6144:+O2Vjy1WyndEXJF48WIMpuqaqj9NDsA/DUzYeeKjmFQH3K:+Ooy0jnnWIMpucj9NsSQY/KjmFQHa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646117211, "uuid": "c2a7496c-5229-4f6c-8ff5-b4e8a1740487", "value": 341145, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646117211, "uuid": "00122c1e-9157-435b-8931-2b4a9bb95a0a", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646117211, "uuid": "d2103459-d07b-4445-9b5a-99b61bd1ff41", "value": "Service-Interrupt-947051958.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27bf24ba-997b-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646151476, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646151476, "uuid": "ba8c7c38-bbf1-4b9a-9f0c-2d56c7f0ae73", "comment": "Malware payload", "value": "54c0ae8530a79b79d62877e7527e236f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646151476, "uuid": "8a0b5e07-ff9b-43d7-b5da-b59f0c77b999", "comment": "Malware payload", "value": "53b3ebaa3c485772f8e6abaa0f366ef192137496a7064e015ced4e6fc204b3c8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646151476, "uuid": "9f06da2b-268b-4d08-9e77-8ec9fab3bb56", "comment": "Malware payload", "value": "ac6dff8d2277ad03618e9a464a7b3bb01674ddcd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646151476, "uuid": "9f10086e-2d71-4ccb-b8b2-a2d2a5847c90", "comment": "Malware payload", "value": "05d19dc8c441bf03abc0884e818bb03828fb61e7eaad74d4102a857fc514f7182e530697ad6644a2da21e7ca7c9515b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646151476, "uuid": "444e9cf9-8a9a-44b6-8bd5-14dde2566acb", "value": "T1DAB57C16A7A804F5C9B6C23CC997960BE7F2B8150770EBDF0AA846B91F637D1163E740", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646151476, "uuid": "ebf88f23-6c52-4850-bc98-4f0bc566130c", "value": "bc1fc12dfcfbfb96d61fc1ad211049f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646151476, "uuid": "4f5be450-aba6-41d0-91c7-f889a369c4c1", "value": "49152:IygszOLIrd+CJawonIPOfKvGRMOKIIIMvqPGsYP:LOFIP3GRh7Mv1ss", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646151476, "uuid": "4b1d0bc5-fccf-42d3-8641-a3b9fddab39d", "value": 2333696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646151476, "uuid": "6b093940-c985-4f92-a0ed-78cd5bff3442", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646151476, "uuid": "8a0c103f-a53f-4742-8313-40a8ef4c6e43", "value": "data.log", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea4385a1-99ab-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646172419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646172419, "uuid": "92a8f27a-f34c-4ccd-8eb6-cbf1e44887a3", "comment": "Malware payload", "value": "4f196431b094d01bb88c1613570a0516", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646172419, "uuid": "4307843e-6799-452f-aa96-0247fc051db8", "comment": "Malware payload", "value": "53ec3cc844c0f8d06964a7bfa0741fca4fd50a500c77ac3b3743973ae7fc64f8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646172419, "uuid": "6afe8614-aea1-4e67-afbb-627b9e4cadf2", "comment": "Malware payload", "value": "bb8b7a3bc11d337bae6781d370e18e0ad9153f45", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646172419, "uuid": "8ba0be84-2f2a-49f4-b34b-92c00a972ea6", "comment": "Malware payload", "value": "4ef00b67bbf69df6303d31a0d0b277227c380e171cf0b156e5057fc13937b89041bbc74ce54d92676284e8a25eebf541", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646172419, "uuid": "6515498d-f4c4-45cc-8eba-ca14281e469e", "value": "T119B4AE11B7D0C072C26A35342926E7B656EEBC719AF583876FD03B7E5E301D18A2835B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646172419, "uuid": "02b605a1-d585-47b6-8238-3caee3baa6c5", "value": "d02245ac5c961d83d0907c826d8ba5c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646172419, "uuid": "d13f5696-a13b-4998-adb9-3bca686a1e72", "value": "12288:JhC1q3aXOwkiPs2iCtyj0OAIlgOkar//wJY8Itgm:Jgq3aFkiPs25a02Bkm8jm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646172419, "uuid": "5af81a94-3520-4d11-9f0d-ae41f80869b9", "value": 499712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646172419, "uuid": "62bd9e91-4524-4494-a561-bb85e0fee105", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646172419, "uuid": "aa627058-a103-4dbd-b71b-5dc21f36774e", "value": "4f196431b094d01bb88c1613570a0516", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47683dd8-99a8-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646170857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646170857, "uuid": "720cfec7-ef84-453f-954e-f3ad22e341ee", "comment": "Malware payload", "value": "d4b679a72d532de44f7d73ee43f2d7e8", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646170857, "uuid": "bcf22240-494b-44b1-9993-effca93091d0", "comment": "Malware payload", "value": "54039f2b0edbb37c7dce5e5c06b47c704df77cffd57ac86300cacf012977b360", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646170857, "uuid": "7dbc333e-2b9a-405f-a6ad-75506d832068", "comment": "Malware payload", "value": "fb1bebed54899a8cb617f809a4b04888c8743e58", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646170857, "uuid": "aa00b642-a330-4714-a650-9911d99b447d", "comment": "Malware payload", "value": "f4e82d1144d5feb5194aa1f159318dc47579773b4bace3ad44cb833690555abe7abdad3c45c8e75b1ba675e3d7ce3fb0", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646170857, "uuid": "2db84026-b5bf-45e5-9b5d-44dc99360c37", "value": "T164B4AE12B790C076D1AA36342526A7B51AEDBC709EF5C3876FD03B7E5E301918A3C35A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646170857, "uuid": "1bae7794-977a-4232-a1e6-170754ef8124", "value": "f08242131de62ca6d7c4b2727b491b3d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646170857, "uuid": "0d931b37-617b-4acb-a190-4ae246f705b3", "value": "12288:jE3TMKM/JjdkdO4+BNhOwyN4h43JopSz/o:jE3TM/JjdkSw3Ko", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646170857, "uuid": "8638958d-8e1b-4abb-b90e-c202ee8c0ff0", "value": 505856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646170857, "uuid": "5f481bf9-e9eb-4db0-a385-00e77dfb2945", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646170857, "uuid": "7d640192-2f5e-456a-b7c6-ee986d08ddd5", "value": "iO2Ci472huWJYejETUmsuh4LOf1R.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "933d5cac-996b-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646144785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646144785, "uuid": "c51255bd-551a-4510-8707-702453737c91", "comment": "Malware payload (Formbook)", "value": "ede8f6826808c6dce6934706b105b8a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646144785, "uuid": "a19f082a-5292-46e6-9b27-353ad225354f", "comment": "Malware payload (Formbook)", "value": "546a2df71813511617bb9fd39d390ab7e59af6a39062825daedbbe8f82a15af4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646144785, "uuid": "f022d1b1-9b7b-4074-a02e-04a0faa801f9", "comment": "Malware payload (Formbook)", "value": "081d0ac99dc82ad2539c100f1e6c181d0655f207", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646144785, "uuid": "9f91ad6d-e666-4f7a-b23a-8e9cb0225035", "comment": "Malware payload (Formbook)", "value": "a9bb21a24b23a2ed39582e9aa905af86b98722e679e41ce9ca3112be216fb9817d4437cfa2775cfe8bb7b56cf1f631aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646144785, "uuid": "3feefce7-f4ee-46fe-971a-69b8978f956c", "value": "T1F96412236AC285F7CA461B354D7272B2C7B64154073066073FA42FEAD667888A7371B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646144785, "uuid": "e600d8a8-4382-4183-affa-51e52d8a2c79", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646144785, "uuid": "57ae883b-332e-46d1-92f7-3797e011a2e9", "value": "6144:rGihmf58eKMfHOAdrc+AlyflUxlkXULvsVkrNNS:4f58Mdrc+ilSokVkJNS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646144785, "uuid": "5697912a-b394-4cf8-8efe-3f9ea0f4af91", "value": 316710, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646144785, "uuid": "13133834-81ac-4733-91d8-4ff8277df292", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646144785, "uuid": "e782d72f-7ae6-4b49-89f2-cbe6883ee111", "value": "Order No 30288030122.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e6a8a3c-9956-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646135784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646135784, "uuid": "0090bf79-3a9e-4475-b0e4-2705787d4493", "comment": "Malware payload (AgentTesla)", "value": "629498dde768cb33a8718df00d1f53af", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646135784, "uuid": "bd721ee4-2b8e-44a9-97c9-dd29429c18f2", "comment": "Malware payload (AgentTesla)", "value": "548576eceefea4fcde68e94efee831ec3fec9041ee28264403475f2485a2ad32", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646135784, "uuid": "064177fd-7f0f-4421-ae55-12da369f8cbf", "comment": "Malware payload (AgentTesla)", "value": "372782ed50bece2976883ee5a0167eef6e393d9f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646135784, "uuid": "68f21c94-cea3-4ee3-bd0c-1e9455aec00b", "comment": "Malware payload (AgentTesla)", "value": "f67f55b44ef4cd432b295fa94fc00a8121f2548ec1b16bbb3b2319371952e0e3631a085294e1740b84f1674a7e51878e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646135784, "uuid": "f9e82c46-30c2-4e24-ace5-d8a382859de0", "value": "T15945AD943B56E0CDE1639DBE9DC4ACF09BE4EC261E0EB1A620933F0A5679D87CE11171", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646135784, "uuid": "74fda781-1802-45eb-8409-7ddf7e58e080", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646135784, "uuid": "b7920587-621f-4aa5-a158-23c6e392d020", "value": "24576:bZPgpuW4vO4fbNzgMsKF6txQHEVvUc6cZKYIZF4SS:JW4m4f5kMoiM8oZKYIZV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646135784, "uuid": "34c17235-fad3-4cda-bf7b-ec93162bf15b", "value": 1187840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646135784, "uuid": "38ac31b0-4547-4c2b-b732-141991b3e4db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646135784, "uuid": "d2ba20b4-8c3b-4d09-9b1b-708b25b07e2c", "value": "Invoice 1535132022.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70a899b7-9941-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646126688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646126688, "uuid": "9b4526f1-4818-497c-aa04-4f021a61a8b9", "comment": "Malware payload (Formbook)", "value": "531544a3ba94737e9aee2c6ada39a149", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646126688, "uuid": "3f089fd3-6cf0-497f-9280-4a688df1d74d", "comment": "Malware payload (Formbook)", "value": "54d3a5ab9cf83b63a50a382b1f3fe4f2bdc03620744b9ecdee74723415fccd9d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646126688, "uuid": "4436cd96-14e0-4b0e-a33c-fca163b8c3e8", "comment": "Malware payload (Formbook)", "value": "750a418bddafa95605d2b2dae08309086234d9a8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646126688, "uuid": "50111b62-fefc-48d6-83fd-15d77159d256", "comment": "Malware payload (Formbook)", "value": "ab34c42be838a594adbf55e975e74ab4b6c566a2712b38b6a7bbab64949e23e521673bfb38621907c676ef6204cb31e6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646126688, "uuid": "a74beef3-1dde-486d-a6b0-5290a0ab6ffc", "value": "T10784E15DDBE3431ECAA8457E84F633E82F10D427E0AB863B94D2191A1D633F9BF80595", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646126688, "uuid": "0874ea7d-ee17-4b13-9b79-8956a4afc3d9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646126688, "uuid": "29dfe2e8-ad6b-42aa-980f-65f3bed1c535", "value": "6144:5UDDwU5vYNoSeWOSrSyFxrd5meGNIeJI+dqFQwkDeO2EEyvM6rfDTzNL:5U4V5RrSy3bmeGKAZwg/EEh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646126688, "uuid": "76699c84-9c4f-4a9a-8bb9-32c65bef709d", "value": 393728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646126688, "uuid": "32063394-16f9-4bf7-aecf-7eb5dfc6ccc4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646126688, "uuid": "57e7b5dd-672e-417c-810a-17b617616a5c", "value": "531544a3ba94737e9aee2c6ada39a149", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd7929b6-9977-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646150010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646150010, "uuid": "e28a988e-4b98-4ba7-9a95-a8c23e1dbd53", "comment": "Malware payload (Heodo)", "value": "3a9ac93afe472f457b6a01258c1b2b0b", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646150010, "uuid": "109865ab-a017-4491-9443-6c55f3f8a641", "comment": "Malware payload (Heodo)", "value": "54e81f3ca946d348a83ca81fecf19f3a3952d2df45f030def3473185ef29d33c", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646150010, "uuid": "55070743-50a8-4791-aa72-60e34270f951", "comment": "Malware payload (Heodo)", "value": "aa10b7632ee1cd18d85aba9cd0c92d035c1cd43c", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646150010, "uuid": "c8e767b5-0531-4f47-8325-09a0063eb9f4", "comment": "Malware payload (Heodo)", "value": "759c56e688ec8a52cd93e30360c33bce9d9ffc909548cf492d5b86e414f5e00c743a9ea3e34e3da9a1e09d3333f89365", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646150010, "uuid": "b43764bc-b195-4879-9429-66211fe1731d", "value": "T17B13E02AC0961959D727283DD6148EF4124C0E4A89E5F99B1D50B3AC2B6E1FB0B4FCB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646150010, "uuid": "777f4c73-eb83-4c4b-974c-d34f3a469297", "value": "768:S9oms9O+pOevZCwtxyKfcrND59V+L9Rw4eWrXcTqw0VfWZE:S9oms7tylND59V4jwmXc2RVfW+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646150010, "uuid": "db403b55-0eef-4f3f-a6aa-1768db2ebf99", "value": 41841, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646150010, "uuid": "0712e87f-88cd-42b6-bcec-e5b1c06243a3", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646150010, "uuid": "4c3580ee-2058-43a4-9133-abd033f206b0", "value": "2022-01-03_0834.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0eda4d5-9992-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646161665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646161665, "uuid": "7d1be3f1-197e-44ce-afd4-830d9529c468", "comment": "Malware payload", "value": "38fed9aea64229f4081938d20caa46f1", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646161665, "uuid": "c592da52-8a60-4adc-9ad6-3a14369d5315", "comment": "Malware payload", "value": "54ef5700c3fdcb5dee46d0e9876098b89a0dc805a057d2ed77e8a0b3f065290a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646161665, "uuid": "4ae2edec-8d22-4658-a613-0fa04049164f", "comment": "Malware payload", "value": "228a5cccd13f068df73fb5e3bb08b3354c2134fc", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646161665, "uuid": "ca3d0fb9-c0db-4a15-b687-c2fa3a3f81e8", "comment": "Malware payload", "value": "2113efa09e0f72227ce843a0db07c96c64738bf88a1ba6f6f59fddd7acafd6668852aceda5a2a282bda87c381d3cd114", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646161665, "uuid": "7910e1db-4dc7-4cef-8b4d-e8fc29ce6dd5", "value": "T111B4AE11B790C076D2AA36342512E3B51AEDBC709AF5838B7FC07B7E5E315918A3835B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646161665, "uuid": "c0ba2af0-a733-4076-acc7-395e576a5c28", "value": "f08242131de62ca6d7c4b2727b491b3d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646161665, "uuid": "f95e101e-21ea-402b-8bf0-f2a40046e4ac", "value": "12288:dbFLiEzuSo9guqHuWjr2pyw4W6SpktSuHE:5VWSo9guWU6ZE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646161665, "uuid": "135f3ba1-115b-4077-9242-297806c0e202", "value": 500224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646161665, "uuid": "4a2c0c29-c4c2-4c4d-87e2-9bd5245d6cd8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646161665, "uuid": "701e39e1-5dba-455a-93db-be5dc5d7dcc8", "value": "WuyECGy6upM.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "607bfaec-9933-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646120648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120648, "uuid": "cc23d41a-cbc4-4ea4-af63-f4b12bf72759", "comment": "Malware payload (Formbook)", "value": "1fed710b59067f0010112392a3a82a12", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120648, "uuid": "6540ef31-e7f5-4a60-8190-b51384b75149", "comment": "Malware payload (Formbook)", "value": "551cfba046ab0302e8974b313188f825377ed6cf8afd0ed26e0718fda571e409", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120648, "uuid": "1c1411df-c495-4fb9-94e5-dbe81c41ca1a", "comment": "Malware payload (Formbook)", "value": "4492a3d6fd3f66d6c468f2d7adc5001aeea3a92b", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120648, "uuid": "f0995bd3-a175-452a-8fc6-605de99a30f5", "comment": "Malware payload (Formbook)", "value": "8e53a627c4e31b71a4d9af50bb2a0c900c9eba8b429f8e1ad9fc7ba1803b72b8ca893aba23f06362988316cf0aa69c79", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120648, "uuid": "2a5e3bd9-1675-48da-88c2-4dae4779f8c6", "value": "T1E81412A7B2A14414DCAC72F238D83E5D458CAEA4EDBE51D7F770BE8AD070621B54870B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120648, "uuid": "5501110a-044a-42bf-9340-403d7ed7800f", "value": "3072:In+5DqBfrydy1/ZYwzec8NX58y8qYSJdvYWdsSr4ouB97ys+S3aSeg7b:w+ofvowzet558y8q3J5YWdZr4ouPTqS1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646120648, "uuid": "3d12a00d-2405-4d08-bd4c-6bd0e49b5cb2", "value": 190936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646120648, "uuid": "8e66a8ef-11be-491e-8512-5e300e0f9c0d", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120648, "uuid": "208e5395-143a-4aef-8023-924549808bd4", "value": "RFQ.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dae404f3-99ab-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646172393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646172393, "uuid": "74b939d7-4a3b-4924-9e3f-bcfca97b7f25", "comment": "Malware payload", "value": "54b22bb2dd651cedc5874bc81c5ede1e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646172393, "uuid": "c511c0d8-32ad-4b3f-9fb7-65fbdf2e7b52", "comment": "Malware payload", "value": "5528c92f056fda621bab1f7faf6a31c4b3dc919a04c663f7a8988eff0619cb4e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646172393, "uuid": "dab0b69d-22f4-4536-b039-0ac3eee30b62", "comment": "Malware payload", "value": "69a51ff7423ca1d155702af258db5c1486f35fdc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646172393, "uuid": "bbe54c11-736f-4ea9-be95-d1bb69ef30de", "comment": "Malware payload", "value": "d80ad742bff261986b62440dc986570f3b9fba8faa268fd03f85e346f09a8f23c97c153d2ea5cd940e5739dfa8470fae", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646172393, "uuid": "b5cca9d9-f1cb-48fe-a743-05446c2a61c6", "value": "T19AB4AE11B7D0C072C26A35342926E7B656EEBC719AF583876FD03B7E5E301D18A2835B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646172393, "uuid": "4f9dd075-d862-4bbb-93b5-f45edd7053a4", "value": "d02245ac5c961d83d0907c826d8ba5c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646172393, "uuid": "76d267b8-81d1-4e8d-97d4-11547f9befb3", "value": "12288:JhC1q3aXOwkiPs2iCtyj0OAIlgOkar//wJY8Itgm:Jgq3aFkiPs25a02Bkm8jm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646172393, "uuid": "2d7317b4-cfc9-4b09-8d10-a133adec3b57", "value": 499712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646172393, "uuid": "aab8722f-ef24-42c0-89b3-07c8afd220ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646172393, "uuid": "9b6ddba6-ff62-4fd2-a204-2c2b3a1076da", "value": "54b22bb2dd651cedc5874bc81c5ede1e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "054ccff3-992d-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646117918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646117918, "uuid": "47cd9231-0bcc-4e9c-8b87-f994f01033b3", "comment": "Malware payload (Heodo)", "value": "d223c4f6649529ea153fe4a64e3aacf1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646117918, "uuid": "c5c1ca2f-6245-4ddf-960a-5393643ba527", "comment": "Malware payload (Heodo)", "value": "557b8e07897a5f92b176c946ba55f0c4989915ed153ce40e8622d2c8e32b98c1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646117918, "uuid": "073f9b3a-88fd-4783-bd81-dbde0465c06d", "comment": "Malware payload (Heodo)", "value": "7678682c0dbf668830f39ba4c95e565b776ecff7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646117918, "uuid": "c745dddd-f276-42b1-b17e-61543d503fc4", "comment": "Malware payload (Heodo)", "value": "a069f11849f2574e03c3d02d74a19b8ad93f0e4139906367bd90eaae470bb401e014e3d51899d31106428c2d568217a8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646117918, "uuid": "1a29c27b-3cc5-4825-a373-c6c7adc46ce3", "value": "T181D47C82F7429EF2C00B03347C32B2586BADEAD5D2158D6B9398A5AE1F35573493DE43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646117918, "uuid": "dc8ee4fb-4e7c-441e-b016-366358b19816", "value": "e0b213ccd96f46d30dcd8e225f4e9fc9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646117918, "uuid": "5cbe2e42-8864-41a2-9293-8546bc04bcd9", "value": "6144:XjPgWGbb0OEmS9Vzf5WI9nI1LSfcaKMyhKmZHNRuIfv7YtaIIo0cm59CH7PQ:X0bEtf5WyI1LSfczfxhstaICRLmrQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646117918, "uuid": "6f80186d-2ac3-4a45-932f-84b0ae46e281", "value": 602112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646117918, "uuid": "7232d73e-e57a-48af-baad-f9c8f3f887bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646117918, "uuid": "a4c2bd44-3845-40ca-8344-8d5f9cf7c320", "value": "d223c4f6649529ea153fe4a64e3aacf1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd2e83f2-999d-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1646166330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646166330, "uuid": "098de215-4586-44c0-8543-6a1ffecf65aa", "comment": "Malware payload (Mirai)", "value": "a600b2c61738c9b9c4bb30502f236098", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646166330, "uuid": "0312c381-213f-4f9b-a2c2-8ba23c4d1d44", "comment": "Malware payload (Mirai)", "value": "558aff24018087ac1ac59167dc0b88d8b8808e39a78876fb3c143d298803f2d7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646166330, "uuid": "15c396dc-0e0c-4f54-8537-da81bcd826d2", "comment": "Malware payload (Mirai)", "value": "03164411949729967411b369f2b41cd83f3eac2a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646166330, "uuid": "9bdaf2ea-0176-4fdf-9bb4-b040025e88c5", "comment": "Malware payload (Mirai)", "value": "3cf042eefdd24f49bb6c212b06240214d71535c3dfd7083f92f14ffc5bb401132db7fe2b54747ec1844670f50dcbe265", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646166330, "uuid": "8b051d75-4f68-4bd4-a5cb-e43bd60e5055", "value": "T1CFD2D0BED5287EAAE8EE0D36410C27741C9EF6C1785FA78DD21418C5A7691C3B82E05B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646166330, "uuid": "37940fa3-1563-40ab-a9f1-0e6e8dbb619a", "value": "768:6yr9rOzcDlzQCFZI9R4nwtzg08JB7vFDWMa:lJOAhVZIRhg3Bj8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646166330, "uuid": "78c28bdd-1ac0-4d1a-9781-9ed48af4a655", "value": 29764, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646166330, "uuid": "eb8b7162-86e2-4e26-b093-80fbe323f606", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646166330, "uuid": "e1210e25-ffe6-4ca1-a5bf-393b9f0a8f32", "value": "a600b2c61738c9b9c4bb30502f236098", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f9aa298-99a7-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646170334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646170334, "uuid": "ac985357-be39-4642-9bf1-6af5bbeeae8f", "comment": "Malware payload", "value": "23a8d9bc9d3822af42336dae9fcaaf9e", "object_relation": "md5", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646170334, "uuid": "0dc1a768-223a-4aab-b04a-cd649a0db193", "comment": "Malware payload", "value": "5596e3802c5206417645243039094903abac111825a50301c44b2b80d68fa3e8", "object_relation": "sha256", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646170334, "uuid": "1add82b8-f355-49a5-a69a-c50399d62cae", "comment": "Malware payload", "value": "f6f196902cfde386c7acc2d5f43487c31b536a72", "object_relation": "sha1", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646170334, "uuid": "c6a9b0b3-cf26-48dc-af73-34e3ecc31c3b", "comment": "Malware payload", "value": "eb2e7577e3ce0e1aaec1ae945648ebbf496245b38361cc5a829f4640b913a45020c103075ad408ae4d401ed6d0c669aa", "object_relation": "sha3-384", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646170334, "uuid": "a60a2b9c-cd41-446b-85e6-771df42aaa84", "value": "T1E723D025C1607828C73E8C759200EAD2720A7D04D9D5EF893585BB4C3B96BEB57AF9CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646170334, "uuid": "9f44a885-d23b-44e7-b12d-169c5032f0c9", "value": "768:uio9DOevZCwrvtD608zdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Uh0VPWft:uio9D7UtT5fTR4Lh1NisFYBc3cr+UqVC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646170334, "uuid": "5211ce50-202e-41c3-8d29-1f259a152f1f", "value": 47699, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646170334, "uuid": "fb8228de-afcf-492f-9db4-ae9601cd850c", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646170334, "uuid": "27761e6c-53e0-4c91-9776-b3dd0fe2f2a3", "value": "Payment Details.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9f8934c-9932-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646120422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120422, "uuid": "19d11117-8ca9-4f66-ad6d-029cd15bb461", "comment": "Malware payload", "value": "be5a3d9934743ade5bf312aa38918da2", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120422, "uuid": "09daf7ef-dac5-4fe8-a033-77ba8243223a", "comment": "Malware payload", "value": "55f117500a431d054ccd86997dd1c552551388f9f4ca1b8a9fe99f44c00e3d38", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120422, "uuid": "19ce1e31-0f4e-4069-bbec-14e4d219bcb4", "comment": "Malware payload", "value": "b1b5f53bfba753cadc935296e6e278048c4ed07b", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120422, "uuid": "11a12102-7187-4d2c-929b-b2c023ccfc8a", "comment": "Malware payload", "value": "c102ac1e555ebb2d6db38d41e467432f602d8e71d87ff31a8b05d7153bad4c1f37a7d45b2027504175d6965022f97682", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120422, "uuid": "7b936fe8-c814-466e-8f2d-703fc9dea27b", "value": "T135D39E22B691C911D95857360DF2C2B97B27BC419EFB43573651F72E2EB37A48C03A0A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120422, "uuid": "e0b993b3-4e08-4da9-89fb-3e6a2504ba4b", "value": "3072:QrxEtjPOtioVjDGUU1qfDlaGGx+cL2QnAOG8yp/u3xCAn0e8wwd:qxEtjPOtioVjDGUU1qfDlavx+W2QnAOR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646120422, "uuid": "5db47661-59b4-421c-9556-25e8b32b1196", "value": 135168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646120422, "uuid": "9804151d-ba46-4a4a-84e8-9e6ca0f2968c", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120422, "uuid": "5d2b01ce-daf2-4774-bb11-97d45343ede9", "value": "Euro35000.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebe3ee9a-9943-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646127754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646127754, "uuid": "c84cfc9d-ae02-4636-b16f-e863f21594c7", "comment": "Malware payload (AgentTesla)", "value": "399c6c940c3e3ae9ec3996af85443d7b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646127754, "uuid": "ecf2d71a-d80b-45ea-b0b4-5c2cee1278ee", "comment": "Malware payload (AgentTesla)", "value": "55fd9e1165e7209083459e48ed8c8cbacf23c54cee2bd1d6d4314e7fcbcbc7b2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646127754, "uuid": "5ec85f75-6423-4057-adb3-ff1d98a83255", "comment": "Malware payload (AgentTesla)", "value": "6c9c270fe48bfb05b6f60e6a41903f7a2466fb35", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646127754, "uuid": "e3c551af-6169-476d-a724-d3636eae2dc0", "comment": "Malware payload (AgentTesla)", "value": "086faf02559e1c84e4fde01c2d8695b899fce04abb50587a8406b0d5a1525f862e17fb8fa5cc27886ce03c2ac32c48fb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646127754, "uuid": "006263b4-5d9b-4570-8e93-b6b07d23ad5c", "value": "T161E423B77538F60CB3A99C10A0D61C7AC99E4FC46756961FB38869C0C1B841CA7EFE19", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646127754, "uuid": "10442ea7-bb58-46a6-a636-361438e7baf1", "value": "12288:oyxOAFncVGS5vbcefy+7z+kx2tbDZU1CDVevKTZrKzFLCYWN2z8kA4U:ZOcn+7v8+v+kmbVU1WVfTq+N2gk0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646127754, "uuid": "d3480b87-6ef8-4682-96cd-34ce6b32c52d", "value": 711500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646127754, "uuid": "0fee8ff7-818a-4e1a-8e49-f7f05585659f", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646127754, "uuid": "eba47bf1-9f92-4893-932d-354c9d675c62", "value": "ENQUIRY OFFER.PDF.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4086f161-999f-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646166980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646166980, "uuid": "a0c7d005-d4f2-40c5-ba40-1433dab448c8", "comment": "Malware payload (Heodo)", "value": "1667ef6a13678c89094d11e78a34264c", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646166980, "uuid": "0dc7b368-9865-47c0-9572-07ce465dab8c", "comment": "Malware payload (Heodo)", "value": "5624f9f3d2c1a5f0817f493106ec2496c31c3d716d3d9f5747370e4bb58f72a3", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646166980, "uuid": "ad8f6aaa-78f9-40fe-99b3-d14d3f50e400", "comment": "Malware payload (Heodo)", "value": "e41f9e8915a3b5ef30bfd1052ae095285e38212d", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646166980, "uuid": "6c766b7a-5efd-4521-afe2-4b2b3998ab61", "comment": "Malware payload (Heodo)", "value": "414f4c8bd6221a1669a6497588ec97242ca43044421c5a27aa806b9dde29c358ddd9b922d80d3f07a2ae815600de0574", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646166980, "uuid": "7eabe000-3c11-40ef-9e26-a6e678286841", "value": "T11023D025C1607828C73E8C759200EAD2720A7D04D9D5EF893585BB4C3B96BEB57AF9CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646166980, "uuid": "edc6107b-42bd-494d-8aa3-dc3741904df5", "value": "768:yio9DOevZCwrvtD608zdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Uh0VPWft:yio9D7UtT5fTR4Lh1NisFYBc3cr+UqVC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646166980, "uuid": "6a4c7530-1d96-4186-88cc-43093d05dadb", "value": 47699, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646166980, "uuid": "5559d8bd-3aff-4c17-af37-6adb2a6b4dfc", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646166980, "uuid": "41a02e4e-c957-4fcf-9c95-32fd75cab303", "value": "Opast Publishing Group.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0c4a129-9956-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646135788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646135788, "uuid": "8fe10ee9-3b99-4168-8488-bb8aeff9d542", "comment": "Malware payload (Formbook)", "value": "566d252251957613171fed838fc80268", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646135788, "uuid": "62bc1971-aeb3-4625-9ee1-10ea14c3a145", "comment": "Malware payload (Formbook)", "value": "5645d9e38c998f5db43ae93e35339d7dca0a96b81f806b370624e7410e2eea0a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646135788, "uuid": "fe1aa758-66e6-481f-a60c-1c1b3358cbde", "comment": "Malware payload (Formbook)", "value": "2717de64ae24cdec43ab3bdc6e31adcb4b558c24", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646135788, "uuid": "f96542ae-4158-46b4-977f-0dec3dee5e10", "comment": "Malware payload (Formbook)", "value": "7644fab11582e97e458d48544526f519f106e87e2bfd862c5c690407db2a3018c62857bc19ac750bcf48c972b39a5b45", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646135788, "uuid": "9fbd109e-6d33-49e5-b738-1906ca4e59c8", "value": "T10515AF4835D6607DE8368BB2CAC0EFF0DB29F232D54960B654020E59960DBBD8E45EFD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646135788, "uuid": "e9655ea5-4113-44b7-ae71-e7b577f525a3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646135788, "uuid": "8c5044e0-af9f-46ad-b478-6ca264d2ce6f", "value": "24576:CsIDujOWRv2xfdZPdf2Fcu0a8zRqD0bKdfgzA:CyinVZl2FY5z/bKa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646135788, "uuid": "948d7738-92b7-4f2f-af04-ce41fe45ada3", "value": 891392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646135788, "uuid": "fc162f14-7998-4e82-81ee-849e62caec6c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646135788, "uuid": "e6449a7c-ad7d-4ebe-bbe0-5df802df5e2f", "value": "No. STB42020.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40ca555d-9965-11ec-9275-42010a9c0029", "comment": "Malware payload (DCRat)", "timestamp": 1646142069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646142069, "uuid": "30747a3d-f5c1-4f5d-99cc-0548e3bd5550", "comment": "Malware payload (DCRat)", "value": "b6243dad15ca4b90a98435d9095186c4", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646142069, "uuid": "f0785404-e401-426e-abd9-67ea4370c804", "comment": "Malware payload (DCRat)", "value": "572d0452c9832a4418c5c024282a753a36526b119d0f61854dacbb2c460c7d11", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646142069, "uuid": "456d1951-4ca8-41d0-a2cf-dcb7804bdc40", "comment": "Malware payload (DCRat)", "value": "9757aec152eb74b72953640e374ba4c7bd5e3aad", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646142069, "uuid": "a167addf-5ef5-42c7-8fca-43c23d66d449", "comment": "Malware payload (DCRat)", "value": "4b206b48bb703378b4e22c84d4ca5b9eedbd7f076fda4363d41b38b0f9938d8ca956af9cd3cc53d3ca9866a13802896e", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646142069, "uuid": "7cf8ae9d-bacd-4096-a891-dc6b635efe80", "value": "T10EE495342EEA5029F177AF7DDAE07596DA6EB6A33707994D04B1038A0713B42DDC063E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646142069, "uuid": "6a698b88-1a0e-4037-9290-9cb818afc5aa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646142069, "uuid": "04ec9d66-9ed1-47c0-a92c-a681907b09dc", "value": "12288:eMnvNGlsP1v8jr5vw9TDLVWMBONWb4zhRAA6yONBKwdb0yaYfZNDV:eMn1qkvI5vTof7A6ycBKI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646142069, "uuid": "62e77d68-ba4a-4d91-b56a-2fd8b59cc2e4", "value": 707072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646142069, "uuid": "0534fceb-e773-4643-ba2b-711f479a91c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646142069, "uuid": "3abd3784-3fbd-4bf3-88aa-d09e708b6b08", "value": "b6243dad15ca4b90a98435d9095186c4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63f59801-9929-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646116359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646116359, "uuid": "14f646d4-eeda-4c3a-9324-fe1bc38b5083", "comment": "Malware payload (Heodo)", "value": "183eec2842c7732d25ade2c43561eab3", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646116359, "uuid": "60537ea6-2d4b-426e-a102-bc314b33b8a5", "comment": "Malware payload (Heodo)", "value": "5801752676f828e712b8931112e9eea4ea3dfdf48ee550db8c208c1f94fd1b40", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646116359, "uuid": "5fa212e6-452c-41bc-b1e0-cf53c4e7b595", "comment": "Malware payload (Heodo)", "value": "f71d54c806a023b8c22e26e1182412686ab9c959", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646116359, "uuid": "8a2c0608-6d09-4593-b2a2-8110e8c843e1", "comment": "Malware payload (Heodo)", "value": "cb509080f96e97c681739dcf6a6f19e00b7b1ca386595b9a06faccb0207d881ebd172541d54b47345a89755349a36c63", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646116359, "uuid": "c984608e-e71a-4973-b2b4-35d4fc5c48af", "value": "T1C913D019C4665ADDC327693DD6149AF4120C0E0A89A1FA9F1C54B39C2B6A1F70B5FCF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646116359, "uuid": "414fbaf4-68ca-4e2b-8831-59f2678de330", "value": "768:+/omdH+DOevZCwttqyKfcrND59V+L9Rw4eWrXcTqZ0VP2HLp:ComdH+DoylND59V4jwmXc2CVCF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646116359, "uuid": "ca166c4f-221b-498f-a28d-dd8329eeb46d", "value": 41827, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646116359, "uuid": "e952f964-4757-49e8-bfbf-ac02832d33a5", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646116359, "uuid": "ae394818-14b5-4283-aad5-29e2ae16786c", "value": "Receipt attached.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6586bf41-999c-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646165753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646165753, "uuid": "4620b186-53f0-4d16-99fe-f2fb1380faf2", "comment": "Malware payload", "value": "2464ab12d3fe45448598b83c78ff7421", "object_relation": "md5", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646165753, "uuid": "a8529617-79c6-466a-b967-658538da8397", "comment": "Malware payload", "value": "5849db5783fd9a14dc035f0940b5209f4757bfdbd3980c4e30a5ebbbbe38c519", "object_relation": "sha256", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646165753, "uuid": "2652e27d-0b3e-4cfc-b72d-8dd72851db1f", "comment": "Malware payload", "value": "f519fdf1b327de80134214cec1ae57801d9338d8", "object_relation": "sha1", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646165753, "uuid": "1a12147e-e743-4e6a-93bb-1d3e459db740", "comment": "Malware payload", "value": "4676dd2958032e01bd393ac634793602e3fa5e9cec5d52833fe374b70c91c97bc6cb302d704f5395a95a5d7036f9cdd2", "object_relation": "sha3-384", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646165753, "uuid": "fb169fc7-17f1-4088-9c38-da7f84baf725", "value": "T1D423D025C1607828C73E8C759200EAD2720A7D04D9D5EF893585BB4C3B96BEB57AF9CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646165753, "uuid": "4fa2b569-cff9-4100-b2dd-ba4c9fca02f9", "value": "768:Sio9DOevZCwrvtD608zdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Uh0VPWft:Sio9D7UtT5fTR4Lh1NisFYBc3cr+UqVC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646165753, "uuid": "e44b0937-3d50-432a-a9df-f2a5679b44f1", "value": 47699, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646165753, "uuid": "0f4546af-37e3-460d-9ff0-a219a9731601", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646165753, "uuid": "b91fce9c-e763-4c9d-a682-21d960817ce8", "value": "STY-010322_TZKQ-010322.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9662c7ec-9991-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646161111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646161111, "uuid": "f136effa-1f49-4540-9bbc-c9fa36f2d68b", "comment": "Malware payload (Formbook)", "value": "049fea34ec6a74961a27d11d2c429560", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646161111, "uuid": "bc491feb-b99a-47e6-a2f8-e43ff52d170e", "comment": "Malware payload (Formbook)", "value": "58a3b0684756dd561c0300547a910b82c2b177d7644cca51b1e746302fe8fdbc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646161111, "uuid": "2d11c5d6-9488-4f65-b08d-b4cfc920a651", "comment": "Malware payload (Formbook)", "value": "e39048584db159f732c6f1b332adece7da67b0ff", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646161111, "uuid": "d031c36e-627f-49df-83bc-c2064b76db68", "comment": "Malware payload (Formbook)", "value": "c2f9209471a9873a7ed4a5bfc9e1ea81016c4699aa5db609434def58e037d321c5482549c837baedf82aa36aaa5d9a72", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646161111, "uuid": "23fb8f67-3f4e-4c90-b787-dffcd8d5867d", "value": "T1FDA40518D876A2F1CADB3131A9987F2945116EF2384CC53252FE3E463D59B0E3CA4DA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646161111, "uuid": "8037f1a2-37a5-4975-92bd-c470133bbd4c", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646161111, "uuid": "ade6ed31-bf85-4ec5-bf18-3d9883887a96", "value": "6144:UGiJTyiedBXpBzgjIAQAKzA1h5iUklSLOEsIZO6f47yCRbjiM8uSVpu/:m5UXTIQAKzA1fXkkqUO65CRbz8uSVpw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646161111, "uuid": "8e2e6c75-97e1-4bdb-95fe-68d2c506beb8", "value": 482924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646161111, "uuid": "0d3ec4ee-14ce-450a-9cfa-362f40dbdb32", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646161111, "uuid": "f03a1ed2-0c3c-4713-b574-6935c5331a1b", "value": "049fea34ec6a74961a27d11d2c429560", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d1c5243-9934-11ec-9275-42010a9c0029", "comment": "Malware payload (NanoCore)", "timestamp": 1646121018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646121018, "uuid": "261234c2-231c-4f26-9f65-f39f471e0994", "comment": "Malware payload (NanoCore)", "value": "a0b8b7f4c60761dfd4302e835fc667d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646121018, "uuid": "bac4468a-ddf9-4232-a751-9adee4135cfc", "comment": "Malware payload (NanoCore)", "value": "59158ffa159d5d00b762b547ba6f97a0c0d1c24bc16cb741d9dfe00191ab5629", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646121018, "uuid": "7249e3f1-d920-442d-8c40-a29f076793fa", "comment": "Malware payload (NanoCore)", "value": "377f08b2f52de82b123dbb799bcc2b442c8f5b4b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646121018, "uuid": "fce3ed84-1968-484a-9ba8-2e6162ae5066", "comment": "Malware payload (NanoCore)", "value": "474f972c34e29c4633a39d1293e4de549200066878a341176a0a650b19f06ef164648f1636ab98c2940d00f191ea336c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646121018, "uuid": "9e61a1b2-9121-482b-9f59-76862c437861", "value": "T11784235756C2D973E5E02B7202769F3B5F7A10A0017FAA134BD47FFA2F2384A5912B60", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646121018, "uuid": "8e50d0f7-5648-4433-aea3-d7ea772c8623", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646121018, "uuid": "c4b3b240-5c80-46e2-ba00-50859a50cea5", "value": "6144:dGiyt2iLxBnnBidhXjTaw+YAiExzQqkmh6Ntp1CDDmIJpwBQc8XCt+UhQPJ:oMCnnB2j0YbEFYmoimMp48XCtGJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646121018, "uuid": "190e7e9a-538b-4026-bda9-372ca67eda70", "value": 374418, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646121018, "uuid": "47394071-f3fc-4c45-af36-ce1715b28b36", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646121018, "uuid": "c513edbd-a861-450f-976f-47035cf2c9dd", "value": "DHL Express Courier Pickup Confirmation CBJ19.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46ce9b31-998e-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646159689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646159689, "uuid": "6b6de2c6-6928-4365-96de-91fcb4db0da2", "comment": "Malware payload", "value": "de687e52085477b200c98fbda93505dc", "object_relation": "md5", "Tag": [ { "name": "ramnit", "colour": "#6E87D3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646159689, "uuid": "5605cb25-5f7a-4422-9063-c5a770405eb8", "comment": "Malware payload", "value": "59561642f32679da96576e2ce946233f8ca58e0ddc07f3047e08a1177a471a8c", "object_relation": "sha256", "Tag": [ { "name": "ramnit", "colour": "#6E87D3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646159689, "uuid": "e77e76c1-49e2-4d59-a267-c33d010e140f", "comment": "Malware payload", "value": "433c2461d156ea76d2eb1f9740f5e17ed4c31e67", "object_relation": "sha1", "Tag": [ { "name": "ramnit", "colour": "#6E87D3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646159689, "uuid": "bf36ed08-7edd-4647-a258-6c44edc3f76e", "comment": "Malware payload", "value": "87ad50a0a836379676d26f5074ab610cb96ce6cb10decec44759d722d3b768a7d0fab11c5df083ce74e720084ad43421", "object_relation": "sha3-384", "Tag": [ { "name": "ramnit", "colour": "#6E87D3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646159689, "uuid": "a003b82e-ed01-4d1e-a8f7-aa39fc8569fc", "value": "T15AB3B0C9516944C2EC063EC5AC643BC74735727387F4043426AFAE489FBBDAD8449DBA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646159689, "uuid": "4beb171d-4078-4dd3-937e-072057a917cd", "value": "1536:ByLi+rffMxqNisaQx4V5roEIfGJZN8qbV76EX1UP09weXA3oJrusBTOy9dGCsQSn:ByfkMY+BES09JXAnyrZalI+Y+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646159689, "uuid": "2d1a78db-55c4-4b15-b3b9-02037da29b53", "value": 113064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646159689, "uuid": "a2bcaebb-23e0-47da-aa01-8dea2ef15075", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646159689, "uuid": "134083ea-c195-4467-ae43-cafe98044866", "value": "ramnitsingle.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b041afba-9929-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646116487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646116487, "uuid": "288fe3c2-db40-464c-82a3-16e067b51284", "comment": "Malware payload (Heodo)", "value": "5f7ed32481c0aeadf9bf1f6f675e5045", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646116487, "uuid": "67466ca7-b7fb-497e-bcd0-fd8c4c6e61dc", "comment": "Malware payload (Heodo)", "value": "59f8b871bc1603d1a2e566a9c9b5b627662e4a14811fe1687b6ea59b587efce0", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646116487, "uuid": "bb6dc83e-aa5f-4f91-9171-bc8d08bee87d", "comment": "Malware payload (Heodo)", "value": "b8945d1be6917ae9fb2bfe00a54d7cc6fd0f6ce4", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646116487, "uuid": "187c6337-45d4-4361-a662-966a498d52f2", "comment": "Malware payload (Heodo)", "value": "272d2fbe6c81e8a69dc57c8933b9ac43819348db5b6e03d63f3d02a7a22ce7c6b19ffe3d51a7db64f5b50eed4156fac3", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646116487, "uuid": "5cf55855-538a-494c-acff-6de71422b637", "value": "T18763AE3E57357A2ED6CFAC75C0324BD2832B2346E0AB9569B450F5CB1E732A22B45C5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646116487, "uuid": "ef2f90da-64a2-4991-a227-a9b722a5c2e0", "value": "1536:ByBvEXHLWhxndhjh/VwBpSZobSex7jB0FfuZibVkq:u6rWhxHjh88ZoH7juFuZi6q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646116487, "uuid": "9224e29c-ec05-4657-9791-6c5b2b49b365", "value": 71522, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646116487, "uuid": "26b9b89a-4c91-4b68-930f-0147bf92ace2", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646116487, "uuid": "f16eb7f2-d64b-4bb7-a3b8-ef158ffd09b8", "value": "100522472543965332301.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c6fcc84-994a-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1646130627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646130627, "uuid": "b714e063-a3dd-41d3-ac59-e98c415a5ed3", "comment": "Malware payload (RedLineStealer)", "value": "7080ba732f67cc5a84ed56b215fbbc39", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646130627, "uuid": "ff1447c2-f77e-4e63-9bab-33665cc8797d", "comment": "Malware payload (RedLineStealer)", "value": "5a90de54b9f8fdcd40caa7a5fa4e32e7db9b7e7d98ae4e292869926fca3074f3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646130627, "uuid": "3c82cd6e-6b61-4a28-a5a4-838482756ac6", "comment": "Malware payload (RedLineStealer)", "value": "2b5fb4213b97e66c853740b226456f3ce5d08579", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646130627, "uuid": "a19ba6a6-42fe-42b9-9a9f-a6dbf64748d8", "comment": "Malware payload (RedLineStealer)", "value": "a6b6e965cb8305d157db08269b644375bbfefb5be75eaf75387cc2a4d89c7abfb242079e59b0073de2621c65aad837f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646130627, "uuid": "f57eabf9-d9c2-49d2-8780-20b261c364aa", "value": "T1C564AE00BB90D036E5F312F8857A93AD753F79A15B25A0CB63D52BEA16356E4EC3130B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646130627, "uuid": "d9af2ce1-396e-4cb1-acc4-7806af2002f8", "value": "803999de15851b525de7455d6fbe3205", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646130627, "uuid": "5aaaad2a-d7c9-40e0-9521-b065b5a41fc1", "value": "3072:87OUWKmRylQ2dIwSogVteaJCdoijwqCQuLroozYM225CirK0E5bGYLS/VwJ5sSaS:IrQMIjogVKoij7CQiooztBlE5nHVadg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646130627, "uuid": "73cb4927-b098-4d7d-834e-54f4e40e9d3a", "value": 333824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646130627, "uuid": "eb72c4af-9400-4ff3-8dd2-5616e4e5443d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646130627, "uuid": "3629aed7-f478-4504-ab72-b1afee73c308", "value": "7080ba732f67cc5a84ed56b215fbbc39.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c993fe0d-9977-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646150030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646150030, "uuid": "f75b4746-5a88-4e1c-8876-adc3f74f21ac", "comment": "Malware payload (Heodo)", "value": "3dabb93eacc3c68fbb1453f21dc2d526", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646150030, "uuid": "840366a3-414f-49d9-8b0b-42c716798c5c", "comment": "Malware payload (Heodo)", "value": "5ab232c4e89b0da375b5d8459181f0516bd5d0b09e87893dc0034e60cf625c39", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646150030, "uuid": "d892a190-f783-4256-9e9f-49392483a537", "comment": "Malware payload (Heodo)", "value": "31d72c768eae7483e0c7f97dce3b70a54c520829", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646150030, "uuid": "216c3042-5882-4211-8515-185cb7263280", "comment": "Malware payload (Heodo)", "value": "d468c65122bd553ba6b8d3fcc7790117692aa8bc331d37c14af6addf0ca364072fcad120d23b105f23cc0a4e46d0dc08", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646150030, "uuid": "cfd6807b-3870-4a58-ad40-d2f8a72e48b2", "value": "T17823D025C1607828C73E8C759200EAD2720A7D04D9D5EF893585BB4C3B96BEB57AF9CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646150030, "uuid": "a123a98d-e02e-4685-a415-d1bf90a707ee", "value": "768:Oio9DOevZCwrvtD608zdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Uh0VPWft:Oio9D7UtT5fTR4Lh1NisFYBc3cr+UqVC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646150030, "uuid": "a4ab9240-67f7-48d9-a521-caab900824d8", "value": 47699, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646150030, "uuid": "90f21b8c-79f0-4455-b901-ff21b34c51b8", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646150030, "uuid": "0fa3eec7-def2-4f44-9726-a8b7118b3650", "value": "Ommega Publishers.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1895e6e9-994f-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646132553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646132553, "uuid": "e21cccc8-d41c-4229-8d65-cbd76e5d8d5b", "comment": "Malware payload (Heodo)", "value": "19fc2bf9798db7f68729dd4a7fa4b939", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646132553, "uuid": "d89cb86c-232e-4751-a726-b218c6442c32", "comment": "Malware payload (Heodo)", "value": "5aef1432b91d3ca63c223b4540d7a8775e225c83c2eaf3ea4575209540081d58", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646132553, "uuid": "9b2f02e7-a5ee-4577-9013-27e29aef4404", "comment": "Malware payload (Heodo)", "value": "d043ddc0665b43be02648dc94676fe90d0a0c6fa", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646132553, "uuid": "5f6f7c91-8b6f-4bb4-a570-5f5ef50d8676", "comment": "Malware payload (Heodo)", "value": "5f0a92aa76dee5f87635bce64e7bae18bfe50ad89b7328d7df17e55e511d30edf7dd863974363307d3a8fafa37b70114", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646132553, "uuid": "ff44a638-4fe3-4d40-b11d-107de78799ca", "value": "T1ED13E02AC0961959D727283DD6148EF4124C0E4A89E5F99B1D50B3AC2B6E1FB0B4FCB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646132553, "uuid": "d182d192-fe48-4caa-ab67-3cde7c5533ce", "value": "768:m9oms9O+pOevZCwtxyKfcrND59V+L9Rw4eWrXcTqw0VfWZE:m9oms7tylND59V4jwmXc2RVfW+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646132553, "uuid": "b529f32c-4c7b-4af3-9b0f-418a82d6aabf", "value": 41841, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646132553, "uuid": "8f112f71-5ec6-4978-ab6e-3a52d2d93e45", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646132553, "uuid": "e98262ec-6934-42f8-b68a-51f09149667d", "value": "INNOVINC.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2e912d1-994f-11ec-9275-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1646132866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646132866, "uuid": "bff23305-cf8a-4c1d-b0b2-32a066a042d4", "comment": "Malware payload (Quakbot)", "value": "68fdf743bff4c9044bc81eb6fe4ee1e9", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "THE FAITH SP Z O O", "colour": "#87FB2C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646132866, "uuid": "b452967a-6de3-40ec-a5ae-7beaf066a0ff", "comment": "Malware payload (Quakbot)", "value": "5b3a17806d05211b9eec5ba1617aa508e874cd3f806fe0ef2ddd53f4b1a964ea", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "THE FAITH SP Z O O", "colour": "#87FB2C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646132866, "uuid": "b27746fc-c46f-4fcf-bfd0-bcd83895d4fe", "comment": "Malware payload (Quakbot)", "value": "910ec25290829c8c76a6290ba7d0329731187940", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "THE FAITH SP Z O O", "colour": "#87FB2C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646132866, "uuid": "43c0db6f-1f07-4518-97d6-3c2d97b3a870", "comment": "Malware payload (Quakbot)", "value": "fc5f2b5780ae1c540a4313a7b4aefe863df5abd27111e52ab930071c672a8a221aed2b4f16763891b783aeb7bc97ebc6", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "THE FAITH SP Z O O", "colour": "#87FB2C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646132866, "uuid": "84457de7-3f94-4487-97ba-7fd88d6741cc", "value": "T1F025F94286642A0DFD3DCEFB6F3AA3ED40664F70192AB256E350288951B81F1723DF57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646132866, "uuid": "a65f9c95-7cea-49ba-8e81-726f6769d0fa", "value": "a2c4c1cc45cf157e67048505a3f85c3c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646132866, "uuid": "bc66758e-961c-4e28-a373-b81663750975", "value": "12288:Zg4d/lpygJCNLgUgYUypwKzpVCD2aep4Xl8I1JV5OwBi6fC8a/ZnFH08hXhQrVNP:ZdddhCN3tVwV1Twh/n/qVh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646132866, "uuid": "5d0d735f-ee84-4c26-8280-276b561bcc12", "value": 977865, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646132866, "uuid": "ff2bb985-4b1c-40d2-ad89-b719bfd146dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646132866, "uuid": "0d450e8d-6f0d-44a9-b425-bf53d6a88ce1", "value": "5b3a17806d05211b9eec5ba1617aa508e874cd3f806fe0ef2ddd53f4b1a964ea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72323acb-9958-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646136569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646136569, "uuid": "bfce255d-ac00-404c-b484-8fe5a6af62c3", "comment": "Malware payload", "value": "a6e9d6505f6d2326a8a9214667c61c67", "object_relation": "md5", "Tag": [ { "name": "Daxin", "colour": "#652B35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646136569, "uuid": "b179b5d0-347c-4ae3-952b-18ddfdfc5b27", "comment": "Malware payload", "value": "5bc3994612624da168750455b363f2964e1861dba4f1c305df01b970ac02a7ae", "object_relation": "sha256", "Tag": [ { "name": "Daxin", "colour": "#652B35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646136569, "uuid": "05aaafdb-71d4-4c36-b01d-d3e0c1862064", "comment": "Malware payload", "value": "cb3f30809b05cf02bc29d4a7796fb0650271e542", "object_relation": "sha1", "Tag": [ { "name": "Daxin", "colour": "#652B35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646136569, "uuid": "c6a89d89-7b6e-4644-a11c-c8144414d365", "comment": "Malware payload", "value": "65eef1a9f50529a3dbd6afdba208f7586bd55c00c0bec0611a79471bfb451cc2860c82782a9bc2ff4bb6b68494d148a8", "object_relation": "sha3-384", "Tag": [ { "name": "Daxin", "colour": "#652B35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646136569, "uuid": "dc839c2e-4bb6-4b56-af5a-80e3a6a46c33", "value": "T114C5F1FD6144335CC45B8474C423ED4AB1B6562D4AEA95F9B8EB3BD07BDB420EA02F42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646136569, "uuid": "c7b8398e-bb48-470d-b4f0-18f1594e4ab7", "value": "c9a6e83d931286d1604d1add8403e1e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646136569, "uuid": "f29c53b9-2895-4d24-8203-1b24fb364d5f", "value": "49152:wt2EX2c4BB8MbT9pDbe5xZPHVZpny8S4LQvo3i88/F7dXXjBFFMMUVymn:42EX2c4BBZbTLDbeFP1vny8NZSldHjT0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646136569, "uuid": "0580e980-7125-436c-bf42-daca18c6257f", "value": 2722880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646136569, "uuid": "38c882b0-a3dc-4be3-ae55-c29b46840a28", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646136569, "uuid": "1c325800-30ee-4f1c-80b7-87982c227c85", "value": "5bc3994612624da168750455b363f2964e1861dba4f1c305df01b970ac02a7ae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12c470dd-9998-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1646163897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646163897, "uuid": "052c5ce3-50a9-4abf-8cb4-7882b0dd0458", "comment": "Malware payload (Mirai)", "value": "dcfd8bb144429d001cd6c87fe0fbd185", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646163897, "uuid": "ec56e6a2-4532-4c69-b494-0fe4bf428f8d", "comment": "Malware payload (Mirai)", "value": "5be1d0bb58b4c202f31bc0099f202d110bd5fde3615b545edb27bee708c04f19", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646163897, "uuid": "aa7e2ea4-4329-4ed5-8672-18ef4f5cfaa2", "comment": "Malware payload (Mirai)", "value": "5c6051b76feba04f9bf955f44203d7151d0ee7fa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646163897, "uuid": "00974e8f-c54b-4d75-8818-ae67156ff162", "comment": "Malware payload (Mirai)", "value": "206a5fc0597c3677e12d24b6787a26e588f2370169c40948f998be04f9d8162e312cde1b04c7025bd7adfbe2a5f24559", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646163897, "uuid": "efe7345e-92e9-450e-ac71-86477a0d3e4d", "value": "T196439E62C42BAD68C5194670A4648E304F73F01496972FF59D8BC662D443EACF29D3F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646163897, "uuid": "b64c5a1f-7f6e-49e5-b1ce-70cde9fa875e", "value": "768:+aoZkDheshqFhelheUhekhezziMSVqebReaR7wmNyyHCR+aoOJk39NvC2JUW1:+aoul1a+tlMPveblMm9HN9OANvC2J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646163897, "uuid": "78db5dd6-9dd4-49b7-9324-f5032f8184a2", "value": 58832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646163897, "uuid": "bf97a421-a8b2-46ce-9ed1-a200acebbfc9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646163897, "uuid": "ea129a66-3080-482f-9bd6-f0803fca14b1", "value": "dcfd8bb144429d001cd6c87fe0fbd185", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dcb6060-9958-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646136561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646136561, "uuid": "cad09f4a-48bc-497e-b043-3070eaa73632", "comment": "Malware payload", "value": "1cd158a64f3d886357535382a6fdad75", "object_relation": "md5", "Tag": [ { "name": "Daxin", "colour": "#652B35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646136561, "uuid": "6283ad1b-af9a-4ee5-9f8c-12db54c85eab", "comment": "Malware payload", "value": "5c1585b1a1c956c7755429544f3596515dfdf928373620c51b0606a520c6245a", "object_relation": "sha256", "Tag": [ { "name": "Daxin", "colour": "#652B35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646136561, "uuid": "2d094a18-3614-4174-9ac4-68cc5c73f000", "comment": "Malware payload", "value": "a48aa80942fc8e0699f518de4fd6512e341d4196", "object_relation": "sha1", "Tag": [ { "name": "Daxin", "colour": "#652B35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646136561, "uuid": "96f41ef2-f2cf-43c5-9016-8ad5e42468c9", "comment": "Malware payload", "value": "d29eac4038e99eb3f0b55d5771cbea14de91cfae61ceea3fcae1903d99036fcda559de7ce0c48845be7f41c1c1e1ac59", "object_relation": "sha3-384", "Tag": [ { "name": "Daxin", "colour": "#652B35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646136561, "uuid": "0619967a-64bf-4963-a913-44007c1ad413", "value": "T17C1412E30AE61693D93915743FC3AFB99A348107FE59046E62C07B5076BA2E8590F742", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646136561, "uuid": "3b462224-5790-4e3d-a6e5-475870b75023", "value": "bf9d32a6ab9effcd2fd6a734e5be98f9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646136561, "uuid": "e416f771-d04d-45ab-9d53-55106e3242c0", "value": "3072:7TiR8+//JH3IS8TsN9pjEI9b9VBm43Jm3tUIiNQb15fja/9wuFq+Hr5emy:3iF/h4S8+pQqbc32IdHLowTSemy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646136561, "uuid": "7b0a78b6-72fd-4ffb-984b-7dcc13dc4979", "value": 192576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646136561, "uuid": "54f07aff-118b-43a5-9e09-3e6ebdc1e61c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646136561, "uuid": "23ee377c-8834-4ee9-acd2-c578a10f75be", "value": "5c1585b1a1c956c7755429544f3596515dfdf928373620c51b0606a520c6245a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0881b175-992d-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646117923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646117923, "uuid": "9dc399f7-2265-4f77-b666-979e00c84160", "comment": "Malware payload (Heodo)", "value": "63d1fe6db5afba73dec96c30974abae7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646117923, "uuid": "4e133714-afc8-4c79-89d6-4de5dc3953ee", "comment": "Malware payload (Heodo)", "value": "5c8490b08d2dfbc5564a4e65cd7aeb89ee12cbb0fe1927a120ef30054ea27823", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646117923, "uuid": "61bea7be-6b6d-48ab-91c7-8ef8714c464b", "comment": "Malware payload (Heodo)", "value": "c3b931bcd1b4fbd37d11d9cba223ce10439f27df", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646117923, "uuid": "4e57ca64-d198-45e1-97a9-c9ac27d516d6", "comment": "Malware payload (Heodo)", "value": "711eb44be0f910dd6f1089ce39449c3d9ac1551680b226e0a34aaff71dbf24d4e2be8c5256f7a6247c4b176aa6ace922", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646117923, "uuid": "586826c1-3917-4ac1-a8b8-d209a1bbb454", "value": "T1F2D47C82F7429EF2C00B03347C32B2586BADEAD5D2158D6B9398A5AE1F35533493DE43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646117923, "uuid": "d3d06792-1583-412e-9607-9c8f774fc6d7", "value": "e0b213ccd96f46d30dcd8e225f4e9fc9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646117923, "uuid": "a2af98fa-2da6-41dc-82ba-9162640756b5", "value": "6144:XjPgWGbb0OEmS9Vzf5WI9nI1LSfcaEMyhKmZHNRuIfv7YtaIIo0cm59CH7PQ:X0bEtf5WyI1LSfchfxhstaICRLmrQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646117923, "uuid": "d9a73dbf-0441-4104-bb70-4c46705f13bb", "value": 602112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646117923, "uuid": "b73e64f4-2286-42fe-a317-9450a6887435", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646117923, "uuid": "881a6e1e-3542-4017-ab22-5d8d8a999811", "value": "63d1fe6db5afba73dec96c30974abae7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6d11e9c-9946-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646129034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646129034, "uuid": "70a1d749-bc03-48b9-8f23-7d4f8909bd89", "comment": "Malware payload (Heodo)", "value": "8e3ba741cc9317d59ceb9f20e87a2beb", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646129034, "uuid": "9624ef67-225e-4768-90b1-6123bd60fb3a", "comment": "Malware payload (Heodo)", "value": "5ca0078d88fc0c10c3269d9fbaf1858ed587b683e655034f82da347aa4c73bb8", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646129034, "uuid": "d03b8b7a-f591-4de7-85e9-a4f60389c080", "comment": "Malware payload (Heodo)", "value": "3c728b73aee5dbbc0cd9c7e382a083cb463e9031", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646129034, "uuid": "c0fda428-17e6-46aa-ac3e-6547a4139a6b", "comment": "Malware payload (Heodo)", "value": "6c7f4dcbf54c559292fabdcfb401490b6a70aaae3088a800f2a441f5ed38d308581e68985ab919e615da0c6d1cc50145", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646129034, "uuid": "f0f88b38-f509-4eb6-ab59-66f78f3bbbcc", "value": "T1AA13E02AC0961959D727283DD6148EF4124C0E4A89E5F99B1D50B3AC2B6E1FB0B4FCB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646129034, "uuid": "3f90a8e2-1739-41d9-8983-423a5d5f3376", "value": "768:C9oms9O+pOevZCwtxyKfcrND59V+L9Rw4eWrXcTqw0VfWZE:C9oms7tylND59V4jwmXc2RVfW+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646129034, "uuid": "d08bdf58-ed56-4178-839b-8c1a7d1922ac", "value": 41841, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646129034, "uuid": "77ee8532-b1c5-4553-b129-6188edb286f1", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646129034, "uuid": "d33e87af-a2ec-4075-8794-ede27e334d22", "value": "IRZ3324449972.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "474bffd2-99a0-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646167421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646167421, "uuid": "15c5a9dc-ceae-44fb-8c3e-d35ee4504653", "comment": "Malware payload", "value": "949d5d9d46e8adda004f8e7734c55600", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646167421, "uuid": "8b2a7a19-bdca-4488-aa98-755467844f14", "comment": "Malware payload", "value": "5cf233d7267a011a4e21064d530fc1b6e80f995b22cf86b29e773d13a463a628", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646167421, "uuid": "0f33db74-c0e5-4528-848f-4cd5d5b19297", "comment": "Malware payload", "value": "ac3753df0b8645053d2347d75da28168be0f5126", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646167421, "uuid": "6fd86472-6679-41a7-ac8c-7fb609e43f1d", "comment": "Malware payload", "value": "199787b34149e5765a3555e0e64f72b0d7ef97732c8446e13f5ad786208f87e2811b9a8ae3c6df97743d7b88ea98c411", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646167421, "uuid": "dc60a1d0-006a-460e-ac9e-62c1f2064cc9", "value": "T15E451240FAB0D039F1B355F479B597ACA62E3DA15B2055CB22D62AEB17306E0DCB530B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646167421, "uuid": "47fae4a1-5928-4695-8c22-270eabd5e8f1", "value": "e0099c0ba3b564d2d3b0381e49f6db7c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646167421, "uuid": "40d03b13-b1e3-4e3b-aeac-b1ec16b35224", "value": "24576:eyLutOdBT0XDYxD9Z8qshIFfDKyOdePuKsyy0zAj:AOdd2MxD9Z1shYKFdmOj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646167421, "uuid": "8a16939a-7275-400b-8ea4-27bc94bb0bb0", "value": 1256960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646167421, "uuid": "d226b8c8-b1cc-4451-9419-879a488b4734", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646167421, "uuid": "8d524bf2-63cc-4c31-b39f-1b12ef572a15", "value": "949d5d9d46e8adda004f8e7734c55600", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae040415-9932-11ec-9275-42010a9c0029", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1646120348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120348, "uuid": "5643f2ec-698d-4d7d-978f-98cf45adc442", "comment": "Malware payload (AveMariaRAT)", "value": "f95701ce9d006b05f5b1d453b5e13bc3", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120348, "uuid": "c77576b4-640f-4f72-9797-7d7c88b4d101", "comment": "Malware payload (AveMariaRAT)", "value": "5d6515052058ca580fa2280e02c2c2fc29fd37235b7f09f3159974aeab966b2b", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120348, "uuid": "4c1975e8-8830-485c-8bb2-93af76a4fe07", "comment": "Malware payload (AveMariaRAT)", "value": "93395e80f752225ae9391347825d7aa48af16af8", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120348, "uuid": "43c0e163-a8b6-4b8e-80b3-c9e472d83bbe", "comment": "Malware payload (AveMariaRAT)", "value": "bde0cff530d6e350fc93c518046565b548a22e6b5dc91beae47e9b9182a4ac7bf6773f012862d0944b0d9940a01ad4ef", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120348, "uuid": "1b8bfdf2-6140-4e1b-9bac-54f4427fd6f4", "value": "T18E5435A0682F0976E748BD0E50E1704A1DF6FEAAB0C19732539FA964DFD46F18EC0857", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120348, "uuid": "51b56922-d525-43da-8afb-f5ac581bd8a7", "value": "3072:ide9uXcR06QRQe9uXcR06QRQe9uXcR06QRQe9uXcR1Ee1P3g4dzFtr5RDAw5wfQ:cDpdzFt1RDAUwI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646120348, "uuid": "0a1dc702-ebb0-4287-9179-1171e891e793", "value": 293044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646120348, "uuid": "72f4fc11-bce4-4367-b4d7-3d90923f4e76", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120348, "uuid": "0e0e06d4-d134-4d89-b8cb-3d79ec6e67a9", "value": "2022 selected samples catalogue designs.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d87f67a-9931-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1646119757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646119757, "uuid": "ee4cd74b-ccef-4b83-80f8-893105ab9884", "comment": "Malware payload (SnakeKeylogger)", "value": "d81a1d3e5e377927be094ea2364ba291", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646119757, "uuid": "2e28beff-245e-4a28-9032-260cb783c48a", "comment": "Malware payload (SnakeKeylogger)", "value": "5e8eb8d2e1ba90756915c1a717da45749c3fbc14ae25518cd694146f6fbd7891", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646119757, "uuid": "34cd0c91-7803-4040-81c8-56de7837f28d", "comment": "Malware payload (SnakeKeylogger)", "value": "8aea0040ba5fe121aa4217ed73ecdcd065270827", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646119757, "uuid": "e7a3aa05-617e-49a8-8059-74bd623a5e1b", "comment": "Malware payload (SnakeKeylogger)", "value": "9031041a766bd85fad3b31a2bcc82ba0bbb84641fa2229abc5aae6a0a3ad6f65d83ce63dc5407770c3d64f5573849016", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646119757, "uuid": "45e410ec-42dd-408f-9bf1-da9e35a1a456", "value": "T14AE4BF0839E75039F83A8BF1CEC4EBF19B6EF221E54860F5A4000E598655BBC8955EFD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646119757, "uuid": "2c4e9f61-9aa3-4e0a-9c0f-56ff5f4d31ed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646119757, "uuid": "7ef84063-6071-4b00-9e1b-c3a89d114882", "value": "12288:lEYYR/InEm/sxX6sauvx6Q2BKQeStMc7zZAIWX7jSUL:oysJauvlaKQnMOWI6SU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646119757, "uuid": "170534b5-1dd7-4e49-9dd2-f6a7d3ae6756", "value": 720384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646119757, "uuid": "6d83a232-b72e-4947-b4de-412ef16c59ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646119757, "uuid": "251b49dd-807e-4a02-8433-a3b325928b03", "value": "5654343-9876576.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b52a33ec-998d-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646159445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646159445, "uuid": "679c252a-18ef-41c4-ad07-e46719ba3fb9", "comment": "Malware payload", "value": "2f7e63f16aacb4bb3e1ee126bd8688a0", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646159445, "uuid": "57e7629e-4dea-4426-a83c-887d5eeb30b6", "comment": "Malware payload", "value": "5ee4f32919e541d6c57f5f297e08c40c316d64de36bf21b34f2e556136addc40", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646159445, "uuid": "25a3b212-db2f-44e5-ad22-7bf03a5e0bff", "comment": "Malware payload", "value": "8fd1306c024127d7e4d10c7d67f7e638c61ff33d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646159445, "uuid": "b6783be3-e6d6-4c73-aeec-aa6fb7986ee2", "comment": "Malware payload", "value": "e028f0a314b5a9e7b6edf9564acdd6561aa5e2ff6f5ffa481733027f1e20363f7a024aecd3be192808961c8a89935b53", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646159445, "uuid": "c83aaa7c-af64-451d-ba9a-65ea5d5a9ba7", "value": "T139B4AE12B790C076D1AA36342526A7B51AEDBC709EF5C3876FD03B7E5E301918A3C35A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646159445, "uuid": "fc7e83a3-039f-4f50-9af4-44bb267fbc6a", "value": "f08242131de62ca6d7c4b2727b491b3d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646159445, "uuid": "a150a11d-404c-45a7-9a16-43010c4d2b62", "value": "12288:jE3TMKM/JjdkdO4+BNhOwyM4h43JopSz/o:jE3TM/JjdkSj3Ko", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646159445, "uuid": "39120ec2-10b3-490b-9cad-69312131fe53", "value": 505856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646159445, "uuid": "8c397f03-6494-420b-96f1-e899d9c296a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646159445, "uuid": "385b3195-fbc9-49cc-b716-0d1ae7e38c57", "value": "aew.ocx.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bdab924-9933-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646120640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120640, "uuid": "6d11c5cf-54a9-46fa-bf76-662b6021473e", "comment": "Malware payload (Formbook)", "value": "3550919e6f8cb1710285ba11a8ed08b7", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120640, "uuid": "1041a1c3-14c2-43ee-84a2-6d0b893d1576", "comment": "Malware payload (Formbook)", "value": "5f16eb40e0fd611f64ad78dbe19eeae04cd2325ad7d83c8cd78cf93837ca75d3", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120640, "uuid": "e0aa5f30-218e-432a-afc4-ed7398d6feb7", "comment": "Malware payload (Formbook)", "value": "42a607f1d3d5bc25360175f2836755b257c68b8e", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120640, "uuid": "3f3c6223-00c7-491e-9f4d-0866e97e629b", "comment": "Malware payload (Formbook)", "value": "0714db734524484c436fdc775e6c5cb9274706c4cbed545bf41fa30355773aa570f4b461303cd67be05128c0648ddd6e", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120640, "uuid": "acfdb203-c369-43f1-9821-7f642240d968", "value": "T1FC141255F1166B90E981D37C213BA09AF2608F542F5CD98B63EC7F684DF6AF83004AD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120640, "uuid": "1d839fbe-e0d3-46c3-b02a-4c5ca7558705", "value": "3072:MD2rC07AkK++tWKVZE8CV0svw0m7i6ldL2kRWDyveELFjXwEqE1FgpxAC:s22cEtWKVK8103WdnReyjLapAgpxf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646120640, "uuid": "bec467b5-1d1d-439c-ae18-bb815b5ae9fd", "value": 190504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646120640, "uuid": "da59e995-3ef3-4da7-9ed2-7b88cb090d5e", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120640, "uuid": "42554e2f-edf6-4669-b3eb-c1939c9989cd", "value": "NEW ORDER, FEB 2022.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0beebeb9-99b3-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646175482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646175482, "uuid": "d56a881c-67af-4a5c-95b2-8a1b33d5a854", "comment": "Malware payload", "value": "890dac03e01c6a785bbb1253e32f8ec4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646175482, "uuid": "9f2d5f86-c34d-4dc2-8f66-9973fbebdf65", "comment": "Malware payload", "value": "5fb906b316a1158624ae3da23a4f738808f7b1a9e662b9fc1dca9dec3feab457", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646175482, "uuid": "89ddc78b-b40d-4f5d-9c59-cbee98076656", "comment": "Malware payload", "value": "ffe8017e7265ba01d2cee20bd4c92421f3197bf1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646175482, "uuid": "54f954a5-7cc9-4ed3-be1b-cb0f230e24c4", "comment": "Malware payload", "value": "eaf50b7958d1544b14574cd22078fb5002c6549cac0f5a30ff6da5b021a638f354d0040a3ad88054630952de91a23bfe", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646175482, "uuid": "d4861881-569c-4aac-876e-d16756306e08", "value": "T195B4AE11B7D0C072C26A35342926E7B656EEBC719AF583876FD03B7E5E301D18A2835B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646175482, "uuid": "ffa866ae-7f9f-4e7c-a51c-42a93ae9cda4", "value": "d02245ac5c961d83d0907c826d8ba5c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646175482, "uuid": "cdd05906-89d4-4fd0-bde1-35e1795491ef", "value": "12288:JhC1q3aXOwkiPs2iCtyjkOAIlgOkar//wJY8Itgm:Jgq3aFkiPs25ak2Bkm8jm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646175482, "uuid": "ef1aec68-e3e0-472e-a688-17785f4e0c7d", "value": 499712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646175482, "uuid": "8131f5ce-ad28-481f-9f14-9d89951004b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646175482, "uuid": "abf392a4-a28b-4546-adc2-72b8a614565c", "value": "890dac03e01c6a785bbb1253e32f8ec4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15a48bb6-9949-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646129971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646129971, "uuid": "fb29c498-420b-4583-a651-0cb4a967640a", "comment": "Malware payload (Formbook)", "value": "6aa39e4ee824e298eaa69e42d9ac04f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646129971, "uuid": "0fe9ad57-6c2f-4f6e-ab7e-02ffb70e60bc", "comment": "Malware payload (Formbook)", "value": "605353b30400dd2065e8197d1ee3664907c67dda7fb7f1668fd6f61bc12fd6a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646129971, "uuid": "bb24f925-7fb8-42b2-8ebc-5444df92258e", "comment": "Malware payload (Formbook)", "value": "45349e644bec1564b2b885aece67eaa1364ddb26", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646129971, "uuid": "d0597814-2ffb-4811-beac-dc6b5a667b19", "comment": "Malware payload (Formbook)", "value": "3f906cade1f3ab0d91ae00bd4a4c3148c214e8efa407575e49db8fdac564b026616fd734d5a2be80b78b0647394d6730", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646129971, "uuid": "985d469e-993e-4bfc-b9e7-8c76dcba7141", "value": "T1706412993AE88C97E9505D3019F5B73EFBBA538807D60F236F5C1D7E7B2019202245EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646129971, "uuid": "0510b239-4ef0-466a-b930-6a097a706386", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646129971, "uuid": "333e6004-8782-4347-8486-4115edae5ba4", "value": "6144:rGipdAl3Ck0vI/13/s/Z2h6logUmA2CeVG2soH2SLDH1bDWu:YZzl3/GZ2hs5GhGz1bDd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646129971, "uuid": "df7a5c1d-d72e-42a4-98c8-472cdffa50ac", "value": 319871, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646129971, "uuid": "bf51c438-e09f-4f07-b58b-0850aafe01f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646129971, "uuid": "d5ed8dcb-cf27-483e-a173-69410bfb3cb7", "value": "payment receipt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c35d52d-9961-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646140424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646140424, "uuid": "af14a909-65cd-4bf8-806a-9fe94a2ba641", "comment": "Malware payload (Formbook)", "value": "0fe69c309ca81a5b9d3bfab447ece2a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646140424, "uuid": "f50f0975-6c7b-43e5-b9e5-5a797384340d", "comment": "Malware payload (Formbook)", "value": "6077a6a5a6270bd0cbd94bd424294d9c1afe129e72ac671db981245f4e294234", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646140424, "uuid": "726d44ab-9142-469f-869e-e7a29e0eba0a", "comment": "Malware payload (Formbook)", "value": "d30660a65b36800eaf860dac1f590f8c66b199b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646140424, "uuid": "123aa1b7-b51b-4801-80f0-563ebe4db23c", "comment": "Malware payload (Formbook)", "value": "7af78aded4a73059c4ecdbd05fd516d4057a67e70977927df32c07b99e0262fb4bd3628903f025febf42ad95b0734ba2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646140424, "uuid": "e00ce205-9bc6-434e-bd37-404936c989f9", "value": "T14EF4AF1839E65038F8368BF1CFC0EBE1DB6EF221D489A0F554000E555656BBC895AEFD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646140424, "uuid": "908b63d0-74ef-4b06-9bec-64fb0b6ff4c9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646140424, "uuid": "0353cb73-33e1-43c8-9f31-0d40ca875f4a", "value": "12288:fEIcR/Io1P2n4tAP+9zQ+jK4Jm5+TBnka/ubaC2dS433iWEF77yZZyw:6Y4tEMQr4o5+Z/HC246i/7f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646140424, "uuid": "ee51083f-17c3-401a-b542-d46688006088", "value": 749568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646140424, "uuid": "33bf623e-ae97-4385-90b6-6b47f83481c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646140424, "uuid": "db3cff11-4086-4348-932d-480f6dfeb0bd", "value": "SecuriteInfo.com.BackDoor.SpyBotNET.25.30611.25281", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5dd1179-994f-11ec-9275-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1646132871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646132871, "uuid": "b7cf2003-7755-416e-9091-382dbbeb9ad8", "comment": "Malware payload (Quakbot)", "value": "087a19dda4ed46ba5a52f4ea3c260198", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "THE FAITH SP Z O O", "colour": "#87FB2C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646132871, "uuid": "d565e36a-180c-4c0a-a135-a256508e0448", "comment": "Malware payload (Quakbot)", "value": "60b9fc17e4f2ee7816973a2a368c213e53c09e4a77de1314b38d5feafe1c0a94", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "THE FAITH SP Z O O", "colour": "#87FB2C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646132871, "uuid": "2b3bcca3-db27-4d01-af24-05f6fb88a680", "comment": "Malware payload (Quakbot)", "value": "ef47d90f95be2793c8175679dbc98c8fd3043f9c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "THE FAITH SP Z O O", "colour": "#87FB2C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646132871, "uuid": "44e82847-7ea0-4d39-bb83-48c13a5d9106", "comment": "Malware payload (Quakbot)", "value": "24d9bbbfd5b65dbb37a4bcd062edc5bd2aa4452b55d776b8b20c1afde74ed23ba5d248f242108be391c4199b5766417b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "THE FAITH SP Z O O", "colour": "#87FB2C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646132871, "uuid": "bdf113e8-c5ff-4f50-9eea-4435bec3f20f", "value": "T1AF15F94286642A0DFD3DCEFB6F3AA3ED40660F70192AB256E350288951B81F1727DF57", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646132871, "uuid": "22fdaaa1-6a8c-4327-a29a-80b4e3dcf0c0", "value": "12288:kg4d/lpygJCNLgUgYUypwKzpVCD2aep4Xl8I1JV5OwBi6fC8a/ZnFH08hXhQrVNF:kdddhCN3tVwV1Twh/n/qVht", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646132871, "uuid": "f23a5d75-632c-4d12-ae9d-15582a3b5c9a", "value": 956824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646132871, "uuid": "0c9b4fe1-4de3-40e5-aa25-f3b199e07b9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646132871, "uuid": "a2a96d6d-d576-4e89-9ab5-ff52c9804f12", "value": "60b9fc17e4f2ee7816973a2a368c213e53c09e4a77de1314b38d5feafe1c0a94", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab9fe505-9932-11ec-9275-42010a9c0029", "comment": "Malware payload (AsyncRAT)", "timestamp": 1646120344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120344, "uuid": "2857a153-267c-47b4-b6f3-2745dfab5a20", "comment": "Malware payload (AsyncRAT)", "value": "8426095f758e30898cfab26e75684079", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120344, "uuid": "fa39b6d9-395e-4f36-a7d1-7310ba2cbd09", "comment": "Malware payload (AsyncRAT)", "value": "60f4e05710213731a1f92cf6c48a3818eb7c9ecf3f0236f4034994ad0a953079", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120344, "uuid": "84f15520-1758-48de-9484-654a6a0331d2", "comment": "Malware payload (AsyncRAT)", "value": "b4aa2256a91b2ac7e9e32c4a4d8b8cd38f5b11d0", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120344, "uuid": "6c25c89b-1072-4d21-9a6d-4e0af46bd04c", "comment": "Malware payload (AsyncRAT)", "value": "7763507ec9aee9a555eb96e5ceafa3a6474b513a371dc1b89bf1efe0b5d7a9065174f099d2939e6b4921b36ee69bfff4", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120344, "uuid": "d0265d1a-bb6b-442b-adfa-bb956dac2f9e", "value": "T11C426D632F2C1C8BDD1BD0D4C8B0FC5A89DAF42D5ECD094472ADF9700B8A72A997159E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120344, "uuid": "7a31f102-6adb-4d78-8395-4db72a375ed5", "value": "192:drZFX2DjTjwovqQ4FBPzi1ZmI50ZCFYpiZbgNyBkur90i8k1cze0rTmwPKRhfdOT:bFXqvERQIPzia0uZpiZbLBkAZ7ErTmwR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646120344, "uuid": "5410697c-818a-4da6-90d2-9154e6a6cc5e", "value": 12238, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646120344, "uuid": "495ff935-f3fa-43cc-a2a9-b3e42dfa82e1", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120344, "uuid": "3fd7cf36-30a4-4378-812d-798d4b2ca5ad", "value": "Pratka Econt 5300133634052.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1837562-995f-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1646139762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646139762, "uuid": "ec7f34c1-1491-4a2b-a6f5-821dafc0dd17", "comment": "Malware payload (SnakeKeylogger)", "value": "db6b153a44930449c24d13dff88feaf6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646139762, "uuid": "6418864a-8e31-4bed-9b8f-a8aa0023e6b9", "comment": "Malware payload (SnakeKeylogger)", "value": "612e5ff5cc59e952d4dd10e07cd162225905d59cfbcd35bfcc904ba08e26d0a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646139762, "uuid": "d39ffe17-6e6c-49d3-ac34-3a7e562dc396", "comment": "Malware payload (SnakeKeylogger)", "value": "fd47bf3c7cd54f37bd0b4945489a894a901bb149", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646139762, "uuid": "40f96238-913b-4fa9-abb2-862438e04405", "comment": "Malware payload (SnakeKeylogger)", "value": "f9e0f4077393695c1e4af81f93cd6f0ee8f613da334631b9a524d7d2aba4db9fa58afa3754d39ed8ec603631d5314450", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646139762, "uuid": "fb1ef506-9bb4-4460-9aac-d589fc630569", "value": "T1B1F4F49C6512F1C4D894C779E82440F416BBED9FFA84DB2B6F423EC93833A1A8607B55", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646139762, "uuid": "28a84285-f002-49e3-87a9-5c46067d6837", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646139762, "uuid": "73539353-1bbd-443b-8f63-4a4ba1239a72", "value": "6144:zVnkNc4wWnkNc4wAnkNc4wyU71fjZOQ9EqsGWbtvJ/xa3xJFFgrL1Z/lx3ecpq7M:Zr4Nr41r4A7190DFx252LDjLpq7FI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646139762, "uuid": "8095abb8-7e10-4c4f-9135-2b5f93fe7945", "value": 790528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646139762, "uuid": "8a91e7c6-f4a8-46df-afee-a1a0b9b139cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646139762, "uuid": "9ea01646-03cc-4174-b515-791124cbde44", "value": "Agency Appointment + Voyage Orders.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f22f625b-992b-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646117456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646117456, "uuid": "be51553f-7ef2-43d7-aa97-327ab42fa65d", "comment": "Malware payload (AgentTesla)", "value": "da8f929922c32340a9266cba23808ff2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646117456, "uuid": "b182ed3d-363c-418c-9b2d-86640c3447ef", "comment": "Malware payload (AgentTesla)", "value": "6178bda1a50bf4b3ddd9ed09f9932759cf9934fcf9282e821182496a0297b975", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646117456, "uuid": "cb177e70-8ba8-4bcc-8b48-40b83460ae54", "comment": "Malware payload (AgentTesla)", "value": "10b5aefc89c3bf7da6434777d147f560715a6a35", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646117456, "uuid": "e03673f7-f6f8-4eb4-a9fc-8843e89db0d7", "comment": "Malware payload (AgentTesla)", "value": "984dd9cd459d84af8de040d24e93191d55304c82231a1164d58d1edab524dde5aedff23ec53f028e19de48aa7321b5f4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646117456, "uuid": "670c4090-092a-492b-a172-2423f270862b", "value": "T15A05CF4439E64139E83A8BF2DBC0EBF1DB6EF221E48870F554000E595645BBC895AEFD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646117456, "uuid": "eaefc4be-2d78-4252-b83e-427c3045f0d2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646117456, "uuid": "e7d0ce60-ae62-477f-9252-3208c81ee6a7", "value": "12288:iEySR/IHiB1uwaDEUl5HSqQUD2gjqQwBwho59Q9MlemVUN0eOmPepPCvZVK4:8i+PYy5SqW2SBwhozVU0mW5SVV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646117456, "uuid": "ea4381ea-4409-4541-b543-cf5e4045f437", "value": 834048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646117456, "uuid": "1c02c424-6bf2-470d-99c3-f6460785fda5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646117456, "uuid": "3af9906e-f203-4505-8616-c00d5a015be8", "value": "Payment Advice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab773167-9986-11ec-9275-42010a9c0029", "comment": "Malware payload (Smoke Loader)", "timestamp": 1646156422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646156422, "uuid": "12e5cccf-5c40-4cc4-bdba-7eaa30c4ac7f", "comment": "Malware payload (Smoke Loader)", "value": "86e1be7b0f02f62cd9af6a6aea3165f1", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646156422, "uuid": "22d17028-fdcb-4041-8c8a-68ec9d0c7b47", "comment": "Malware payload (Smoke Loader)", "value": "619fcef3f5c3a701aee7861097b3588a73e4ae1ee8bc6467df202216f52e44f5", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646156422, "uuid": "15044680-aebd-40f2-9002-f3a80a3f5752", "comment": "Malware payload (Smoke Loader)", "value": "da50706e1e6864cd3ec2d0b852dc587f1b4f7a88", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646156422, "uuid": "4e32dab5-c4d5-4742-b8e1-a4362d745e29", "comment": "Malware payload (Smoke Loader)", "value": "f12716d0638a97a710c1a3b54be08c657239070d5b610e62816041e9fbdc3427d6db47cae6a1f32af324a6fc7c7053f3", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646156422, "uuid": "f35f9132-4423-4624-ae74-1047f3f96fd2", "value": "T1A5649E10BA90C035F1F716F8497AA36CB53E79A15B25A0CB63D527EE16356E0EC3138B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646156422, "uuid": "8a79ff6e-af81-4bf8-a265-2ac7f0442c1b", "value": "bc84e08c45b22b61d68f82fc1945a48c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646156422, "uuid": "51d0f8f6-b27a-418f-8c29-11f2321f9b64", "value": "6144:Mh4k3sTaPmX6oVCNsQ0wfWghV9ons6UmovLoFg3q2kaDA:MR3RuX6oVphWWgen2sqhA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646156422, "uuid": "cd2b0746-52f9-4659-8870-dd64ed82c8ac", "value": 333824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646156422, "uuid": "484ec4a0-739f-4159-a447-1163edd0f3ca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646156422, "uuid": "9db0c10e-08dc-4cd8-9300-c87003078f23", "value": "86e1be7b0f02f62cd9af6a6aea3165f1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7dbdc8a-9950-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646133223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646133223, "uuid": "a117630f-8f0c-4a24-8bf5-2f95a322b96d", "comment": "Malware payload (Formbook)", "value": "477958bea569adcfd18d0e705ace2cb5", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "nqs9", "colour": "#95D611", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646133223, "uuid": "cafed43a-0b56-49a7-bac3-711e8c56deaa", "comment": "Malware payload (Formbook)", "value": "61e2e3f95b2cfc4704e38670a4b28d00c130c6b27ee86846222ec36be243607d", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "nqs9", "colour": "#95D611", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646133223, "uuid": "aea44ab4-902d-4f5c-a5af-de4c74620c20", "comment": "Malware payload (Formbook)", "value": "ea0bd67ed89576806b5462283c76b4f2721a4e9c", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "nqs9", "colour": "#95D611", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646133223, "uuid": "84019ddb-6595-40f1-a1f5-06d19be8daaa", "comment": "Malware payload (Formbook)", "value": "f39a1fc7ea3c9139b7d94834c7731206b33a372d2182f4cb10bb7e75587ea30728d0964092529041d1985c8853840629", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "nqs9", "colour": "#95D611", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646133223, "uuid": "77210cf9-d1bf-46c9-b005-1a6d04028541", "value": "T1774523236BE0A7B7CFD112313C73AB25B7F685D402642E933BCE9F253B8B1525515A82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646133223, "uuid": "ab143cee-6140-4a18-b629-b21a60f4c95e", "value": "12288:4t2jd57BMZx85V/usBhOmiNqPJXcFTe5O:W2jGZxkxHFioJXcM5O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646133223, "uuid": "cd0b05d7-65a8-4cca-81e6-7a69f884964a", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646133223, "uuid": "9b367147-097d-4536-ba80-a04af84732fb", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646133223, "uuid": "b6e4ebd6-cb53-463e-83a7-7ce1c05f3b0b", "value": "SWIFT-79125401032022-pdf.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b023df3c-9975-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646149128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646149128, "uuid": "9ffdd23e-6f49-4973-9be1-83e071d593cd", "comment": "Malware payload (Heodo)", "value": "872ee2a12417d03ad7d1b935f34d9c85", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646149128, "uuid": "8c775efd-9f9d-437b-9434-64d6a5705a47", "comment": "Malware payload (Heodo)", "value": "627396507796fd689c7e24976be70a9886dae0c8d11557bf0226ac482c9d1e6b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646149128, "uuid": "3dc765a1-9503-4adb-b098-57602ead8c14", "comment": "Malware payload (Heodo)", "value": "8b28be2bcba32150802ccdddb7a8af95173504af", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646149128, "uuid": "f8c24c28-2ec6-43c6-a642-ffbadf61ce5d", "comment": "Malware payload (Heodo)", "value": "fcf3aef5ad137e1b01ea6712bfe5b4adcbdc5da7ed33169470d9bf27bef8ac53f0efdb9ad551b100e8a7dc6783d07243", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646149128, "uuid": "445f7716-28a4-4d6c-98d0-8a88b233ed95", "value": "T1F8B4AE12B790C076D1AA36342526A7B51AEDBC709EF5C3876FD03B7E5E301918A3C35A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646149128, "uuid": "32a28761-fbc8-495f-a410-c7c92156af38", "value": "f08242131de62ca6d7c4b2727b491b3d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646149128, "uuid": "689abfdc-1e29-4b3b-b5c8-7edf40b1b68a", "value": "12288:jE3TMKM/JjdkdO4+BNhOwyu4h43JopSz/o:jE3TM/JjdkSp3Ko", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646149128, "uuid": "f2e43957-7fce-4e89-b194-3cd37921bdb1", "value": 505856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646149128, "uuid": "e25a9dd4-8b11-488f-bfb7-e3dd5c1359d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646149128, "uuid": "79607fa2-f4a6-459b-a16e-ccc8a5788e94", "value": "872ee2a12417d03ad7d1b935f34d9c85", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aac180e7-9947-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1646129362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646129362, "uuid": "5b68e5e1-9b92-405d-998f-523606bb09b4", "comment": "Malware payload (Loki)", "value": "b1359b767a1b1cd0ef2793fb9737cc8c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646129362, "uuid": "ab94f285-b1ee-4254-bde7-523971aac248", "comment": "Malware payload (Loki)", "value": "629ba2b212377b79b1a3cb1dfb22f7f8e4408107f007c6c0bbfdf9acff1f8d85", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646129362, "uuid": "4d59848d-7d9e-4b38-a171-adf29cbe4a9d", "comment": "Malware payload (Loki)", "value": "a59bc6dce9bac88bf5bb8e6c222857d2acc70425", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646129362, "uuid": "ea279556-177e-441f-bae1-1a40249ff285", "comment": "Malware payload (Loki)", "value": "8553931be67b33f734b8c8a6242148dea8bf4bf256081e6ef4930e3d0987db906beafc1cea3a4797672549784fad9a03", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646129362, "uuid": "f32a26da-32da-49e2-b18e-03134a08b28f", "value": "T1D064231FEBE0A437F0CB01F9013B777DC377694A5DE98A038B846F6B2D572468119692", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646129362, "uuid": "68f2cbfc-8b28-4db2-9b6f-c739ae072440", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646129362, "uuid": "c3b65444-f1b2-4e5d-89e3-8dbab417d3c4", "value": "6144:rGiDIUXKP5MebVxRAlm2w591/WcIn30X0OvDLrT5CR4ACul:fiPWGxKq9ccInkVDXT64A3l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646129362, "uuid": "d79358d5-971e-44bc-aa83-4a397766e2a8", "value": 312994, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646129362, "uuid": "795f3f54-7004-4ba0-963f-0e51d0021cf3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646129362, "uuid": "14c159cb-cf06-40c2-b990-5a6a215725b7", "value": "b1359b767a1b1cd0ef2793fb9737cc8c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9ab4e7f-996e-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1646146218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646146218, "uuid": "a07c609c-25df-4892-8ca0-6aa93618a0ee", "comment": "Malware payload (SnakeKeylogger)", "value": "369ff70a1a25f58fae0f878ff3b89fbc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646146218, "uuid": "316fce01-638c-46ff-949c-ed4c705f9af7", "comment": "Malware payload (SnakeKeylogger)", "value": "62dc9351d5a7687aef68fe9c6ee73ed40b8277555f884faf86dbe5ca01d71745", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646146218, "uuid": "617393f7-54fa-4848-8ebb-6a5c319b9666", "comment": "Malware payload (SnakeKeylogger)", "value": "29dca829a938015a6e18fa8a1028d7362a247352", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646146218, "uuid": "6bd577cb-0aa0-412d-907b-3918fd5c0445", "comment": "Malware payload (SnakeKeylogger)", "value": "46d92ad49a4de41610ca982fe5be34e0ef51d70774b2b4a9e30af875249df4fcf5d31e7f7b5bd4cf67b36d688d2d86de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646146218, "uuid": "bb914c44-d461-40fb-bcea-5a8f40c87f51", "value": "T10FF4F49C6512F1C4D898C779E82540F4167BED9FFA84DB2B2F413EC93833A1AC606B65", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646146218, "uuid": "751dc88d-1504-4beb-a0af-ec3f2b513dd6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646146218, "uuid": "91b415b4-8613-4856-b849-a70d43d16b8f", "value": "12288:Zr4Nr41r4A7190DFx2EvzJHOh4B2ZBBkouJ:Zr4Nr41r4A705xHzVBgu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646146218, "uuid": "63799844-1ff1-4f84-90db-0e293df536bf", "value": 790528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646146218, "uuid": "577fb5a3-9142-4577-bf74-abdbb5232962", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646146218, "uuid": "360a2416-efc6-4a52-9fb5-930fb0f39658", "value": "Agency Appointment + Voyage Orders.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd52be77-9977-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646150036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646150036, "uuid": "511c147a-d6c4-4ac5-b780-71ffa313804e", "comment": "Malware payload (Heodo)", "value": "70015efa48b88e20bc373388b8d09402", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646150036, "uuid": "3b90a31e-726f-49c7-8d6a-286c6488afb7", "comment": "Malware payload (Heodo)", "value": "62f4ca6506b85fac3dbe455e63f11a8c0788cd524f4ddcd337bf0411c1e2213a", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646150036, "uuid": "010fb2de-23a3-4c3c-bba0-1a1a4bf72395", "comment": "Malware payload (Heodo)", "value": "e9849a1101c17c7e328c68e8129e68f8d0d65818", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646150036, "uuid": "4983591b-62cd-47bc-893a-382cda402b9f", "comment": "Malware payload (Heodo)", "value": "709199b8f649b86d2998ea8c2c0639eed732e3a1a94fc2633a82b52838fe837bd63d8b149fac5c45ba63936f736b79af", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646150036, "uuid": "0e439a41-67be-4ef0-9be5-cf03f4d0a95e", "value": "T19113E12DC0A65999D727243CE6149BF4130C1D4E96A0FA9B1D54B3AC3B6A1F70B4FCB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646150036, "uuid": "df744f9a-16b9-4acf-8d2a-a429a11fa8e1", "value": "768:ZqoOomihd8DOevZCwtofyKfcrND59V+L9Rw4eWrXcTqZ0VfIeg:3Oom8eDGylND59V4jwmXc2CVfIb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646150036, "uuid": "42d9566c-f25f-4b28-b281-1395d2b5febe", "value": 41817, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646150036, "uuid": "d41b63cc-4f69-443f-8203-39cb53d5d7f6", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646150036, "uuid": "ff031d89-b657-4a78-96cf-8394f75588b1", "value": "SCAN-941.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a99aa84d-9979-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646150835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646150835, "uuid": "0c68d23f-837a-4e5e-9fcd-366d3295522d", "comment": "Malware payload (Heodo)", "value": "3d2fe0267e42a148eef0a37300ead74f", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646150835, "uuid": "34dc1252-9f59-49cf-b99e-196daba53208", "comment": "Malware payload (Heodo)", "value": "63053420505a4cb775222d5ae641377080056ba5d3230bfcfe23168971163d58", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646150835, "uuid": "33d19b90-f32a-4210-a523-1a7554a38488", "comment": "Malware payload (Heodo)", "value": "ca756b8a05c8cbc422c82b37fd87737bbf1ea6c6", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646150835, "uuid": "08290dd6-0725-4e1e-a84f-8849d2723079", "comment": "Malware payload (Heodo)", "value": "bf0cf8f86a3003d976702763d5e83fa51118e0a1bd39b6c8a8b55da70feabffa6ea9fa33130644227d9acdb3945dfd79", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646150835, "uuid": "d6f00910-f7d6-4f34-952c-bf087000973d", "value": "T10C23E116C560682CC73E8C758200AA93720A7901D9D5EB993585BB4C3B96FEB53DF5CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646150835, "uuid": "b6a5b070-08c7-4267-8c84-18819f633c26", "value": "768:6o9DOevZCwrvtOzdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Uh0VPPDks:6o9D+tT5fTR4Lh1NisFYBc3cr+UqVnDZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646150835, "uuid": "bbb5c756-9f96-4616-8320-664dd42e91ad", "value": 47696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646150835, "uuid": "51a53783-5841-4db5-905f-3525a08100ef", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646150835, "uuid": "244e1850-ddba-4794-bcee-a3fe41a956da", "value": "Scan 05.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc125979-994f-11ec-9275-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1646132881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646132881, "uuid": "426583f7-aa5f-418f-971b-7f4d53afbe5d", "comment": "Malware payload (Quakbot)", "value": "870807d56a8a4a8c5b3cdfa8db024e94", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "THE FAITH SP Z O O", "colour": "#87FB2C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646132881, "uuid": "fbba68c9-a58c-4b72-a80c-62489d8dd1a0", "comment": "Malware payload (Quakbot)", "value": "63628acada2af4e65deab9d28f7dc53b455d77af044339e98311ae0dc37bdefc", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "THE FAITH SP Z O O", "colour": "#87FB2C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646132881, "uuid": "1ae99352-3764-4eb5-80ab-50384bc7ea3a", "comment": "Malware payload (Quakbot)", "value": "44bc2a3955ec50806042ca0d3cc8ee418f69e8b6", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "THE FAITH SP Z O O", "colour": "#87FB2C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646132881, "uuid": "4a654e92-bd71-4fd5-855c-087464a50e70", "comment": "Malware payload (Quakbot)", "value": "6ae1507569d0017fee3cd1f70cd4e38b45f95c970788ff149e503a5a38fc39534a011c9414d6b3fa0230f29b3e28654a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "THE FAITH SP Z O O", "colour": "#87FB2C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646132881, "uuid": "6389dbdd-7eb7-4508-ae06-a4f7bb1cbdab", "value": "T17525F94286642A0DFD3DCEFB6F3AA3ED40664F70192AB256E350288951B81F1723DF57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646132881, "uuid": "a5f79076-909b-4b1a-8406-dce5ac4ab6fd", "value": "a2c4c1cc45cf157e67048505a3f85c3c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646132881, "uuid": "558a4b9c-f127-4a27-9018-1ddcdbe35500", "value": "12288:Zg4d/lpygJCNLgUgYUypwKzpVCD2aep4Xl8I1JV5OwBi6fC8a/ZnFH08hXhQrVNP:ZdddhCN3tVwV1Twh/n/qVh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646132881, "uuid": "3c2ae1c8-0841-47b9-b379-5101839c919b", "value": 977838, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646132881, "uuid": "4522d232-ae3e-4ff9-8dd9-5494744c61aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646132881, "uuid": "5b9d9c08-26a4-455a-9f49-8ffad2d705db", "value": "63628acada2af4e65deab9d28f7dc53b455d77af044339e98311ae0dc37bdefc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3ccc067-9993-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646162073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646162073, "uuid": "5b2e4232-0cd9-44e2-be19-6b68b62003ab", "comment": "Malware payload", "value": "ddba7579fcf78db9f5f2e28ab81055df", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646162073, "uuid": "03d24364-e4e1-41c6-bfec-8a365c95e3ef", "comment": "Malware payload", "value": "6394de1149bac235402b7a6453331c0585bfcd54d2a31ce7e44b42fb24caf615", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646162073, "uuid": "7173e04e-8c49-49f7-b16c-e6818ba3eb62", "comment": "Malware payload", "value": "0dc5db4881c7561c9949d489a6f3fb2d85565f9f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646162073, "uuid": "7732f2f9-0467-458c-9e65-8f95a7865ae8", "comment": "Malware payload", "value": "90e52c01cade5f00cf943d371f3676ffeb97e88c0737680f817193a2285251ae576b25e61362dfe85f979781b7d92e03", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646162073, "uuid": "2dea6f1b-aa2a-4328-b663-64026bfa58c7", "value": "T147258E5835E520BDD437CB72CA94EFE0DB29B162D24A907650030E599A0DBBDCE05EFE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646162073, "uuid": "c4e89293-de54-43c6-b5f6-f17134d2055d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646162073, "uuid": "e8eba5c7-bf7b-45bb-85a5-8be7a64977f4", "value": "24576:kWwl86ME0BBY5TKkic36czi1x8dxCtl3GGvQ8A:rwu6M73YkkR7dxE3Nv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646162073, "uuid": "d86d075c-d6bf-4728-9516-6684ed25bc27", "value": 992256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646162073, "uuid": "fe412542-9644-4723-8ca1-cca05d0dba54", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646162073, "uuid": "f00da285-36b1-4c56-9e4a-2c87ae68ce19", "value": "ddba7579fcf78db9f5f2e28ab81055df", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d2e3c54-99ae-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1646173524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646173524, "uuid": "bf769963-3c77-43b6-913d-58bfb6d26b62", "comment": "Malware payload (Mirai)", "value": "f6150321094076aaf2b160c1088a3429", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646173524, "uuid": "4839d4e6-bee8-4893-ba5c-789f746428af", "comment": "Malware payload (Mirai)", "value": "63d1bacc993f7b4b770549b370ee60f3ca89a2d23e05938743ed9e55bbb8fe5a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646173524, "uuid": "4ffd8e1b-f137-4c5e-893b-af415f1f9dfe", "comment": "Malware payload (Mirai)", "value": "9706f177cdc7f8ccb5db33bf6efdfb796d590d21", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646173524, "uuid": "887d9e31-cfb2-4506-9bef-f5b4a3373e48", "comment": "Malware payload (Mirai)", "value": "8895f5203e5bde7d3b048f158a5806caefb42c72aa27bc547939f49a7e45ac5f48421016992a8cc451dba5066813c9d1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646173524, "uuid": "88f33724-6ae2-4d62-8ea8-7e946adaedd8", "value": "T1B5F2E0D09A2E9241C3AAF03F4E9D7D8006001B1D566875B0EDD8797A9FB2B26F7497C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646173524, "uuid": "9d0be3c0-f8e9-43f0-b9e8-b0b545251112", "value": "768:g2lmq4LL6evsahSmMKFmhcwOP+yWDTMQZYRC00Nawkhbr2nbcuyD7UVyqV:g2lk6oBhOKYhB0+FMQy0Tcanouy8sqV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646173524, "uuid": "6162d5f0-dc66-4ecc-87b6-6db6c37b9a2f", "value": 36732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646173524, "uuid": "b318c8d1-7508-4735-b7fb-0c6a15cea6fa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646173524, "uuid": "78a40498-2ddf-4d78-b367-9d10795e37f4", "value": "f6150321094076aaf2b160c1088a3429", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85c0bd1b-9978-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646150346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646150346, "uuid": "3d2294b0-2778-4122-9b45-7ed81db75ade", "comment": "Malware payload (Formbook)", "value": "60610e362b7f268efe7310ce75dfb4ef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646150346, "uuid": "ea1ba368-9f1b-4ed0-a510-321a0aa19fd0", "comment": "Malware payload (Formbook)", "value": "64502cc284ba5ac4a0caca505834ec87fcd9d878b11f33962c747a2526107ed8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646150346, "uuid": "a0bdc533-cc25-4679-aa2c-ef1e112631b3", "comment": "Malware payload (Formbook)", "value": "baa064a59ea7116b365688bd2b217d4983ba4513", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646150346, "uuid": "68fd8d86-61e9-422e-8110-507aa0ae2607", "comment": "Malware payload (Formbook)", "value": "27661df036d6b1a30838c49eabb19327f8c8199689bdc2ca20836dd6740eaf909aa7c001d369249d2b87fa24f6f67b64", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646150346, "uuid": "729ac18e-7509-456e-ab56-a2660054ebd6", "value": "T199F4CF0839EB5039F8369BF1CAC0EBF1DB6EF221D48960F554000E555A52BBC895AEFD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646150346, "uuid": "586b4eb5-c1d3-4ffd-8789-9a0f8d3f8571", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646150346, "uuid": "f79f43a6-ad0e-4d9e-aa26-7c87e05c01a2", "value": "12288:5EhRR/IwBzdep4EG8+2NFHom31HAW2C9UHl15tPUAONxFKCInuM6:2dvvR2NN3lgWrKHvT8ZTZF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646150346, "uuid": "42f34c5a-1d98-44a2-911a-8bb25314f7c8", "value": 782848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646150346, "uuid": "327259a7-8410-4fff-a0f5-d20e9fd2a22f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646150346, "uuid": "debcafa0-9b84-4137-a880-e6e10c1e510e", "value": "order_9822222.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05b4dea1-997b-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646151419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646151419, "uuid": "3871312c-4e31-4e2d-93e9-ebdaf3e7a718", "comment": "Malware payload", "value": "378cdeb0d4fdf2c922b3d562ad72eb4c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646151419, "uuid": "c3f2703e-b077-4773-9184-2be46121a7f3", "comment": "Malware payload", "value": "645e213585ff589c1589447ca08ce4a65dd36bd5270e502e67544ec2f1a05a7e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646151419, "uuid": "9e8c5be5-a6de-4a77-b93a-6909ed507e56", "comment": "Malware payload", "value": "7bd6ab7e4ae6e9b50d2e8b4a6df94c626a069520", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646151419, "uuid": "a659d7ce-68fd-4224-a502-b02dab1d06bd", "comment": "Malware payload", "value": "52afa38b45ee11c94bd850ca7d952e85f8e579e01d9b5ace23ebd9334f079251b7addfb16aa169d8f712dcbbc0f2f9fc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646151419, "uuid": "9c883e36-50af-4ea2-9a58-21fd5447d1e1", "value": "T1AC234A4FA39354FCC64BE27451EB5771E873BC3309319A3E87A8E7300E11D519B29A26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646151419, "uuid": "b5fea02f-a1a0-4b9e-96b8-f6f104e7ca5c", "value": "70af479f7b4e629c97c1ca727551f680", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646151419, "uuid": "be6842e5-1ef6-46a0-9464-f6ae9f59b647", "value": "768:YJa9JEzuEs+UoPhkvGt992srKmVXCEoUG+M9oBBWPHRG1Fl:Y6Jgfswkq98sWkX6tcBWvRG1F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646151419, "uuid": "6749f3d1-2a7e-4914-a581-bf18dd542f7b", "value": 47616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646151419, "uuid": "c9591fe0-6b9f-4f23-80ca-9083747af5db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646151419, "uuid": "1212e336-9f36-4bb4-845e-02b80a946c8d", "value": "Invoice.docx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd347600-9933-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646120857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120857, "uuid": "8235a23b-9329-4ba6-978b-e2dbffa11eeb", "comment": "Malware payload (Formbook)", "value": "ef586b1497300e2f6da37b6cdf17893a", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120857, "uuid": "f1b76698-f8d0-44f6-8929-5e2360849130", "comment": "Malware payload (Formbook)", "value": "646c1f8cf21a06c587674a901af854914e62c3af875aca5465de121c9a623c4e", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120857, "uuid": "3d5aa337-96b1-4e95-a0de-c49b7d4d31e7", "comment": "Malware payload (Formbook)", "value": "ee9ae12bad757ae305e8d811a9fe80f626a30828", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120857, "uuid": "6837bc07-e4a2-4af0-b6bb-5c76025250ec", "comment": "Malware payload (Formbook)", "value": "69cb47a5022c408dbaae4c5612a1508bf2bda39581f68fdcadf158707f573b36a5b6b6543278b23116201067d1b55e48", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120857, "uuid": "309e9090-a556-40ff-bb8b-535d66f67c2a", "value": "T10314128449445D47D4A82579AD4AC3F02132FE2A1BD3917FBB40762F3BB4DB863E2D1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120857, "uuid": "6b1cf9de-9fcf-4efc-a5c7-29359945cd6f", "value": "3072:zcZB7jnde0+O1EDIvx7w7FfQV5RVKu8GQQx4LC68TPoFhNDy9So8iQZu2:YB7r00+EZ7w7FAL8GnSe68TA7Dpu2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646120857, "uuid": "ba066b22-9bbd-489c-a1df-5fea1bf30830", "value": 190888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646120857, "uuid": "27a19d24-2b62-47d6-a6d4-af009cfdefa1", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120857, "uuid": "f6530fd6-4fb5-4457-a572-f02fb6195eb7", "value": "Scanned from a Xerox Multifunction Printer.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c08c850-996a-11ec-9275-42010a9c0029", "comment": "Malware payload (Hydra)", "timestamp": 1646144236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646144236, "uuid": "4e5f0da0-6caa-4a19-a131-1d094829451e", "comment": "Malware payload (Hydra)", "value": "975f5eff0e960994608742678ca70208", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "tor-hydra", "colour": "#10AB92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646144236, "uuid": "51b9eb60-a773-4ed9-bbe8-3034f030f9b6", "comment": "Malware payload (Hydra)", "value": "64d0257352222162db7125f27e4ef16958c515326adab554d50698a1685e46ef", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "tor-hydra", "colour": "#10AB92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646144236, "uuid": "5cfa610a-62b8-4b68-a2f5-8650db5c115f", "comment": "Malware payload (Hydra)", "value": "e311d4f346b363665c462658889ddfb73c4dd8da", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "tor-hydra", "colour": "#10AB92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646144236, "uuid": "854510e9-47b9-403a-a493-bcdb4f8a974a", "comment": "Malware payload (Hydra)", "value": "9833568c227ae13d75427287ec2618e0f3ffd6402a2aaa39dd1c6cc80522fd2697c410730bf87ac32c1bd05435ecc1ae", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "tor-hydra", "colour": "#10AB92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646144236, "uuid": "8d45ca59-d714-4a89-9830-e69aaa4cf2b3", "value": "T1487633547FF07107C996B3B89DBE0933C6861CD98FB54B65010A3B906A7F2DC9A4B42E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646144236, "uuid": "c921e792-b6c3-49da-acaa-261e9a6c98da", "value": "98304:c1NE8G/uKVsOH06gHhqnLpTCiif96fU3Jj85luY/vCIfF6njtW8SMHJ4rTVpLjt:QmTO2gHh01CDXJkuAvCIfF2BSMpMHLJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646144236, "uuid": "ee2d6d5d-3e31-448b-8b43-aa965c117a9c", "value": 7457646, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646144236, "uuid": "9c505004-1ac8-431f-b363-f0958f67cf92", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646144236, "uuid": "50878987-1924-404d-905e-ee972619f278", "value": "psk.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30fb54f3-9959-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1646136889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646136889, "uuid": "f48d091d-551c-4be9-903c-4e27ecbb986a", "comment": "Malware payload (RedLineStealer)", "value": "9d454a3c9f1256b1aa25f71f6960e7fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646136889, "uuid": "2208718b-868e-47c9-b851-cb3cb9bce4e6", "comment": "Malware payload (RedLineStealer)", "value": "652c7d7f64f938ad142ada796fbad932c8c9d2bfb2b383d65f20311ad3775078", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646136889, "uuid": "4a43293a-a724-465c-98ae-3f810d48cb1a", "comment": "Malware payload (RedLineStealer)", "value": "068412f225b172bef99ea8201aee832d20eb6b09", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646136889, "uuid": "49c8756f-818d-4e8d-a383-05976e84ecf3", "comment": "Malware payload (RedLineStealer)", "value": "f72d0191b0e4a138243717d495374e66f7756b8ef77fe5f737ec09e8edc51fb9f78f5e47faac703fbdf8ec8b3ec582ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646136889, "uuid": "d6b0be6a-c492-4418-b949-9edcaf610a0d", "value": "T152C423FE6680EE4FC5470E7429C5691FDAB11331EAE0EC89A5FDC38B454A56B610D23C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646136889, "uuid": "9b9b091b-76e0-432c-9e0a-bf9bc63283ac", "value": "445554923421947cbff896012e27345a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646136889, "uuid": "47b49d35-42b5-468b-a2f9-7ea2dfc92588", "value": "12288:teDLtdwzY/ZMOb8WGQS03ULaHNqrxlKIQNoPVFROEpTBcveSmJYvqa:g3tmGMSjGkEaHNYK3QTR5devsJYv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646136889, "uuid": "cddc6a59-8ce0-4855-bd21-ebd33ba02970", "value": 587056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646136889, "uuid": "724c9141-8fb8-4939-9d3c-a33d4fde8721", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646136889, "uuid": "a673e66f-d93c-40c7-8a1e-20b324847a95", "value": "GenshinHack.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95d96dfd-9947-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646129327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646129327, "uuid": "b658d184-74db-40bb-bb55-19ef8f98be44", "comment": "Malware payload (AgentTesla)", "value": "fb57315b8dce8c738948d7540edf2dbe", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646129327, "uuid": "e28eade1-e6bb-4739-8247-5a8cbfe6d2ac", "comment": "Malware payload (AgentTesla)", "value": "664dbf2d835736eefd6e7c4400474b27c7d1968444685b7f86843b129d35b6f0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646129327, "uuid": "f0d19226-52d6-4f0e-9b89-fa57fdf4cc83", "comment": "Malware payload (AgentTesla)", "value": "7674fe691845a115b5e5b62b47c0f6128501d525", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646129327, "uuid": "a9f5027a-a011-4979-93f4-4572b661b441", "comment": "Malware payload (AgentTesla)", "value": "4221c99e5a48a28cb5ac5d864903bdaed617e65f00e511b5198148b112fe0a3b5ba9663992150a72ef5a60468e0370ab", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646129327, "uuid": "dc088a57-d446-4521-8337-021e7cca9d22", "value": "T18A05BF0839EA4034F8368BF1DAC0EBF1DB6DF221E98971F594000E559655BBC894AEFD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646129327, "uuid": "e2573d16-56ba-4689-8c4a-267ffa4f6ac9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646129327, "uuid": "ac0b3053-196e-4f1b-95cd-6e444400232c", "value": "12288:pE1xR/IpSsO4crHAnWQEbLYE1FPUtd/NHkCWB6z0QPDHZxSpP9WOvoG3uyo7/Xao:bOtrHDLjFM7/NEKzTPDWpP9zoGW7/X7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646129327, "uuid": "2f8bb893-e98d-48ab-bb60-3bd3fd5c7df8", "value": 807424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646129327, "uuid": "0f550cfe-9e8f-46f1-8661-0cb3666b45eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646129327, "uuid": "2e123c89-2833-4510-a90d-14b4dec29f7f", "value": "fb57315b8dce8c738948d7540edf2dbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c629d2b8-9977-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646150024, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646150024, "uuid": "1a0ddcb6-0383-4a0a-bd13-8d1a0750199b", "comment": "Malware payload (Heodo)", "value": "eb454b2f640ae91c5c66caeaab3e5bf4", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646150024, "uuid": "819e7364-eb34-4592-a995-0db1421fc3b5", "comment": "Malware payload (Heodo)", "value": "66ddea55851e1ed020bfb2fd4671a12f2b21c18ab7427279c3a125a8bdfb8511", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646150024, "uuid": "82e1f362-c02a-4981-8717-cfebdb45b2c9", "comment": "Malware payload (Heodo)", "value": "cc0312570232e7535cd62c98c5c8620cc5d680c6", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646150024, "uuid": "2369873d-10b5-4562-96ba-b6917e618753", "comment": "Malware payload (Heodo)", "value": "15db2ba177de2d5b132e1f7af575963418036f330a988f6151c429450f4352d4bb1b6cfef3eeed7311bfdc2ff534025a", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646150024, "uuid": "cca1bc54-903e-48af-b8e4-4a3666c1c5df", "value": "T18223D025C1607828C73E8C759200EAD2720A7D04D9D5EF893585BB4C3B96BEB57AF9CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646150024, "uuid": "d024b45c-d163-40ea-b9e3-2730fd5e8e8f", "value": "768:yio9DOevZCwrvtD608zdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Uh0VPWft:yio9D7UtT5fTR4Lh1NisFYBc3cr+UqVC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646150024, "uuid": "7e9c737c-c2e0-44d9-b893-bbd33c3ac262", "value": 47699, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646150024, "uuid": "6925f7c2-454c-4963-a94a-1971ce23ce1d", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646150024, "uuid": "bf413eee-3cbb-49a8-a660-8bd7e933738f", "value": "Medwin Publishers_1.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ae5787a-9934-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1646121068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646121068, "uuid": "462b89f8-8a71-47cb-9bdf-60e0e17cb34d", "comment": "Malware payload (RedLineStealer)", "value": "46803687a6f974d618012d1945d7a189", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646121068, "uuid": "7044e3c5-5225-483c-84be-57c829a38e64", "comment": "Malware payload (RedLineStealer)", "value": "68315f9b95450e287e19be6f014114f36aa6fd98eef733e839efe670f302fced", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646121068, "uuid": "1363e970-f8db-4919-bc35-8d6f8b7f6a42", "comment": "Malware payload (RedLineStealer)", "value": "8262a74ec500c8f8db800a23ec59c639335e8f32", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646121068, "uuid": "d55af529-1c16-42bb-9658-885a09c385a8", "comment": "Malware payload (RedLineStealer)", "value": "5aa161de416d06d0c2191af4ca7cdefb858a5c5931be27ddbfd6adbb65b4b2e22b77b629f1ba3c1d5ecb464449a2833c", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646121068, "uuid": "61657882-04a8-4657-97be-d0cf2bcf1d6b", "value": "T192C47E57F7DBF6B0E6FE867A86F1851C52B774620260A78F664072886D22382453DF0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646121068, "uuid": "1c35f8a8-8cb8-4a63-8318-0993d1b57460", "value": "a31761b5a590c4c499d5f4a347d75c12", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646121068, "uuid": "14d66025-91b6-4bc6-986b-a24482223440", "value": "12288:Kn/zDvGHAykH8vLW/4+8bzbBSreMdwBY4ZyrE7K3yl8PeVooA/AB2LEJZsAQPUqj:4zbGHAzHKjX1/BY4ZyrE7K3yl8PeVoo0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646121068, "uuid": "c55c0477-cc2b-422a-8700-4bae321f966a", "value": 563200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646121068, "uuid": "6ee32272-2beb-4961-8007-5b4623fbe93b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646121068, "uuid": "f2c3f845-058c-4e25-b4ff-375835a21722", "value": "Ach List64 1.xll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec2ab0a1-9961-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646140639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646140639, "uuid": "8a29b7ce-95f2-4de7-978f-6f06884238b8", "comment": "Malware payload (Heodo)", "value": "621815989d64fc9663f303763812c0b3", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646140639, "uuid": "674dc6d1-1c42-41fb-84f8-cb54b0c86959", "comment": "Malware payload (Heodo)", "value": "68532eb84ae9494173391a03461fc815fc308972159b99d26ff7a55bb337795e", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646140639, "uuid": "169804eb-1a71-4fce-b485-76d1723c5682", "comment": "Malware payload (Heodo)", "value": "740da69ef87716c55c94f1c26624447c820092e3", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646140639, "uuid": "5d5a3571-5d39-4a51-95b9-d3c3396f1c91", "comment": "Malware payload (Heodo)", "value": "4bb0376d759d0d33f2949e61ad97f1d35fc12e2e9f2f30e303c80e2bb186685f073252d2b713b1c7140443ebb4c209de", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646140639, "uuid": "76519651-2564-4a39-a712-f55df4dc923f", "value": "T1EB13E02AC0961959D727283DD6148EF4124C0E4A89E5F99B1D50B3AC2B6E1FB0B4FCB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646140639, "uuid": "b0295026-4db6-492f-b917-09c4e50522a0", "value": "768:i9oms9O+pOevZCwtxyKfcrND59V+L9Rw4eWrXcTqw0VfWZE:i9oms7tylND59V4jwmXc2RVfW+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646140639, "uuid": "cbf2c970-4ff6-4109-8e31-88422bd4c01b", "value": 41841, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646140639, "uuid": "ae591c36-64ba-404c-a986-26b1abefa016", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646140639, "uuid": "a8cd1b90-29e1-401f-b3db-97d08767faca", "value": "New_Address_and_payment_details.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68b3c5c6-9958-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646136553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646136553, "uuid": "a79fe7d4-5c29-4a3b-bcec-bb5f33c6c031", "comment": "Malware payload", "value": "8636fe3724f2bcba9399daffd6ef3c7e", "object_relation": "md5", "Tag": [ { "name": "Daxin", "colour": "#652B35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646136553, "uuid": "925bdbdb-c5bb-4032-80ff-926e09dfc742", "comment": "Malware payload", "value": "6908ebf52eb19c6719a0b508d1e2128f198d10441551cbfb9f4031d382f5229f", "object_relation": "sha256", "Tag": [ { "name": "Daxin", "colour": "#652B35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646136553, "uuid": "d1c016d9-30eb-459c-88e3-0371bd9d3019", "comment": "Malware payload", "value": "3b6b35bca1b05fafbfc883a844df6d52af44ccdc", "object_relation": "sha1", "Tag": [ { "name": "Daxin", "colour": "#652B35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646136553, "uuid": "8200eea4-2268-43da-87ac-b782ff06ba23", "comment": "Malware payload", "value": "7846f0e04ef0cb2bc86476ee80671789aab19ab19d87183d63b1a971fa69bfd029d0a6b6180e5f03477eb85f17ac6fa4", "object_relation": "sha3-384", "Tag": [ { "name": "Daxin", "colour": "#652B35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646136553, "uuid": "28d5d848-1377-4538-9805-cf58829cac7f", "value": "T105635BC6926810B9E5EAC679CAA1873FCFF2345257644BCF429046C62F13BF4A63C359", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646136553, "uuid": "6dc5fedf-19ba-4a44-bfc7-43d20c82aa12", "value": "27f6dc8a247a22308dd1beba5086b302", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646136553, "uuid": "b218c3a6-a1ea-4ea3-bdf6-6b84fbc65f9d", "value": "768:mlBOZLK5NiC7XotYF7HumaqtqIBxf5R1Aw/aPZb6QK86ioShy4pTMzPSmYCkAFiw:gX5NA6FDWaff1DIy1NH0nhyn/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646136553, "uuid": "426e5ffc-7783-480e-9e2a-1a87db1e312f", "value": 67320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646136553, "uuid": "d67d4905-9eaf-4b0c-adba-22b56c6c3f3c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646136553, "uuid": "3995a2f2-9498-4573-bc3a-af9eebc74cf8", "value": "6908ebf52eb19c6719a0b508d1e2128f198d10441551cbfb9f4031d382f5229f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50e92338-9931-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1646119763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646119763, "uuid": "b0c3cc32-885f-4bd0-a1d8-16ca37443111", "comment": "Malware payload (SnakeKeylogger)", "value": "5091d1ede2883202777c464e26c73b7f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646119763, "uuid": "3d5d0b23-9b20-42a2-9414-361b8521f968", "comment": "Malware payload (SnakeKeylogger)", "value": "692597a436a6408b4213c52594e3645af83db745f36c31b6f8e9732768c63843", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646119763, "uuid": "9089f38e-4015-4ef8-b78f-d6f424fee60e", "comment": "Malware payload (SnakeKeylogger)", "value": "47d6246820937bf51340187d13af435115df37e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646119763, "uuid": "0de89505-c681-45b7-a20e-e817028515c9", "comment": "Malware payload (SnakeKeylogger)", "value": "74882c1c9f13d3d67d18325692dcf0058afd773b2ef53c73dca109e93fc4251d706b3f113acc9b98ec8cbc4a1b52d679", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646119763, "uuid": "3e7c2383-5bee-47f4-938c-c633d55bc506", "value": "T1F984D09162373B96D1BC3BFDA96D82701BB87C850866E285EEC1B2CD183EF001755B97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646119763, "uuid": "93da92f0-9781-4594-a0be-530134904b98", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646119763, "uuid": "beaa1dc5-6bcf-4edf-8402-de1910d75729", "value": "6144:XWtvJ/xaWAuTtIoLNG4J7hvjW9v8xKmai/kQ:YFxzVLE4J7J+vwJ/k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646119763, "uuid": "b9df5c3c-99f5-4a5c-9a74-05cd0965bd75", "value": 378368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646119763, "uuid": "ecba9637-ced1-403d-ab94-55d61b47eef5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646119763, "uuid": "b8076d9a-2795-4d52-9db9-98a7686e16c3", "value": "5091d1ede2883202777c464e26c73b7f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c322c0a-9923-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646113634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646113634, "uuid": "1c863dbd-0b61-4a75-9e68-4244c1e65f9f", "comment": "Malware payload", "value": "b283be1d63255d849bfd643b3503d49e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "veil", "colour": "#80A310", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646113634, "uuid": "d0976178-a548-4b04-87e9-5955e37f945d", "comment": "Malware payload", "value": "6931096e6ed7e2e780a229de9610223497c7760ef7f060e73ace96364695d48a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "veil", "colour": "#80A310", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646113634, "uuid": "c3bfcee5-2e05-4dc7-965e-2d0900251cdf", "comment": "Malware payload", "value": "7547fe8000eb25242db7d4d4f95e2152fe9748d3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "veil", "colour": "#80A310", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646113634, "uuid": "9391d5dc-0caa-453f-978e-7ff51f4b5328", "comment": "Malware payload", "value": "517fd8741a3c60d62a10f682e02f9887aaf643bf35f67fbb09b00632eff45bb1bc762359a4c701c0dfcf52622d38abab", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "veil", "colour": "#80A310", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646113634, "uuid": "3ec68d73-f3a1-44db-83c2-9448ae3ecf77", "value": "T17B133A1B2AA17052C59320B0FA991F34C47D4CB6116BB066FB417B6928B2D63CFB0DCE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646113634, "uuid": "45eef03a-4f24-41fd-9770-074fecec2a65", "value": "170193414cc4abf0ae27dc2a19d74879", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646113634, "uuid": "141885e3-3ccb-43de-a638-2cae46bf0376", "value": "768:qZL/0F24lercjO4sTZg5ZLvn2IuWZ0kqKNPWQHpJD:OLsF2Kerc64sTiX2IV0DhuJD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646113634, "uuid": "3cdbeb48-cfc1-4f14-b041-2a19236eefb6", "value": 45080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646113634, "uuid": "966d92d0-3e7a-4cc3-a15d-79863ee0798c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646113634, "uuid": "a5a65e65-447b-4459-ac09-c92b50d922cc", "value": "WINWORD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1495640-9935-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646121615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646121615, "uuid": "492c6046-ad4e-4623-9309-dec6f1b01b2a", "comment": "Malware payload (Formbook)", "value": "fec370f18ac838f422108ded47a53061", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646121615, "uuid": "c991520c-0bbc-4f12-a936-1fe46574033c", "comment": "Malware payload (Formbook)", "value": "697f3439d8efa6c60f3bfe037104f26349dff9be2b9ffbe1f0b499e6112f4ee3", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646121615, "uuid": "58629e06-eac7-4d44-b9ae-a93b7ef9a1c1", "comment": "Malware payload (Formbook)", "value": "57dec53879cc326847860c601f6bac1a65ce00bf", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646121615, "uuid": "63b31840-cb1e-4af7-a40c-79e3222e7fdd", "comment": "Malware payload (Formbook)", "value": "297fce419bf709e2310578a5e27b99e000eaf13feca5d596e13c1388e8426b98f56002551440729bd9d5d6a2654406bd", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646121615, "uuid": "33fe6887-f189-4789-8277-7f641ec7eea8", "value": "T1340515836407B8D9E92F0FB904FB9CF831636DEC6853A615E5783F2FB6720190E11669", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646121615, "uuid": "7cb22173-1326-42fd-9896-024974d232ba", "value": "6144:eGiMz887yuETBEd0XohUGJnc6gsQsniu31gfXS5vNTnpj487ZBq1JB:yYElxX6UFRsiu3y/SzTnpj487ZBkJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646121615, "uuid": "7a51e605-0a6b-479b-a143-191c84121947", "value": 796672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646121615, "uuid": "38228281-0970-4957-ad7c-b61d9608dc46", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646121615, "uuid": "d8f7b340-e93c-42fb-865d-a9a1ffefa644", "value": "Ref. No. MS-DGP-220137.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35652c57-999f-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646166961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646166961, "uuid": "ed968c4a-f67b-4c11-91c7-9dde5df955fe", "comment": "Malware payload (Heodo)", "value": "eccb73a9e13b3f8385fa1291d52025fc", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646166961, "uuid": "ad253e45-2b16-43cf-9018-c1cd48a1ba0e", "comment": "Malware payload (Heodo)", "value": "6b4caa5c5cdb78222bf223e7d71f6191531643cb6adcd4e067bdfded14169fc4", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646166961, "uuid": "50603529-26ad-4a18-973f-26f60a44ab74", "comment": "Malware payload (Heodo)", "value": "022c1a5b7dbc0bbaeae396c00a48ee2f24a3dbd3", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646166961, "uuid": "705b95c3-252a-4f48-816b-5c8ae6a64189", "comment": "Malware payload (Heodo)", "value": "10bfe462614aaf86d6ef5b817c34d7de70ff8f871e58666885cb91fa8dfcbdb8319ff2626507d7fbadac9f64e9c3fb39", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646166961, "uuid": "f1f6a7c2-907a-4282-a14a-e8e6fa52895e", "value": "T1D323E129C1606828C73D8C759200E6A3720A7901D9D5FB893586BB1C3B96FEB53AF5CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646166961, "uuid": "172ead08-383a-487f-8643-03ee42ab5781", "value": "768:2yMo9DOevZCwrvtE9WzdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Uh0VP9HW:HMo9D88tT5fTR4Lh1NisFYBc3cr+UqVk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646166961, "uuid": "03c1cc9b-36b5-4b21-88fb-9a8e932126b2", "value": 47703, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646166961, "uuid": "1ccf2b0c-f06c-40dd-a2ba-cdabe53f158a", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646166961, "uuid": "c72d34cb-c6f8-4c0b-bbbf-ea0574a07215", "value": "file_01032022.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6566a89-992c-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1646117785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646117785, "uuid": "7db7ef55-9b89-49c3-9ae9-1e5d86972cbb", "comment": "Malware payload (Loki)", "value": "de8f0a4428f6007f4d699deda972aa2c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646117785, "uuid": "6432ea6b-0311-4ea1-b376-e845cb61a5d4", "comment": "Malware payload (Loki)", "value": "6b6e1d972efa4aa3bbbdcbec858e6ec23bbd48de23b7b20371f101a6e8114117", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646117785, "uuid": "cdae4d06-1f0c-4c43-8878-22daa7029414", "comment": "Malware payload (Loki)", "value": "fd90f8ac08d0f0f6a716c3b589e4f2adb804b13d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646117785, "uuid": "a2268600-32bb-40f7-a0b3-e061b744e431", "comment": "Malware payload (Loki)", "value": "f14ecd0fcf2c9cc9c5a7f6c903c1bcd3fca69328e8646d04c7d11edb4dc03d3bd4663ea4179059e5bc8a435a5d9a2d3d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646117785, "uuid": "a36b9643-289e-4246-85c7-512093ee751a", "value": "T1FEF4BE0439EA4034F8368BF2CED5F7E09B7DF621D48AA0B668001F594551BBD8946FBE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646117785, "uuid": "3e3e6bea-196a-4253-b12e-984749e73b86", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646117785, "uuid": "d713229d-2aab-4238-9ae5-1871fcf7efe0", "value": "12288:6RYrQcVmCu2tDdgBLYgmCTlDFpds3GGgypk8fbfWErh4uWON4NciCWWTsfBUWt:WcVmCu2hgBLYgrXpdnXQW4WpgsZj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646117785, "uuid": "7faadbce-ee9c-4f29-bbeb-20025d1e8129", "value": 763904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646117785, "uuid": "9fcadc29-26cd-4c0e-ae81-1afbd91036aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646117785, "uuid": "6d46332a-21b3-417e-9614-b30d9a5174e3", "value": "Proforma Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f6d04bd-9937-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646122445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646122445, "uuid": "f6f1e783-42c6-4e22-bccb-5750c40fc41a", "comment": "Malware payload (Formbook)", "value": "84c7e0ee4768b7bae9ae93e1d5ad23cf", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646122445, "uuid": "a033a060-62bb-4173-939a-ed4e05a914f9", "comment": "Malware payload (Formbook)", "value": "6b9a39bea713ed377c8383e4510ccdfe1e16e725a7f92a75f99923b8c0cae73d", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646122445, "uuid": "61fd0016-5115-4ee8-8d7d-da854220fb77", "comment": "Malware payload (Formbook)", "value": "7fd18c41eeaa55d8127727565435cf096c9d3eee", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646122445, "uuid": "1d2bac92-e7fe-4b39-b925-10357b9bccd2", "comment": "Malware payload (Formbook)", "value": "232ffc3857d709330c082950297ff16a80d5e27d8795b14168b8f9dcdb23621901d42f5039dc3d731861035987705601", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646122445, "uuid": "de6631fd-1bc0-4772-bc6c-e3b6d8666422", "value": "T10294234CE658AE1B6AC5A5D84DE84AE02D47E37EFEEC82FDF1DD224519844C8760C7E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646122445, "uuid": "85e27d03-269e-4e0a-8dbd-22fc479d55f8", "value": "12288:8OvGe3i8XAEtgwG2s9ePKcMCg4TK/9tDxsn:fO8XAsgn2sxGgwcxsn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646122445, "uuid": "a93b22af-a487-42d2-9e69-ad4ca1aaf441", "value": 439475, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646122445, "uuid": "d5895b9b-2a89-4942-834f-50183b6f73b0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646122445, "uuid": "91abf187-3e0f-486a-9ded-fb2900fd79b4", "value": "Order.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39881653-999f-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646166968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646166968, "uuid": "2ee304ed-5034-4c68-b8ed-e69bfcea71e5", "comment": "Malware payload", "value": "10e465db80a7384748960b69d00574d2", "object_relation": "md5", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646166968, "uuid": "5b2b4f8d-fd0e-4fd4-90e1-36739dd4f17c", "comment": "Malware payload", "value": "6b9f01a0342d5fee4224755f17de867dc2c1c12b94f62c003dcb5b043dfe7838", "object_relation": "sha256", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646166968, "uuid": "dbfecb82-8a01-4888-999a-04c9efc6d5da", "comment": "Malware payload", "value": "ad9cc2b4f2b7bec121006c8fa11d05befd6c7598", "object_relation": "sha1", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646166968, "uuid": "fea830f7-0b60-48b7-9d20-800a729bead5", "comment": "Malware payload", "value": "f104af1a2c51220081969ba95603153b986bd866f900e2c82284fdce73c9c1758938c5ddf3656a93458890aae3132814", "object_relation": "sha3-384", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646166968, "uuid": "57bce0a7-54e1-4bc0-a8ab-b22ec52210f5", "value": "T12F23D025C1607828C73E8C759200EAD2720A7D04D9D5EF893585BB4C3B96BEB57AF9CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646166968, "uuid": "7c35fb64-ff25-43b3-afac-6fab03fa406e", "value": "768:+io9DOevZCwrvtD608zdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Uh0VPWft:+io9D7UtT5fTR4Lh1NisFYBc3cr+UqVC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646166968, "uuid": "07a4c866-ddd0-4a8a-b99d-26c535fda1a8", "value": 47699, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646166968, "uuid": "56035d2b-90b1-4c5d-90c6-9835e811d51a", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646166968, "uuid": "824d2603-087c-4d91-aefb-07ee92a07ff7", "value": "ommegaonline.org.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ab341bb-994f-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646132557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646132557, "uuid": "2421f00f-3bc8-421d-8391-59524f7014e8", "comment": "Malware payload (Heodo)", "value": "6d26421c3784fb369f1246b3c51fa073", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646132557, "uuid": "62860d9d-ea64-4a59-b6ef-6fc7d13de16b", "comment": "Malware payload (Heodo)", "value": "6c44284daeb102fcced2e4ff28ab388fb974fe677470519dd8492c546c37968a", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646132557, "uuid": "9fe68629-0597-4244-86bb-409bf48f1f08", "comment": "Malware payload (Heodo)", "value": "ec62c361800a93ad007ccaf861865b5641b3576f", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646132557, "uuid": "0dfa022a-c4d7-4ec4-a319-00b692e4687d", "comment": "Malware payload (Heodo)", "value": "4e3948ee83e7def42ba0f6448497b09405737883b9cfa74353027a2b72bd03ad11e6f6088dcbcde09c33cd97b94c11c9", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646132557, "uuid": "5c9023b8-3e0d-4192-8e75-ecfd7abfe453", "value": "T11313E02AC0961959D727283DD6148EF4124C0E4A89E5F99B1D50B3AC2B6E1FB0B4FCB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646132557, "uuid": "70695d2e-9a8f-44b8-9b78-a143860c71e8", "value": "768:G9oms9O+pOevZCwtxyKfcrND59V+L9Rw4eWrXcTqw0VfWZE:G9oms7tylND59V4jwmXc2RVfW+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646132557, "uuid": "5110362d-eb11-4707-9a7e-89a71dc35f55", "value": 41841, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646132557, "uuid": "4e2c2723-6250-448b-ac37-2fe70355b175", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646132557, "uuid": "34a5d26b-9eb2-4ecb-aa8e-53d37e48b463", "value": "payment.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d29dccdb-9902-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1646099794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646099794, "uuid": "95e531a6-b520-4aa0-b32c-4c90f28b99f4", "comment": "Malware payload (Loki)", "value": "6ca4252672cc9b366320474bc72477ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646099794, "uuid": "0654ef82-cb8c-47a7-978e-6c88850d7f9d", "comment": "Malware payload (Loki)", "value": "6c5b05c8e7c1ec5c9b7b963069e1f1b10d0d3f0bd6f25dc8bcbcd5658124fc5c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646099794, "uuid": "13b3f48d-f610-43b0-a10f-3f6f52dbbb96", "comment": "Malware payload (Loki)", "value": "491862f7dbf51bf4358302a1c6a8e260f0fc6e8c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646099794, "uuid": "f8dcb32b-3721-4858-a365-092d01773dbf", "comment": "Malware payload (Loki)", "value": "e80fb53d6755d9b61ed0004baceacccca52c0bb50e690ee68e1cfa0d7fd3e523fdcd468949ab70a881b81c484bea8f8b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646099794, "uuid": "eb49c54c-6072-401d-8005-21ba949be2a7", "value": "T1D4E4AE0838EA5139F8368BF1DAD0FBF1DB6DE221E44870F594000E554A46BBC895AEFD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646099794, "uuid": "09649acc-3c06-4dca-9d17-58b131ee3917", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646099794, "uuid": "0471a0f9-f920-4d89-ae8c-2ae2262c29a3", "value": "12288:vEdlR/I+GvxyNFweEE8yAfGUIoPmcQ1LOAJxY+wn5RBCamd0SK7DS9e9F:qcxyNGNPvIo+1Lj85gXsDceH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646099794, "uuid": "26421bb6-04b7-41e9-8ffc-5cf9d513d0ef", "value": 702464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646099794, "uuid": "2f53dc78-89da-4217-bc77-4a9fe6860140", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646099794, "uuid": "43f4a7c1-c321-4ef6-976e-f5da39be46ee", "value": "PI-AKR-112-2022-01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62297d2b-993a-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646123657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646123657, "uuid": "777848f2-6438-4e01-b608-4fce9226ba46", "comment": "Malware payload (Formbook)", "value": "bb72baf987635428361c06e25d1d502d", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646123657, "uuid": "44acde35-4b12-4be4-9b2d-e6cab39e60e3", "comment": "Malware payload (Formbook)", "value": "6c97c1a4e7fc851d1b7085ba70489fcae65725b825d812c52305b14304099f56", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646123657, "uuid": "da2786a0-fffa-48a8-acd3-3a4f0137f471", "comment": "Malware payload (Formbook)", "value": "2bbf0ee5fbd4886619268405e8ff144d6822547a", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646123657, "uuid": "072910e9-5d11-4504-a80f-be61b18d771d", "comment": "Malware payload (Formbook)", "value": "59d51821b5cc8bbf3c5afe05801eaf65cc6e89dc3a05915c5c1487c86f61d76d4d3bcad9e391ca4c8592a01a8cf5783e", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646123657, "uuid": "46cfb947-1be3-4bdd-96e0-df76a853390f", "value": "T1DB55AE0439E65038F93A8BF1CAC0EBF1DB6EF221D44871F964000E559A45BBD895AEFD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646123657, "uuid": "335dce52-2836-4025-9d09-aeba26a50cf4", "value": "12288:9EbOR/IHyGinQqCIhB0YjBZ9SI7Ki4+EKPnyThg3BVXCVgmoRjK2:aTd5YjH9ZvYhg3BZ0aK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646123657, "uuid": "fa4577bc-0a2c-41a5-9380-041201be8336", "value": 1376256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646123657, "uuid": "ae50d7f8-3eab-4f07-90c8-a05b166e346d", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646123657, "uuid": "5899db24-ee0d-4c5a-b489-9a0fa245f318", "value": "RFQ-Bid supporting Documents_1.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fabc72f-9987-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646156617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646156617, "uuid": "90f9822b-1781-467a-8e7f-9a814c0347e7", "comment": "Malware payload (Formbook)", "value": "9e2db1088762d4fc5d0cc4e38e08926d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646156617, "uuid": "45f57a2b-17ea-47d8-8757-347cc7c55a10", "comment": "Malware payload (Formbook)", "value": "6d3ef9ddf5f1d57d353e5d8b9bedbca6ab42765de06abf381534126d24142948", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646156617, "uuid": "4e22fdfa-8a18-4cc0-a0c1-57c50ec44781", "comment": "Malware payload (Formbook)", "value": "8441b634b69e053d0d583b74dbef4c54311678bb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646156617, "uuid": "d4da931f-0ce8-4c9a-a959-58e1c3ace35a", "comment": "Malware payload (Formbook)", "value": "665edaec7ada8f7ba3896a5c8194bbda75ea08226cd3971894b0801c22f32f76be252c109113dcc4351a195cefd696a1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646156617, "uuid": "39f9bf34-56ca-4b4d-8b95-fb8cec261e82", "value": "T1FA15AFD2AED00433D0771A3DDD5B87A89926BE611E24588A2BF5DD0C4F3A7C23A37257", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646156617, "uuid": "fbbd6fac-64d9-4cf1-8103-a84505acd4cc", "value": "64e5840c420b2c0e97168f714bb7e606", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646156617, "uuid": "183f6b44-0e98-4663-b998-db9d3b9fdf32", "value": "12288:KzUIfU7Qz6JaV9TjdNRgjYP6hsmSgJRO+jj6F2pUHOwlME0WGX/CALdWSPm6LR:KBfUMV9ThgYPYS8/j6F7ZME0WO9d7HR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646156617, "uuid": "97e39fea-0f4e-468d-ab81-9a0eac1a82d8", "value": 936448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646156617, "uuid": "7dfde727-5d66-4802-9485-592a89c2f90b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646156617, "uuid": "bafbbd9f-d325-4e38-9a07-3e9331ebdc5d", "value": "9e2db1088762d4fc5d0cc4e38e08926d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15663591-9943-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646127394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646127394, "uuid": "814235bf-e3ec-4270-bb23-6c97b74ce005", "comment": "Malware payload (AgentTesla)", "value": "dc50dfa6999393a432c051966570886d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646127394, "uuid": "73771e93-121d-4a27-90ea-da22a25e7f52", "comment": "Malware payload (AgentTesla)", "value": "6d55f0791e96091c8b4f0f951e8f3f8c951f681255338408e2edf4bfcfc20dc8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646127394, "uuid": "1bc175b8-7f8e-4137-b8b8-c6e6ccf3cd1c", "comment": "Malware payload (AgentTesla)", "value": "2608a59eb1582f64ebe42752ee847d8ae315ceb8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646127394, "uuid": "3cf0f841-3e8e-4036-85b5-b533fd20284d", "comment": "Malware payload (AgentTesla)", "value": "4df49bc94776c74a5d042d4485c84d0e959a285c2d2614302568e64dadc8514636c3bbf9997372bf2d7f1d878419b4b4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646127394, "uuid": "abb3894f-750b-47c9-b996-edf23e868e9f", "value": "T1E1742323BEC8A167E04695312B77D7B4E7B7C1E40A5B0E2B13F85F662EF6452140C1DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646127394, "uuid": "d06595d7-60d6-4282-9efc-4792345484d3", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646127394, "uuid": "07233d01-7a8a-4814-b73e-0406fa93863d", "value": "6144:rGi5qniE+kQYpJxLV/pz76c6LfIq9UWYGX6HyPcdRpFzVtnVKFbWvt2EcH5:MniE+kh9/dj6D+W56HRvnVK1WvNcZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646127394, "uuid": "5ca412a3-4e24-40bf-81fa-2e053218391b", "value": 369008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646127394, "uuid": "f639cc9c-a9a5-4ec2-8c4b-02c8019ddb19", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646127394, "uuid": "e7598aea-960e-4c1c-a000-685a95c0ac9e", "value": "proforma Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffcab8a0-9943-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646127787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646127787, "uuid": "0bd3626c-309b-42bc-8d8b-653e7b8a3d1b", "comment": "Malware payload (AgentTesla)", "value": "57f8e760393e067529a04f9a71b81ff5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646127787, "uuid": "46fec8ef-8643-4a0c-947c-fce168d207ef", "comment": "Malware payload (AgentTesla)", "value": "6d75610ed73dcee36125f4b3e248196b805c3d0c2039d4ec16aae998eb729b49", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646127787, "uuid": "b577dbea-eda9-4775-9e3b-408f5ea5b798", "comment": "Malware payload (AgentTesla)", "value": "c93928ca5749f784150e8791e5b639e9db3f1c6e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646127787, "uuid": "02c96fe9-85ed-48f9-924a-c67d6e1578a4", "comment": "Malware payload (AgentTesla)", "value": "22501dcd8ba69117c119aa68b19a246699915e4c56f72765a61c191fe8d33095518c5f5dc1b6049e9facdce8233c824b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646127787, "uuid": "a289d9e1-2e7a-4660-8a2a-17785c443496", "value": "T149435B11DAB9E82DC82ACD7ED493C1600633FD095CC396978F91FA9DBC7074A7942B25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646127787, "uuid": "72c7231f-5dda-4a7e-9864-61b2c040f608", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646127787, "uuid": "d354a669-4517-4711-9c00-0c46887b9442", "value": "768:hwTudAeb3XokaTh6RidhkGWqlRi55g8dtA6ohgAftZNViCnf1K0osAYqF85Rw+dT:hwTkj1kEwdhCmRi5imA6jeVrNKf0/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646127787, "uuid": "d5cd04e3-1747-4345-bd23-c8da99364bad", "value": 58368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646127787, "uuid": "2a820e52-29e8-436f-a056-cd3f42296913", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646127787, "uuid": "d9aa87dd-afe1-47ac-969d-47e1dca0bd52", "value": "copia de pago.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae884d07-9985-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646155997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646155997, "uuid": "d2697770-6b08-4ae6-8770-ffa991b52de6", "comment": "Malware payload (Formbook)", "value": "8b8c35c67649395e451ccc9a5329b39f", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646155997, "uuid": "f2df1e3f-e372-4f53-af75-d8d6fcd07fbe", "comment": "Malware payload (Formbook)", "value": "6dca62b33456dd1adb3c15961845de129357b6e9a28064541a9c7baf0a5e8182", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646155997, "uuid": "ecead8c4-582b-4cef-bea4-1e637617ea61", "comment": "Malware payload (Formbook)", "value": "5cedbb0176ed22f2410d3ffda44d75586b15d250", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646155997, "uuid": "c1c8c6ca-9e39-4816-8a20-e82361fb1fa4", "comment": "Malware payload (Formbook)", "value": "6854286b983a4593b99e672004c2a314a154355e2e047f81770ab417e33c4cb13890b96ff2115490df38fee5a566efc1", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646155997, "uuid": "15fa5fc0-18e8-44bd-8124-c1f42d6daf7c", "value": "T1301402F96F3AD64AEB736A3E44741253E8F99F816CCBF259600C309E8EF140217E151A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646155997, "uuid": "5cf1cfda-eb4e-4113-ab8b-ae7e976b9ef7", "value": "3072:bzJJJJJJJJJJJJJJJJJJJJJJJJJJJJnJJJJJJJJJJJJJJJJJJJJJJJJJJJDJJJJX:86UXAdWUF+sc/AFC8JSpJS4rm/b3F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646155997, "uuid": "ea1f2887-e4c7-42c4-81d7-a072238109c4", "value": 191192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646155997, "uuid": "d15780e5-a24e-4ae0-a17d-472eb65d4363", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646155997, "uuid": "5516e9c1-e80c-4687-9904-23301fca7737", "value": "Scanned from a Xerox Multifunction Printer.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12b15b8d-9977-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646149723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646149723, "uuid": "eb17f4a3-1e86-437d-9c9a-d3906494cbbc", "comment": "Malware payload (Heodo)", "value": "e7e28edc1e9b461e2e70e5f53d164e81", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646149723, "uuid": "63ea5e3d-e4a3-48c2-b3a8-bcfdafd788a7", "comment": "Malware payload (Heodo)", "value": "6dd5dbbd6fbb57ffd8af86fb383f4282af62cd84a3266443597af6d3eb3d875d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646149723, "uuid": "316c7708-19e9-4828-95cc-c6237a0cbe97", "comment": "Malware payload (Heodo)", "value": "4df07a4f32f6d9acfe7ddb293b40c5ce5c03328c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646149723, "uuid": "7933ff15-b43d-49f5-91df-10d653ea08f2", "comment": "Malware payload (Heodo)", "value": "4acf872225aa470c126c9dacdb5045a0c703548b0e2be3575c1037c859919a1a29f18c228303e6ed265a3861ba120cbf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646149723, "uuid": "61e44866-02fa-45a3-9ab1-efd6aa8a09e3", "value": "T18BB4AE12B790C076D1AA36342526A7B51AEDBC709EF5C3876FD03B7E5E301918A3C35A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646149723, "uuid": "d7534577-d34c-4e34-83f8-55dfd0939b3e", "value": "f08242131de62ca6d7c4b2727b491b3d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646149723, "uuid": "f7849bc1-0dd2-4b70-bf75-f87c6673a55a", "value": "12288:jE3TMKM/JjdkdO4+BNhOwyx4h43JopSz/o:jE3TM/JjdkSw3Ko", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646149723, "uuid": "bf590668-1a4c-4ea8-ae71-d057238fe27e", "value": 505856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646149723, "uuid": "a67737cd-273b-4711-95d7-30957bb4d5f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646149723, "uuid": "b75a9513-e07c-44e9-b1ce-199630e77077", "value": "e7e28edc1e9b461e2e70e5f53d164e81", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16868ef0-99a6-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646169916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646169916, "uuid": "0b2eda48-f09a-406c-ad71-5856226156c0", "comment": "Malware payload", "value": "94657380da05dc1b9108463096f3c188", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646169916, "uuid": "4c1b7223-724d-4494-93dd-8097a2234b56", "comment": "Malware payload", "value": "6e33bb5afea750c9d310218cf18796b7e1754332684bf92806ccba081bcc5a69", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646169916, "uuid": "0e67bb14-c4af-4399-a40b-93477c8a093d", "comment": "Malware payload", "value": "5c0f8735d4a63ee55b77bf57c8c821e3969d0e44", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646169916, "uuid": "d495c6d2-121e-4704-bb8c-6ba6569cdc31", "comment": "Malware payload", "value": "9319fe69ef8010356962040b72091cf33c5abde8c9ce11aa69c98780ed63ed97f82eecaa893a4c5410a3e4e399f1122d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646169916, "uuid": "189ff9c7-0f1c-4430-be2b-24f043b5af03", "value": "T110451254AA90C03CE4B311F87469979CB52D3EB14B36A1CFA2C16ADE16397D0DCB634B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646169916, "uuid": "a1113937-ef7e-43b0-a07f-3110c15e4a54", "value": "e0099c0ba3b564d2d3b0381e49f6db7c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646169916, "uuid": "59b9c3b7-6f38-4f17-9e08-872b0862f718", "value": "24576:Mm8S+mWJEc0NH8HSCqj5gP71VVVz7nuvCGmdZJ0ENe:qJEc0NWq5gPb/56E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646169916, "uuid": "3e1e4111-84e9-43a4-9a32-8482abdb859b", "value": 1256960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646169916, "uuid": "8bf4b024-c127-459d-b21a-f81834263286", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646169916, "uuid": "5d826b54-c457-4411-b8e9-ad074eaf1b41", "value": "94657380da05dc1b9108463096f3c188", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc5352a9-9935-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646121715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646121715, "uuid": "7a78bef2-7b66-4d6c-9f4d-c13cc84a9b56", "comment": "Malware payload", "value": "d3f9b222a5e87d8788e3b3701f6883ef", "object_relation": "md5", "Tag": [ { "name": "agga", "colour": "#7E14E6", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646121715, "uuid": "e804b0eb-f288-4d78-a5db-3ebfa1d8dac0", "comment": "Malware payload", "value": "6e44dcf8434f64a602e74c4dbf5757fbaf828a8956cee1a7b6b4b9637d23f39d", "object_relation": "sha256", "Tag": [ { "name": "agga", "colour": "#7E14E6", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646121715, "uuid": "713061fa-47c8-4184-a497-a177e827320c", "comment": "Malware payload", "value": "a4b131f9563591c6b8158dd323eef81f026fd29f", "object_relation": "sha1", "Tag": [ { "name": "agga", "colour": "#7E14E6", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646121715, "uuid": "10c127e8-5a07-4cb1-b23b-3601430d847d", "comment": "Malware payload", "value": "45bb78846a8aa4b6359fe69b8a4150dfe8abf9b474efc37545ea4e40b36be11130d8b6ab32747c45c49ae7dc446f8727", "object_relation": "sha3-384", "Tag": [ { "name": "agga", "colour": "#7E14E6", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646121715, "uuid": "2b196b36-bbe6-47fa-ab8d-16c754fe63c5", "value": "T17113B018C102710AC1B3A53EDC3984E21C7ADC176164499FE1D6B98B0BA4FEB3B4EBC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646121715, "uuid": "7028d4de-0e75-4598-8c48-c7b01b19d5ed", "value": "768:H+ERD4S0JS00SneSnjS0yS03S0IMS0bS02ScxbV+cUs70Nn2srTpxKC6yDsfudHV:H+eMVU7N22Tbwy40zVMMA2+61/K8Nytw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646121715, "uuid": "bdf83184-698c-42ac-9c21-fda1a8ff157f", "value": 43603, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646121715, "uuid": "0103578b-511a-459a-808a-bc234c89fc1c", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646121715, "uuid": "47cc0b6e-fc88-481d-b4ce-51c3ec2b936d", "value": "MEXACARE - new order.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5be4273b-9939-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1646123217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646123217, "uuid": "86280b84-ec00-4693-add4-7ae2176618a4", "comment": "Malware payload (Loki)", "value": "a5ccef6cdb8fe15f5b33fb8fb10019c2", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646123217, "uuid": "da1a8f65-577b-48cb-8a99-266e36a5d267", "comment": "Malware payload (Loki)", "value": "6f35ee0ef52a543bf33b20f0d949c59a93f67bd78c8d0f9a105e989a5a2b9751", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646123217, "uuid": "68f7fa55-374b-4349-ad9b-b1f164375fb9", "comment": "Malware payload (Loki)", "value": "304670fa88f10f249b1ce42caa2411877feb0c4c", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646123217, "uuid": "1632e047-ee5f-44be-8de1-7594b3bc88aa", "comment": "Malware payload (Loki)", "value": "3438334848c79d9b6b8d72935ffecdfc56fc6a73d564872f7b8a94d08b859d2d170015e4e781330605bbbc25bf3c50e6", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646123217, "uuid": "b1858d94-f0d7-4250-a5fd-c9b8cf111934", "value": "T18CF423DCC8467218DC5694A024E7255B90336E36371C8A79F6FDF8EF45DC12AC09A93E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646123217, "uuid": "3bdd5b04-c001-4944-b068-586a455f1edf", "value": "12288:Tzx4g6xi48QhSJo9YHEhb5Vj3LFfFyJmBkXY3Ov2zmuj1horaabKsPC+VX1/zdpd:Px4g6x/8Do35t3LFfFYmBkXY3O+KWwaO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646123217, "uuid": "eb683b95-e3bc-4032-8103-b6fd06286816", "value": 739505, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646123217, "uuid": "247d081c-c012-44bb-826d-e1537f437489", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646123217, "uuid": "18c81e15-d2e2-4c07-bde9-dc0194d847ec", "value": "Purchase inquiry_pdf.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9885d46c-9974-11ec-9275-42010a9c0029", "comment": "Malware payload (STRRAT)", "timestamp": 1646148659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646148659, "uuid": "7add2c42-f432-422c-961b-61d5ef0d5475", "comment": "Malware payload (STRRAT)", "value": "4513d8bd9b483299f230aa5bcb9a6157", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646148659, "uuid": "4246196a-a287-4ac9-b823-e26c8fd81205", "comment": "Malware payload (STRRAT)", "value": "6f50e90b514731e51d254f14e4c9303d3d7cbeb002be70b653322d0fb8074817", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646148659, "uuid": "c9389782-0f87-4aa5-82e1-40b36875c07e", "comment": "Malware payload (STRRAT)", "value": "52c98d5834fdb155080477dfe072f52c9b11ae36", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646148659, "uuid": "96856f9a-6f18-4594-acd6-20801ad478a8", "comment": "Malware payload (STRRAT)", "value": "ef5d27c1395137b58f932eb5a4deaecd963d846449a91dd80c1bd29ba4bde8c313deda9a48d105afab8fde90d1617b65", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646148659, "uuid": "65407647-8f97-4ee4-a05e-fb97df7348f7", "value": "T109E4AD2136C68B32D493117155AEA3711A3EEC304B718287729C7BAE2FB57C06735B9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646148659, "uuid": "1b179c20-2d6d-460b-8710-fedbd2fdc40c", "value": "12288:Bl/DE9Q+3Nn7ByIuyBlpOuq+8aBd98Eg1MaFasDiYv4LEH6Kw:Blgq+3Nn7BjlpOu3LBYZ1M4asDidO6V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646148659, "uuid": "1a38f12d-45f4-4863-9393-4ba1d30d774a", "value": 705772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646148659, "uuid": "8b0030fe-6ad7-4661-8a89-cba4cb28fcf5", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646148659, "uuid": "1b67a8b0-d570-4d9b-b1c6-bdc373bbcf50", "value": "8f920b138b64bda83e3f56cb4562f1e0.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6db7ff3-9956-11ec-9275-42010a9c0029", "comment": "Malware payload (GuLoader)", "timestamp": 1646135798, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646135798, "uuid": "d4d75073-5d0d-48ea-bd18-4150e9a8ee93", "comment": "Malware payload (GuLoader)", "value": "927bc160c71ac6e80bd8ac57f4bf2bfa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646135798, "uuid": "37558f53-1b5f-4b42-8eab-29b833af314b", "comment": "Malware payload (GuLoader)", "value": "6fa4a2e814948b39b8e6df6901112712a4ac2326ca34931111cd3cf46cf7bc2f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646135798, "uuid": "9aa45a2b-2a3c-4b07-8335-ef3725d2c738", "comment": "Malware payload (GuLoader)", "value": "be9b9c96800f133a0c66ec911b4bb17425248865", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646135798, "uuid": "7b0f8d97-05d6-45d8-97e0-5aeb99dbcc31", "comment": "Malware payload (GuLoader)", "value": "a88e5bb1b9029f028376d47de45cd9bcf1c364375a3b14ebf76842dd63e6a63600f7fb81cf8d7d28d933343df7ece827", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646135798, "uuid": "6cf11237-0d32-4853-ba03-488de971a7bd", "value": "T171840225AB64C452D1E11E302D36976A8FB8EF6529B6534737C2BFAE74325D0470E283", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646135798, "uuid": "ff1720fc-6510-4bad-9770-031a2093ae21", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646135798, "uuid": "448c75ea-1b7f-439a-9f6b-697bc574ff23", "value": "6144:wNeZGuOwoXx1OQFk3BcvPmfs1P00qHjEn8cFUekD9UqtJr0iN9r:wNoO90BcvPhN03jE8cF1A9ZJr0iLr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646135798, "uuid": "6d9345ac-6903-4e57-9f95-2b162d7403a9", "value": 383061, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646135798, "uuid": "5701e942-c302-4080-b905-c363233c5f25", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646135798, "uuid": "46d41ff9-5dbe-4c42-b0b0-67016ce393c9", "value": "Q22IT00076 xls.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58f6dee1-9981-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646154136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646154136, "uuid": "149d81a1-d55a-47b0-9f2a-55c1c1b01e89", "comment": "Malware payload (Formbook)", "value": "324dae902601f880e953c844dd3553ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646154136, "uuid": "b5493784-ba39-4355-bf7f-5845b213de16", "comment": "Malware payload (Formbook)", "value": "701f20591c85d0dd55c620f2412bb558742418677555d85321b87d8cc746b258", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646154136, "uuid": "da131a60-2ed1-4edf-9b6d-a5ca0579a042", "comment": "Malware payload (Formbook)", "value": "8ef179bdf7c95add688a58025b1c38843cb044bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646154136, "uuid": "6e890bad-ef33-4284-becf-5b496429d395", "comment": "Malware payload (Formbook)", "value": "c5e453bf4be8c1333108ed27eaa42bbfd6021e342fe6a055cbe949e6727b8462a04c5071ba4f534d2f15c5d194b96734", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646154136, "uuid": "eeb2b2db-05ed-4c9b-aa12-9275a45b0c03", "value": "T1D2D4BE467E315FE2D939D730241D02F8CFE7A962C31EF2A93C87769900B2B4746E6916", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646154136, "uuid": "d4ae487e-f3ee-47bb-90e1-dea6e5ca0259", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646154136, "uuid": "e60b47d5-d43d-4cb8-a817-1d9a416085ac", "value": "12288:lVvy6zhGRUcZ64pcRm00dTo3OTclnBgSOoOQ14NmeA0jLMHhRhVZvjijgQZ:lbcU/RmZdTo+T0/OolPx0Ep9bQZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646154136, "uuid": "283d94ab-5fb3-4028-8b07-f3828a3a073a", "value": 606720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646154136, "uuid": "77020c46-ca6e-417b-81c4-5ae9d15b4e1a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646154136, "uuid": "58720181-0951-4fe3-8ec6-2f129d716aec", "value": "PO - 108.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "030cbb40-9947-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646129081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646129081, "uuid": "6980210a-3640-4e1f-b633-94da5ce77059", "comment": "Malware payload (AgentTesla)", "value": "6d2a6941d18e905cbc15a9eb216039f6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646129081, "uuid": "71b7da07-51eb-41f5-a185-37c528202c35", "comment": "Malware payload (AgentTesla)", "value": "7034ae5a79e8263550a1a1214be3b16fb32399371e71ded2ba8bcf52b5b0e3c4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646129081, "uuid": "c139e98a-e7a9-4419-80ee-3dbb7588cfd0", "comment": "Malware payload (AgentTesla)", "value": "9923fd4846c54596558ea8579b99bd425c6618a0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646129081, "uuid": "2fac883d-fa57-48bf-a656-6bf3b2aafe62", "comment": "Malware payload (AgentTesla)", "value": "e9848293ac070c0e682f4b3a7b9e1cf914cf335a9fda1741a134ecc51cf94319bfa71663e0596991456e42da7cdc1f8e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646129081, "uuid": "18f74733-5dce-4e17-9630-ba9e93060284", "value": "T11B15BF4834D6607DE836CBB1CBC4EFF1DB69F222D54961B260020E599A0DBBD8A05DFD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646129081, "uuid": "4d88d12b-6fda-4bba-962f-f84b9aea8569", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646129081, "uuid": "c4325fb5-fe11-45bb-b611-a8369c59e3d7", "value": "24576:yRI4NMC9faZcO2KOkTY0DA4Cap7RqT5jg:X4NKZrDtrs4RpCj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646129081, "uuid": "e6e21502-8e6f-44eb-ab60-88566765dc1e", "value": 930304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646129081, "uuid": "f98b4218-0f81-467e-8b9b-838b46f19b7a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646129081, "uuid": "70dd907a-bda4-4556-8cfe-810921464650", "value": "Outstanding Remittance Payment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae834095-998c-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646159004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646159004, "uuid": "1f039e35-1da9-49c6-a121-b8c584832fca", "comment": "Malware payload (Heodo)", "value": "9d24595b5d18d6e8ed79f594955c3731", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646159004, "uuid": "0924b034-5edb-4289-a4cb-ed4fb33a0e59", "comment": "Malware payload (Heodo)", "value": "709390a978d39b548f02e243be8387fc2b37676af7b5293de15cd312b97235b8", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646159004, "uuid": "83c7ca03-d93f-4612-aa3e-e8b45caa1ae7", "comment": "Malware payload (Heodo)", "value": "48f2a4b93602c14691b791eeabd75efc756728d4", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646159004, "uuid": "cc916728-8fba-402d-b370-f8be57875035", "comment": "Malware payload (Heodo)", "value": "28fc5cc1455a2c17b7c057b5c14d3a07dd23b781391fcfd1d97d0b307721ba4aa1d6e3a58072ffb7fd87afd2659ad93b", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646159004, "uuid": "48cee4e7-a0f3-42af-9e7e-2f587c023af0", "value": "T15C23D025C1607828C73E8C759200EAD2720A7D04D9D5EF893585BB4C3B96BEB57AF9CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646159004, "uuid": "d14f6211-93c7-499a-b112-596741e0ae19", "value": "768:yio9DOevZCwrvtD608zdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Uh0VPWft:yio9D7UtT5fTR4Lh1NisFYBc3cr+UqVC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646159004, "uuid": "ccb7d089-fb90-4deb-b0a3-96c4d8893cc9", "value": 47699, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646159004, "uuid": "87087bd1-e13b-4a22-ba1b-85f4dedb0998", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646159004, "uuid": "f3d237f7-ca82-4854-a683-0b45ca15b6cb", "value": "Recent_money_transfer_details.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83751ca9-996b-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646144758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646144758, "uuid": "47d72386-3245-492a-bc7e-eda47fd5eed7", "comment": "Malware payload", "value": "1243b4a329a96d641d70ed08149fa2b3", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646144758, "uuid": "ab141171-75c5-44e7-bac0-9128498788e3", "comment": "Malware payload", "value": "7105224b4313ab84ce432bc1e5bc374045348d4a70fe9090f580b3eba473d03c", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646144758, "uuid": "45f9514e-4235-47d6-82f5-436805375171", "comment": "Malware payload", "value": "d3e57c89b4e4b802db5541d32663b414b2b8c4f7", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646144758, "uuid": "c355702c-14c1-4be5-ad9c-8792c4bba80d", "comment": "Malware payload", "value": "1be75e02e355dd198223cb510138d798fe2abde2910af4a761a94bfd563537c9d9bae79fa0262821bc6b79ecf28a4d2a", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646144758, "uuid": "8ec326b4-06a3-40af-8c78-aec4d0a593e7", "value": "T1B365E045F3C5FC2FCC7384364FBA8A2A94469C568646D71359A0B52C8EBBEC05E85FC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646144758, "uuid": "61b1e95b-d3e0-456d-a789-a11d8e98fb83", "value": "24576:9IjbKfzk1fci/p4gObdtjJPRWxfFLGt43ePq920q+LoFZbhx8MgvlJvRz:afKfzk1fcoqgCJPGFK4uS9jq+LoLbhZo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646144758, "uuid": "9eff9b98-4ba4-4d20-9b6e-4cc425b5fcf8", "value": 1500857, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646144758, "uuid": "c5b6816a-b8f8-4f3d-ad91-fba13310ddbc", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646144758, "uuid": "017a6bc8-16d5-4261-8774-7222a807a001", "value": "psk.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "786254f6-99a0-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646167503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646167503, "uuid": "3c07af10-017f-49fe-8769-09fb222d18ba", "comment": "Malware payload", "value": "689c652f185094507807b3a5574ca3ea", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646167503, "uuid": "70b87510-3b12-4221-8546-5fa9d0122a2e", "comment": "Malware payload", "value": "7124dfc80dc2b5fc5c7eab3fe9acbcd02b0b4c1bb85712a2a16a236ed6c4c93b", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646167503, "uuid": "855968a8-959a-4110-a56c-d00c1a71acc3", "comment": "Malware payload", "value": "ae07ff89be9e0f2f94133e4db429d2f37f3b2822", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646167503, "uuid": "f4a52125-efe3-48c2-94fb-72f5eb65071f", "comment": "Malware payload", "value": "21e4ce4658fb31cd4f9afc6576dab2d6fd9b2daa6fc9f49503bff2b9f8af5145c16945f67a5abfb5b5af393a59ff0766", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646167503, "uuid": "8927f08e-c6bd-4ac5-aa22-724a709bb7a4", "value": "T15823D025C1607828C73E8C759200EAD2720A7D04D9D5EF893585BB4C3B96BEB57AF9CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646167503, "uuid": "87a28226-2bf9-4292-b853-68f3f7a11641", "value": "768:uio9DOevZCwrvtD608zdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Uh0VPWft:uio9D7UtT5fTR4Lh1NisFYBc3cr+UqVC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646167503, "uuid": "83b588d3-6dd9-4e9c-a8ae-f029d0023f48", "value": 47699, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646167503, "uuid": "a2a73be3-cc79-4786-9276-de49a96b641e", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646167503, "uuid": "a6f4e377-e60d-4ca6-9920-ea41f31b4a5c", "value": "New payment details and address update.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61d5b5ac-9935-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646121509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646121509, "uuid": "1fce83bb-4b43-4058-800d-125d904e17d2", "comment": "Malware payload (AgentTesla)", "value": "0b01ce93117d58453eefd68392209929", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646121509, "uuid": "a2fbb8de-0ea6-4e3b-bff1-66956fea783c", "comment": "Malware payload (AgentTesla)", "value": "714e081fa1cd468343511ef7a21cdd2474aa0c01f5d0dbe80de339bbd7c3dce1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646121509, "uuid": "56853c86-5c34-4259-963d-9201d40efc50", "comment": "Malware payload (AgentTesla)", "value": "a68cf9fe330aea62beaf279daddfc2f0cba62484", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646121509, "uuid": "6a9887ea-ae0e-4c70-88f0-1ddc089225bd", "comment": "Malware payload (AgentTesla)", "value": "d6cbdef08ef3d2ecfbd3aa93b9819ba2689dce0f33f27c6662e989dd5acb067a0b861a19ebc5aacf405be4871e5f0646", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646121509, "uuid": "8f3fc1fe-4c7a-48d9-8ad7-624a24672f46", "value": "T13484239539790852433B8245BE7C92C863C817F012D7E9F8B1AEFCC08E7AB9798E7155", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646121509, "uuid": "9cc3811e-1a68-431d-b7ff-cc6c699cb2d3", "value": "6144:pDjpM8/VQIXSPD24ZZhas3lBYIT8oCpamOX6OW3Tkx+W8iTnm9AgDm3:9S8/VQCSb1Zhas3lBTjCvOKOWXGnm9Ah", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646121509, "uuid": "c6422b57-8424-4df9-9739-fecce1623218", "value": 374170, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646121509, "uuid": "d6f5b533-0eed-4c61-8d0d-ce6c9973b186", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646121509, "uuid": "aeffce47-f6d4-4e03-a5f7-9de1750820e5", "value": "PO647633.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5d9c3e1-9979-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646150829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646150829, "uuid": "981c9cf9-9c47-4bd5-a862-bd68cbeb3ac0", "comment": "Malware payload (Heodo)", "value": "743bfb0f7bedc9caa8a812793d2261d5", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646150829, "uuid": "c53cab28-7c7a-4946-8479-0da45af053fd", "comment": "Malware payload (Heodo)", "value": "719054f1e68a61b97c8ef0c829ccf2bb324be75dce366be0cb1ac73ec653e3c0", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646150829, "uuid": "9f0d0499-ed4c-4e5b-a493-25238c368938", "comment": "Malware payload (Heodo)", "value": "6634be6008a87eb64dd6625d9414dde019cf5611", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646150829, "uuid": "1347e6e4-2236-4fa2-b6a3-5232fc145c4b", "comment": "Malware payload (Heodo)", "value": "a4b464fb9fe8a17ff870834a94b1735b718c16dd2f4d8d714a1158e0233f76ca4d2ce27b0a379cecae53ebf24b7c0e76", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646150829, "uuid": "8d17d811-e555-4356-904b-91bb5d1e7c42", "value": "T10723E116C560682CC73E8C758200AA93720A7901D9D5EB993585BB4C3B96FEB53DF5CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646150829, "uuid": "c8597ed6-6cfa-4d04-8630-866d8ec10e9a", "value": "768:ao9DOevZCwrvtOzdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Uh0VPPDks:ao9D+tT5fTR4Lh1NisFYBc3cr+UqVnDZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646150829, "uuid": "73063942-cd1b-4aab-97b1-3157f71c5e52", "value": 47696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646150829, "uuid": "2da5ef0b-9ce9-4105-8c03-27b033c09ccd", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646150829, "uuid": "5d79b792-bbe2-438d-8c28-905605092a85", "value": "DOCUMENTO_0103.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ccc8390-9947-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646129339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646129339, "uuid": "10390186-e8db-455c-9bb0-0203e9b5edff", "comment": "Malware payload (Heodo)", "value": "6bf737d1e6a887d25006af4fed929f8f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646129339, "uuid": "067e95bf-5d17-40ea-9dcf-52c6d875197c", "comment": "Malware payload (Heodo)", "value": "71e2dce0b57afc87e54c1b8352b21c4ab77b12a386ba526da7a0d4257e06c07a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646129339, "uuid": "7b085671-3410-4efb-9e26-1ee72e4756be", "comment": "Malware payload (Heodo)", "value": "b234edd001b4121556fea2d9967bbed60021fcfe", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646129339, "uuid": "e9d73c37-4ba7-4a56-b634-f7fd3b1a98f2", "comment": "Malware payload (Heodo)", "value": "2ed8663f3a768bb8f54a6e7861bb9866408812b266133278ae543d3bdc36acddc5a9e2f2c53bfafd7cf98e893bec8a5f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646129339, "uuid": "34fbdcb7-ced3-4f20-9b17-8dfe152a06e4", "value": "T12EC4AF12BFD39072CE2F293C503DA77413A95C65971A8863979C9BBE1D3F9428B3190E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646129339, "uuid": "9889c3ea-cd6a-4bc5-b150-831b0034cd1a", "value": "e0b213ccd96f46d30dcd8e225f4e9fc9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646129339, "uuid": "0a3e57b6-48a2-4294-bf12-711d77949e6d", "value": "12288:onEtDywy8SYlHD70WychG0QOCM8T9xvCGyDyPgyQz/VDNeg:onEtDywy8SYdnhG0QrM8hxKG7a1Ne", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646129339, "uuid": "07885825-3d9d-4aac-9cbd-681a5c052ce0", "value": 585728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646129339, "uuid": "a62ed605-0913-4c65-b363-e74aaa8a4827", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646129339, "uuid": "bcf67757-a39b-4c9b-9752-b3b315612988", "value": "6bf737d1e6a887d25006af4fed929f8f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47040bb4-999a-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646164843, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646164843, "uuid": "a95ed60a-74b8-4d36-8020-2fc1eb6421ce", "comment": "Malware payload", "value": "be93ba165f6ee46e1b7e986b27b6d430", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646164843, "uuid": "9cf9da4b-9cfe-4c21-85bc-5e04af6bd42b", "comment": "Malware payload", "value": "71fc053a9278f2e682c0bfccf6d4b946e27e40b5f62b8d95c330736830b441f9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646164843, "uuid": "f5f6bf74-3c9e-45fb-bf61-ce7156d260df", "comment": "Malware payload", "value": "758a881267efaa167a6a779f58f8846e5a310220", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646164843, "uuid": "1a3767d4-3ddf-4c8e-8820-caa973c1b9eb", "comment": "Malware payload", "value": "9db1676d09f8afe0a9e5993a583c2f79b6166421bf8d3ffaec0171f38fc16f17a23dd62ee30ac3ee7925f61a674b0190", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646164843, "uuid": "79e9900d-c35d-42e1-b688-5aade9b0da95", "value": "T1E6B4AE11B790C076D2AA36342512E3B51AEDBC709AF5838B7FC07B7E5E315918A3835B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646164843, "uuid": "820b9706-1eca-4466-abc0-e5d116333491", "value": "f08242131de62ca6d7c4b2727b491b3d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646164843, "uuid": "b180bb82-3dba-4672-b5f7-a40e41d1d837", "value": "12288:dbFLiEzuSo9guqHuWjr2py94W6SpktSuHE:5VWSo9guWJ6ZE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646164843, "uuid": "5d63b6c0-3dc0-453a-aff6-c941e97ef72e", "value": 500224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646164843, "uuid": "724d05c9-3eed-406b-9a1f-1c0547364edf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646164843, "uuid": "26ab4deb-db98-4a16-bd2d-572ab3fd7b8e", "value": "be93ba165f6ee46e1b7e986b27b6d430", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe0f49cc-9990-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646160855, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646160855, "uuid": "ca764d34-7183-4e94-9583-2b93b830db07", "comment": "Malware payload", "value": "97bb4298108603a730b61ef5c0e48c8e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama161", "colour": "#9F5DB8", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646160855, "uuid": "4f678771-90f8-480e-8d66-3a1c77057b7f", "comment": "Malware payload", "value": "7289831fb440b7f5d6efc91b9e808dc199d184b69ff7342be9977af1dadc51af", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama161", "colour": "#9F5DB8", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646160855, "uuid": "c7437053-4fe5-4e6f-aa38-e4b86604a63b", "comment": "Malware payload", "value": "af2062e66117329d608d1967443721d528aeb799", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama161", "colour": "#9F5DB8", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646160855, "uuid": "487db75b-1c0e-4661-97f2-c04ff41bd6dc", "comment": "Malware payload", "value": "9e456a6f59bc851b38bcf5201e6d7b13ae4fe1afe0e40e3e91de94bbc1153f9d90bd8076f2f6d45def61eaa3baa9492b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama161", "colour": "#9F5DB8", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646160855, "uuid": "d281c154-ec6e-47a4-9de8-09723f4ae1e5", "value": "T17725BE61A2D155BFC1733B7DAC3B2194DC24BE912D10DC8CB7CD1A9E0F296A227215AE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646160855, "uuid": "9858a395-5956-4aea-ad1b-fb4bc863c394", "value": "f3a2b34cbcfe1640f11d8b0978b1dab8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646160855, "uuid": "59f6bc6c-b3f5-495b-8f82-d164904d0522", "value": "24576:HBl4LBmTVxqyZhUgxB31FFbDt3xywiDSR6bs2:HTaG5xB3LZB3Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646160855, "uuid": "0f1c5aa7-a911-4bf8-b2c6-5c313b52ee46", "value": 1048576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646160855, "uuid": "89ecf30c-d2d3-4e58-bf9f-2a2030f9f18f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646160855, "uuid": "c70e7817-e053-4dca-a716-25d87bf7d9a0", "value": "44621.7848322917.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66d7d1d5-9984-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1646155448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646155448, "uuid": "c33a23df-cfca-4870-b1c1-ff49e409d8e6", "comment": "Malware payload (SnakeKeylogger)", "value": "b673d43aa7213515a0ba9d56c4d1ebd2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646155448, "uuid": "7f843861-fd3c-4688-9f88-fb4dfd9802aa", "comment": "Malware payload (SnakeKeylogger)", "value": "72d5cd1dea26a10b5e76e866eeeefe0520320adc988845a4fec6bb15df53d0ec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646155448, "uuid": "458b1f04-81c2-427f-a250-f10eb6006802", "comment": "Malware payload (SnakeKeylogger)", "value": "ffdcd5c61e059487e13601e72ee120de7499afb1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646155448, "uuid": "c3aa1f13-002d-449a-b84b-b8d5512dbe10", "comment": "Malware payload (SnakeKeylogger)", "value": "4162dcb8fdc47a5b4b72c2e63224647ceb62edf2cd95099bce0a49ec45d4caf2f2b57c26402a7a1f2ab3cd9ce7476182", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646155448, "uuid": "0deccb5b-4375-43d3-a9e7-c642b3ba35fd", "value": "T10E26280267ED0418F5F32B388A7AA8509A37BC560BB4D5DF02981D5D0F73AC29D76B72", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646155448, "uuid": "eb1d9c19-fa86-4aaa-a1e4-062486bb4468", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646155448, "uuid": "18b17baf-5c28-4f97-b488-367c54712f79", "value": "49152:I65DIOoVCysfoYcdLEBE7YPJVo9gvcDPkB5FREPtAxrCcGU8+kB4gb3OP1m8vPHj:BdJysfydLKKYvoCvcIpxrXGxqvO/cPY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646155448, "uuid": "21f7b623-994e-4482-aae2-58894df56f91", "value": 4625920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646155448, "uuid": "d106a4a2-f3df-455b-b15e-810828f68394", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646155448, "uuid": "91a98b35-c1e5-4a22-bcf7-8a235d9d937a", "value": "b673d43aa7213515a0ba9d56c4d1ebd2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26733037-98f8-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646095210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646095210, "uuid": "a79b378d-eb2e-4b52-80ef-2e9430d090b5", "comment": "Malware payload (Heodo)", "value": "c8be5c7b8d452f2a1950e476d25069a9", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646095210, "uuid": "9f430845-71b1-4bed-924f-e55bb7266113", "comment": "Malware payload (Heodo)", "value": "74053a6ccb0fb87d0f54efc309c6ba35de2acd416ef7ba48dbe148e753262831", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646095210, "uuid": "b314ad71-595c-4b6e-a6bc-f87210fcee57", "comment": "Malware payload (Heodo)", "value": "7818ad2f6441cc1e1032652e765f6c9c20639a02", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646095210, "uuid": "17605a52-46f4-422c-a4b4-bba350b196b6", "comment": "Malware payload (Heodo)", "value": "bb5dfc0d8f53dbd2fb822871a6fe98290e7059b60db6b02e144fb91ae004d1f68c53a520bb0a23d1d212da53ad94a139", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646095210, "uuid": "023122f5-0dc8-47a1-8f0a-5f0478d920b5", "value": "T1BB13D12DC0A25E9DD727193DD5149BF4120C1E4A9AA4FA8B1D54B3EC2B6A1F7070FCB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646095210, "uuid": "4b8fea65-1be4-41d1-8bfd-68ef49e7be5f", "value": "768:WbomCS/DOevZCwt7OyKfcrND59V+L9Rw4eWrXcTqZ0VfddDhw:eomd/DmylND59V4jwmXc2CVfdxi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646095210, "uuid": "bf3b6219-9c8a-41d6-8d3e-0421527dbe21", "value": 41797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646095210, "uuid": "73dc303c-c107-45b0-89ee-568b76d2dcff", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646095210, "uuid": "10cd508a-6c1a-4e7d-aef5-036fdb9d60bb", "value": "list-09.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d291e935-99ab-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646172379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646172379, "uuid": "b07efa0f-688c-4047-9ea9-a3b7795a033c", "comment": "Malware payload", "value": "af53fa3d44364969dfffe4b5cc4448cf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646172379, "uuid": "757ee5fe-f76b-4abb-84f5-e2596d884406", "comment": "Malware payload", "value": "743580529d9425b8b1696789506f68879931103d9e6db560475c92f64987d3bc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646172379, "uuid": "6defca57-c353-40e9-b238-2b4fc634643b", "comment": "Malware payload", "value": "fce1281626fa81bb989bb93e0ff024b8b6d89ca7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646172379, "uuid": "bedb0444-92a9-4c21-a789-4360a7b8ac00", "comment": "Malware payload", "value": "5bb8eeda49e6f3decf6e957f0f3084801bf75a74550ec9e997bab17b12c8db0ae55b56bcbfcb410a52c52adb0b4159fb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646172379, "uuid": "3d31d78d-daae-48da-8325-52d86ad7eae8", "value": "T118B4AE11B7D0C072C26A35342926E7B656EEBC719AF583876FD03B7E5E301D18A2835B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646172379, "uuid": "e1a92662-0009-43e5-b70f-881164065496", "value": "d02245ac5c961d83d0907c826d8ba5c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646172379, "uuid": "43f7a1dd-d326-442d-b313-5494e0b4d9b9", "value": "12288:JhC1q3aXOwkiPs2iCtyjmOAIlgOkar//wJY8Itgm:Jgq3aFkiPs25am2Bkm8jm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646172379, "uuid": "7c46ef0f-5106-4593-a1eb-d0cc25fb481e", "value": 499712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646172379, "uuid": "4ec817f6-286f-43e7-9d3f-f849f2e5aa7d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646172379, "uuid": "72bc2d32-c8d4-4eaf-b36e-473555afa2d8", "value": "af53fa3d44364969dfffe4b5cc4448cf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac03dd9a-9962-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646140961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646140961, "uuid": "d9f93b7d-a75c-4f35-986a-cc23e82f98f2", "comment": "Malware payload (Heodo)", "value": "a04e920019d3cfcc4616288d6f8a520e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646140961, "uuid": "aa870204-ec98-4f80-8a3a-30c2183a0037", "comment": "Malware payload (Heodo)", "value": "74b862d22ba021cfefa801f65e383db7131a554587e49571afa248f38ee6c2cb", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646140961, "uuid": "b4f10136-e885-484c-9d8d-72ffc1034fbf", "comment": "Malware payload (Heodo)", "value": "f8f3bf08af8f2fe65dad7620801e749a9b48287c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646140961, "uuid": "51621193-c8d5-42c1-b955-2cbcf3d45115", "comment": "Malware payload (Heodo)", "value": "0f4d953053012aa1d3c884034eb9fd5575028eba9df2a8d9e625b1dd73807bc5d406e955c2bcc959ccbc06d78398805d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646140961, "uuid": "d79fc1a4-aba4-4d85-ad38-26670e916f2d", "value": "T195D47C82F7429EF2C00B03347C32B2586BADEAD5D2158D6B9398A5AE1F35573493DE43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646140961, "uuid": "bb7e3109-c5f5-42f2-b33a-1ca41c2adfa7", "value": "e0b213ccd96f46d30dcd8e225f4e9fc9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646140961, "uuid": "bd4b0c5a-1544-46e4-a992-ce0a06e29791", "value": "6144:XjPgWGbb0OEmS9Vzf5WI9nI1LSfcaFMyhKmZHNRuIfv7YtaIIo0cm59CH7PQ:X0bEtf5WyI1LSfcUfxhstaICRLmrQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646140961, "uuid": "b3f818f1-034e-467c-93be-cc1e2c676c21", "value": 602112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646140961, "uuid": "4ff3cf99-400c-4072-a33f-decd8a0094ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646140961, "uuid": "0bd855fc-0e49-4702-8683-a2ea3fc1d8d3", "value": "dan.ocx.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "010ae5a9-993a-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646123494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646123494, "uuid": "ec6df5e3-983d-4258-81ec-594e9019bd1d", "comment": "Malware payload (Heodo)", "value": "cc49f9fc073c1c4ddda5525f7279603c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646123494, "uuid": "6a628d22-d3d8-463a-8bff-73419c08a370", "comment": "Malware payload (Heodo)", "value": "74d9b9305b21229d59662acb5c20e4227dadf31357b562032bbd7255bec0584e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646123494, "uuid": "367ef9ba-72b2-4c9b-9090-a6f4c603b585", "comment": "Malware payload (Heodo)", "value": "c6b2bd6ef763058d095091f939757dc9f4a4e5b9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646123494, "uuid": "cd686321-acf7-4a0f-a181-514ab13a1f31", "comment": "Malware payload (Heodo)", "value": "715ca5fa7a87ff8bc0189b73138b8bb83264799fe9cb976af7c6cd6f6abebb8e5d215c63c8b2ab750e5d002c6f28318c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646123494, "uuid": "85990a07-56ae-4e93-b0b2-3fa0f6e753b2", "value": "T1E0C4AF12BFD39072CE2F293C503DA77413A95C65971A8863979C9BBE1D3F9428B3190E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646123494, "uuid": "84968b05-6814-4c2f-b347-315dc3583920", "value": "e0b213ccd96f46d30dcd8e225f4e9fc9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646123494, "uuid": "40acacc5-6a59-4a15-aba2-d62490ecaeb2", "value": "12288:onEtDywy8SYlHD70WychG0QOCM8T9xvC2yDyPgyQz/VDNeg:onEtDywy8SYdnhG0QrM8hxK27a1Ne", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646123494, "uuid": "90eed7ef-d743-4a2a-b318-b6c3849e3de5", "value": 585728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646123494, "uuid": "aca966e6-db3c-42cb-8dbb-af0feee5e33c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646123494, "uuid": "cebad2b7-465e-4991-8eb9-fc553771dbf1", "value": "cc49f9fc073c1c4ddda5525f7279603c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a4dc825-998d-11ec-9275-42010a9c0029", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1646159265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646159265, "uuid": "0a38f67b-1471-432e-a351-d2e95c9e738e", "comment": "Malware payload (AveMariaRAT)", "value": "3346c56f56dd3704fae1702388f0dcab", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646159265, "uuid": "b693ab35-53ad-4b34-97a0-775d881c94cf", "comment": "Malware payload (AveMariaRAT)", "value": "75a25fe05bbcefe44a5965015d178374e74b2d2be3ec2fba5d15cf37dc93df20", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646159265, "uuid": "0acf7f11-6dfe-454e-a90f-e371b94d8d71", "comment": "Malware payload (AveMariaRAT)", "value": "acf58fee939957b9dbb8df32b2024377328c7b4d", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646159265, "uuid": "dd34ab09-fc45-4231-a7f2-bb3135404215", "comment": "Malware payload (AveMariaRAT)", "value": "ba14e8a453f22c87e27c1ad3a0a5197b7d5c84011d0814bedb3e561634312c1d8ce3ab415ca27a2190806901f1404334", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646159265, "uuid": "4a69a161-4228-4cf2-b242-d2ec9fbdd366", "value": "T19484E02E97DB86A3CA7527FB04B677241F92E4762937D35B188624484863BF93F007C2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646159265, "uuid": "c7ef0d2f-580f-4a70-8633-2bc1956c37ca", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646159265, "uuid": "c45d6d67-fba7-40da-a574-64977f3a7518", "value": "6144:KjcR8S7ToRXRORJaod/Ais3WBUdhobu9m/Ttt67tXDOmFpzK0eHlUQ:KjcRsOvabismYgu9m/BU7tbZJQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646159265, "uuid": "d109b1c6-e46b-45aa-b896-f33ca1229734", "value": 388280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646159265, "uuid": "0cfdc489-96a9-42aa-bf1b-e2ca2fa2ba22", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646159265, "uuid": "f0905a48-cbb6-42ef-8f0b-9dbe50203f09", "value": "PO_IN00043INBOM_Specifications Sheet^^^^^dwg.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6107f41-9931-11ec-9275-42010a9c0029", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1646120013, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120013, "uuid": "3925836f-3097-46f0-b8a5-dd304eec7d05", "comment": "Malware payload (ArkeiStealer)", "value": "f1eca9ba48442e89c5d6ad7d176fc1a4", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120013, "uuid": "5ab5a9fb-892a-4a8c-b8c7-857d41c03868", "comment": "Malware payload (ArkeiStealer)", "value": "7639d5ebd3bb3b9a9fd111201b1b5cbff24d01de6cf2347e3eaf52c4ed53f0b6", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120013, "uuid": "0891de79-2625-42e3-a771-c31040a8b5ea", "comment": "Malware payload (ArkeiStealer)", "value": "bdee2e467b0a3dd8483b9bffefaed27538b9387f", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120013, "uuid": "1bcd1a07-3be7-4bcd-bb62-a08f35f13b66", "comment": "Malware payload (ArkeiStealer)", "value": "a3adb1f765a17715bd7e4b9a0dd344aaaaff0578fbcc2b1c7c1c251ab82255a145bd71b7c5f1dbd9beafc7bd4238ca97", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120013, "uuid": "56b888c1-112c-4e4e-af81-43a4dd6f5a43", "value": "T19DD41225B091D076C89B55745C78C7BA6A7EF8211830495B73AC3BBF5FB02E12B79309", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120013, "uuid": "b4e7cd92-3499-4ed0-944a-a2d795bb9e3c", "value": "6719cea6e789ad7f2a4d4234a3635d2f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120013, "uuid": "1cab9fd1-5b4f-4ba6-99da-2aa992854cf6", "value": "12288:kpaUmNVoClDoKiDUWg4mJe43dKTfvv5+/OV0kYJne0y5OHSQZkWHFe9FZ:QmXoCCKiDUWoe4tcX8/O6rg03HLkWHFc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646120013, "uuid": "01caf0ba-72b2-439e-8716-d50f02d4bfda", "value": 608256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646120013, "uuid": "e1375c3a-aab5-4f97-826f-092be7284463", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120013, "uuid": "54c099ed-38f6-4483-a2f1-0834d7095ebf", "value": "f1eca9ba48442e89c5d6ad7d176fc1a4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4d03ffd-9986-11ec-9275-42010a9c0029", "comment": "Malware payload (Dridex)", "timestamp": 1646156411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646156411, "uuid": "206886cf-abef-41ad-add3-9867874352fe", "comment": "Malware payload (Dridex)", "value": "87ee46ad05bc4d64ba678864ad66c8d8", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646156411, "uuid": "b95b75b9-105f-4242-8e41-39806511d7f4", "comment": "Malware payload (Dridex)", "value": "763b5323953c0899bffe4ca733732874a2b2aa64b1a4aff4714b10bbc5f28f22", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646156411, "uuid": "59478114-77ee-4f68-8af5-205b161d653d", "comment": "Malware payload (Dridex)", "value": "a45435a2a0a53458ce0f32d470c4677c1afbc88d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646156411, "uuid": "ae304ca9-7e38-471a-a10b-35aeb8f04ce1", "comment": "Malware payload (Dridex)", "value": "64718be8506afcb51241981c4c6db08fd80a82afa01c46756fce8d534607303eddc3c61c1399dfa3c89cf2ecf48d79fb", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646156411, "uuid": "a1c61bac-01a2-4561-99ad-010e86e12472", "value": "T115324505EB4951A6D7D041B944EBCB4EDADE0249036C3ED3E31668FB28119D3BD7EA0D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646156411, "uuid": "2abd7554-e075-4e93-a6b6-ec871ba1fb8e", "value": "192:hlgbouC58IUIFmlwxUUJzFmS8IxBr/pN5J9uTjpDpy3QyMVQlT/HXQhAq:h+9G8xIFmlgxmS8qBr/P5J9uTjBMFXhm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646156411, "uuid": "81cd7a38-bb9c-4cef-967c-945664eba510", "value": 11616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646156411, "uuid": "5f7e472f-ee2c-4056-ada5-2b8e052bf0dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646156411, "uuid": "67a02ee5-ab47-401d-9827-94e07aec63bb", "value": "87ee46ad05bc4d64ba678864ad66c8d8.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbe890d1-9977-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646150034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646150034, "uuid": "ab185802-5ccc-4696-9f7b-632827e80083", "comment": "Malware payload (Heodo)", "value": "aa450cbf61ef33a6e40247a23bef066d", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646150034, "uuid": "4a770004-0302-4c22-9b97-e928565ee1f8", "comment": "Malware payload (Heodo)", "value": "771bde3d8cdb1e71c7412ffd70319caceb1d41efb7075f258e69b7e0fb4b85ea", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646150034, "uuid": "4dfc8d9f-3034-4f0b-a186-e16c31e0cdda", "comment": "Malware payload (Heodo)", "value": "5e89d9a38d2ca5e2937f919dd1f10f219adf9f3b", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646150034, "uuid": "47444766-12f7-4e2a-9393-2910a0c8758d", "comment": "Malware payload (Heodo)", "value": "5c927b5113515255369c6404cef1529e3c50d3e1afcc6655d64b77dd36d89ddfeefad399f5460b5fd8f74e566a57b7d2", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646150034, "uuid": "be50984e-2753-46df-9125-1511d93d7703", "value": "T15213E02AC0961959D727283DD6148EF4124C0E4A89E5F99B1D50B3AC2B6E1FB0B4FCB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646150034, "uuid": "3b4c5c23-ce92-49f8-beb3-0d5fcc9ac129", "value": "768:y9oms9O+pOevZCwtxyKfcrND59V+L9Rw4eWrXcTqw0VfWZE:y9oms7tylND59V4jwmXc2RVfW+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646150034, "uuid": "b9674487-ca28-4d44-8485-44b2c4463e15", "value": 41841, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646150034, "uuid": "b9b71909-422b-48f7-a96a-77bbc476a36b", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646150034, "uuid": "f0912515-7c21-48fa-9458-1022080e27eb", "value": "PO 03012022.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f81209f-9987-11ec-9275-42010a9c0029", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1646156643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646156643, "uuid": "b08b59b0-d065-4ba3-a670-c7c3b317dd3e", "comment": "Malware payload (ArkeiStealer)", "value": "4324e2270db29c4e06f7c53586e6c98d", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646156643, "uuid": "48005c3a-57a0-42f1-b77e-f569b8280ba6", "comment": "Malware payload (ArkeiStealer)", "value": "7754bc519aa3f2c1b0e70de80c22f8599563ecf383a321363358b216a8d31e0d", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646156643, "uuid": "46f66ad0-2014-4db4-84b4-d3430b5def68", "comment": "Malware payload (ArkeiStealer)", "value": "a1293a44ca31ecd1a24b0e97ce7929f0cf73f653", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646156643, "uuid": "039c6838-5200-4065-94a6-f2b63ac778e3", "comment": "Malware payload (ArkeiStealer)", "value": "cd9b19b917ccd5882422bd2907b329e5e64274c57c967ebe068da6e0a286285878448714d813062ea3f22ccf97c24508", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646156643, "uuid": "535c0a83-c7af-4f7a-b472-49f70421d77e", "value": "T119749D40BBA0C03EE0B755F8797A93AD653E7DB15B2451CB32C52AEA16342E0ECB5317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646156643, "uuid": "a9ce1d8d-c2a1-4d1e-b908-f2e9bef39411", "value": "26b4d512596063f87f095ddd2779dc70", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646156643, "uuid": "28b2c7cb-bcd2-4aed-a3ea-7788ea5e6457", "value": "6144:iqh2aS9bvCU/TPzoQmqwnbHiF4AF+Sd6SZdOmH:bP2vCU/TEHqwbCycv8s0m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646156643, "uuid": "6b61aabc-6f22-4243-9a5d-50590aba7e0f", "value": 370176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646156643, "uuid": "8976d605-c166-492e-8576-2ca51da95eed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646156643, "uuid": "8e286fe5-e464-4e60-8fcf-3fa2c021420c", "value": "4324e2270db29c4e06f7c53586e6c98d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b975a91-9937-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646122465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646122465, "uuid": "e8c64ed5-b14d-4cad-9691-596207fbe3f5", "comment": "Malware payload (AgentTesla)", "value": "5cc7c6a29862596569092ab0a06615d8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646122465, "uuid": "15a32c82-c6bd-4652-a096-a7b1b9c97351", "comment": "Malware payload (AgentTesla)", "value": "77fc5bf1260d7324bcddc2d58a88f9c23bb9a62ac995eeb0c595b20f7af69844", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646122465, "uuid": "fbf4ec48-acfc-46b9-b0e0-1701c40a4968", "comment": "Malware payload (AgentTesla)", "value": "013c7bb5ad1f2fd25aa446afc41d3a5c103c6206", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646122465, "uuid": "3fa79803-ac69-44b5-b0bb-282c82dfdc42", "comment": "Malware payload (AgentTesla)", "value": "d9cbebee5e8cdb8efaadae0d5d5f6500f337d1fb6409e4c8a66d67b6924e7882ef77b713d32db21f788ced6fe86057fc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646122465, "uuid": "e4351c2a-aef2-4c37-87b2-d2980e9af94b", "value": "T109F423AE3FFE4657C49D3ABC014AA60003F8F5D2D588F6C1DDE261874A973E099469CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646122465, "uuid": "e78f0164-60b7-4996-8dcf-f5f4a1fc1e8f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646122465, "uuid": "b972f2d4-b3b7-4834-ab2b-bf6ed9afc588", "value": "12288:xEF6niogYmfWt91KrvgABrs4hHWpGjz/Vmii3SQ2vroCv5idi34qOLp:SF6io3rxKTgdU2pG3VMHKoI3ap", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646122465, "uuid": "8aefdf9e-37f1-4d0d-ac19-adaddc5b8112", "value": 751104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646122465, "uuid": "5ddc67a7-b398-4dad-87e2-750ce14c9425", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646122465, "uuid": "5439cc0d-309e-4c3c-aaa9-07ad470b4a70", "value": "DHL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be48dc2e-9957-11ec-9275-42010a9c0029", "comment": "Malware payload (LockBit)", "timestamp": 1646136267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646136267, "uuid": "4f4bc278-b27b-4759-9f44-3ee2ec0ca7dd", "comment": "Malware payload (LockBit)", "value": "9853c2380ec417b486857501dae0b3bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646136267, "uuid": "3706e746-7d68-422b-94b5-499958e95b6a", "comment": "Malware payload (LockBit)", "value": "7878f6f17b90a1695d73de830dfdd8bdc62f365dab88bd42b13226668f913254", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646136267, "uuid": "eb8b89ed-31e6-4931-abf8-658c71552a10", "comment": "Malware payload (LockBit)", "value": "c4c6de40ac9a8fc0c842de86e440687a78c1cb10", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646136267, "uuid": "b3520f69-c958-4d3d-8718-8b27c22718a0", "comment": "Malware payload (LockBit)", "value": "8338b86ebd755e0eab5365fea584bbce78ed43245984405f8bc4c5511095b537400716c8149add30ff7f183cfd3f6812", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646136267, "uuid": "6520a14a-4f4b-4cdb-9073-44aafaec9107", "value": "T1A2253A0593018F96C813207951FE8DB3A877073192BF1CE6A78466DC83B2FA5776B366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646136267, "uuid": "b6a71a13-6fae-49cb-9073-fc9d5e23dd27", "value": "216df81b1ef7bc2aa8ec52bbeef137c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646136267, "uuid": "037d2ca2-a137-46e5-ae6d-2f42bdd2e1b3", "value": "24576:uLjr3s2nScu1i1tz3f++5kRzFxk7rMxNeR1R9qpdZF:Ujrc2So1Ff+B3k796L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646136267, "uuid": "2fc29e99-ff14-41bf-add3-a55f05138204", "value": 982528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646136267, "uuid": "8662ed77-2e6d-44e7-9be6-fe15adb88ccb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646136267, "uuid": "cf281036-6a9c-4fea-aec6-584de891a790", "value": "7878f6f17b90a1695d73de830dfdd8bdc62f365dab88bd42b13226668f913254", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6d83e00-9942-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646127262, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646127262, "uuid": "6220c9d4-d71b-49f8-9b6b-db153df72e57", "comment": "Malware payload (AgentTesla)", "value": "d43a8f3ab91d5ed567332e6143a47700", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646127262, "uuid": "89b6ba62-30a7-41ed-a50c-f3caff56938e", "comment": "Malware payload (AgentTesla)", "value": "795245ba3ef0d5a7778d829ab577b6417eab4c88b9d81f044a2d4d59a3d0eaf3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646127262, "uuid": "ac9c1e39-43a8-4e9d-a846-d3978b9279e7", "comment": "Malware payload (AgentTesla)", "value": "75c3c775c4bf31a151d55ed8bc54e422df4310e4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646127262, "uuid": "f1d1c7a4-a168-4c1b-af83-40da20075abc", "comment": "Malware payload (AgentTesla)", "value": "5bf22e40d91177ec7ba04018c41c852bb9db25c35dacbf76ef821713375dca20cbd30fd7f52f92c0544ce4aa82bd9f9b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646127262, "uuid": "26e55c8c-bbe8-4554-ba79-8c66dfb6f3cd", "value": "T16535AE4835D5307DE837CB71CA94EFE09B29B125D60A90B650030E599A0DBBECE15EFE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646127262, "uuid": "ed3c735b-86be-499d-a493-dd02d20fb246", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646127262, "uuid": "7b809b89-5ae0-490a-b7b8-d291519e1a2a", "value": "12288:Y72vjcIa5a9d/JXFJpmeJ4h0rfwtgCP+opmb2TnWbLMNaCM2irbdI0G2CxcIzGaW:G2YIakFJPo0rfUNPOyWbA4C3YSchc21", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646127262, "uuid": "2df659b7-8474-4ea3-b73a-826004735426", "value": 1092096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646127262, "uuid": "ab2de02b-f62d-4231-92f7-7f1223bc6310", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646127262, "uuid": "1cbae3a3-1f44-4f84-9e49-0c951ba41b1b", "value": "d43a8f3ab91d5ed567332e6143a47700", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eebe10bb-992c-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646117880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646117880, "uuid": "9cbc5941-6e82-4801-b712-15c10d3638a4", "comment": "Malware payload (Heodo)", "value": "3c4cd85fde94f46eeaaefc5dd9ccfe62", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646117880, "uuid": "2d513de3-9b94-4c32-9e91-2f96fd6ef2f5", "comment": "Malware payload (Heodo)", "value": "7a6fbd6214816d023f7bb01224a7b7ef017b58ab811b0fc2fc0b4352ec0ab2a1", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646117880, "uuid": "79548cc4-1b25-4ea1-a201-8a21525d579a", "comment": "Malware payload (Heodo)", "value": "e1b44f11ac584ee93b6f1b8605ba54eb35637b48", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646117880, "uuid": "27411048-0ba4-4c15-bdb6-7f4a474d9572", "comment": "Malware payload (Heodo)", "value": "801fe875336d4f2cdef13b578de2e75c562bf6e407f976e5e7b39a567725ac063f1bd9b6910aea975b6dda171aee8bf3", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646117880, "uuid": "64298cbe-864a-4649-a786-1c554dc47242", "value": "T18413D019C4665ADDC327693DD6149AF4120C0E0A89A1FA9F1C54B39C2B6A1F70B5FCF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646117880, "uuid": "e58e42c3-ee74-45e0-8f3c-a9e2a524e415", "value": "768:O/omdH+DOevZCwttqyKfcrND59V+L9Rw4eWrXcTqZ0VP2HLp:SomdH+DoylND59V4jwmXc2CVCF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646117880, "uuid": "631458c2-2618-4d43-bae7-308aa39eeb37", "value": 41827, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646117880, "uuid": "5f873f57-1099-4e56-8aed-50cc1f8a1e05", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646117880, "uuid": "048a99a0-678c-4f85-bb1b-87fbab752b79", "value": "New payment details and address update.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59e5caee-9958-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646136528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646136528, "uuid": "ecb12a1b-7d8b-4359-97ee-a98f0b6ade56", "comment": "Malware payload", "value": "bd5b0514f3b40f139d8079138d01b5f6", "object_relation": "md5", "Tag": [ { "name": "Daxin", "colour": "#652B35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646136528, "uuid": "939c2a84-c40d-4475-958c-8e6b0b656223", "comment": "Malware payload", "value": "7a7e8df7173387aec593e4fe2b45520ea3156c5f810d2bb1b2784efd1c922376", "object_relation": "sha256", "Tag": [ { "name": "Daxin", "colour": "#652B35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646136528, "uuid": "5054592a-29d5-450d-a6ee-f080db818a3d", "comment": "Malware payload", "value": "73bac306292b4e9107147db94d0d836fdb071e33", "object_relation": "sha1", "Tag": [ { "name": "Daxin", "colour": "#652B35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646136528, "uuid": "f622bca9-a62f-4f11-9a0b-ad2bfada6955", "comment": "Malware payload", "value": "ede944e175358ebfab8b5a0db1b1a253871017663bf01069abfbe6eadaa6c93656db0992b4bdb1becc513cced5ee049e", "object_relation": "sha3-384", "Tag": [ { "name": "Daxin", "colour": "#652B35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646136528, "uuid": "e5925e41-3a8c-403b-a586-6b02acf3f875", "value": "T127231B00E2409339E5FF00F3CAF66A5D266E8B25030514CBEF985CA57BAD6D67E3049B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646136528, "uuid": "fb3c28d8-e310-4108-a91a-e6b495c65f15", "value": "6c8d5c79a850eecc2fb0291cebda618d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646136528, "uuid": "549b7d13-5898-4f0d-8627-2e2254f6ef6a", "value": "768:RLJNjwM2VhYcdoxcKpTQjsP0J270ocs5/Nb4Ml5D5:tT2VhXoNhMJc15/NUM3D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646136528, "uuid": "3c9c612a-f958-4a6a-a306-a250b2618d54", "value": 47104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646136528, "uuid": "25c79fea-326c-44db-ae12-8d97b1e19270", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646136528, "uuid": "3ba931a5-01a7-40b0-9e5e-e1b43f691c94", "value": "7a7e8df7173387aec593e4fe2b45520ea3156c5f810d2bb1b2784efd1c922376", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4a5fee3-994a-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646130721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646130721, "uuid": "93437706-0363-4360-bc92-5e7b640c2876", "comment": "Malware payload (Heodo)", "value": "a04931effa9d2b87cb322a09fa9c1682", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646130721, "uuid": "868cf2aa-6f8a-498b-9c67-a846cbad331e", "comment": "Malware payload (Heodo)", "value": "7b181e95abe2e0d7f2dd7e04ab4eaa9dd31d49b143c13f41e8c4d74ef2a39ddc", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646130721, "uuid": "bebe0e75-338f-4b6f-88e7-eaaf9a737cd1", "comment": "Malware payload (Heodo)", "value": "fe65d6bd063c31bda4190edb39ffbac5ccea2ced", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646130721, "uuid": "63c18c95-1233-420e-8519-c299bb1ac2fb", "comment": "Malware payload (Heodo)", "value": "3902061cf818fd0d89151796c111e30a0b59ef94179f3740eb4e774b56fc1818625aa124e57fcc18051b4a5d10b5576d", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646130721, "uuid": "cf8f6ca2-c202-4000-9b22-d2ec7a0f28a2", "value": "T10413D019C4665ADDC327693DD6149AF4120C0E0A89A1FA9F1C54B39C2B6A1F70B5FCF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646130721, "uuid": "b7611169-b9b2-4819-ba1f-d29b5c15e77b", "value": "768:q/omdH+DOevZCwttqyKfcrND59V+L9Rw4eWrXcTqZ0VP2HLp:GomdH+DoylND59V4jwmXc2CVCF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646130721, "uuid": "f6594bdc-1cc5-4d59-9534-dc8b68656170", "value": 41827, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646130721, "uuid": "b09a3444-f1d6-4218-80ad-d1cdcb7bf632", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646130721, "uuid": "6eec147b-c5de-4fbe-ab2c-6a0a126a52a5", "value": "2022-03-01_1429.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdc736af-9931-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1646119972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646119972, "uuid": "d9647dbc-b73a-4c45-9adf-d6a676f6afc0", "comment": "Malware payload (RedLineStealer)", "value": "18f12407d163ea4f84a0f772469f7ce0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646119972, "uuid": "3fc6d794-750c-4b67-8d3d-f26b04944006", "comment": "Malware payload (RedLineStealer)", "value": "7b35752706d16854b9d9e0efcce4fd9c6f1fdb88613531a6763e2d4a1df297e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646119972, "uuid": "387b1add-9e66-4301-8955-826e895ebb10", "comment": "Malware payload (RedLineStealer)", "value": "46d9dab61ab86bc76f11d9a4e5f512eea9a0e961", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646119972, "uuid": "3dfe4f60-8690-470e-833e-9c5ca4397a46", "comment": "Malware payload (RedLineStealer)", "value": "a836c87350c5b1747c20a7a4ba14524815cd099be3c5c6ca02eafd36e0175b03f9efcad7e3b4dc7e671c2a7a3dfedb16", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646119972, "uuid": "82e49c28-d6a3-477d-b997-478c201e87ec", "value": "T132C423DF51943B1DC38E9EF46A79FF26AA51923C7DC2E9562D10CD132049E82A67C0EC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646119972, "uuid": "f5778fef-1c57-4ae4-a3bb-bedce9a22bfe", "value": "445554923421947cbff896012e27345a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646119972, "uuid": "7b9f3c4e-2621-45ae-9c62-f298050bbf74", "value": "12288:H2O9Phc9ZuxSyrETiWt5H13BxQS03ULaHNqrxlKIQNorEqolY3NVzrEeR:W2Ph2ZQScyiu1LkEaHNYK3M7oy3NVzLR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646119972, "uuid": "b0832b58-60d7-43a5-b4a2-4fd72bddb01c", "value": 578048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646119972, "uuid": "105d4f5d-bf67-4468-be9e-8e54c624b431", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646119972, "uuid": "1b33b6ea-fce4-4490-8575-7b845f184871", "value": "18f12407d163ea4f84a0f772469f7ce0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c588fa3b-9977-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646150023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646150023, "uuid": "dd8c2e04-1af1-4059-8f1c-f3afeaf61249", "comment": "Malware payload (Heodo)", "value": "79182778b83eedc8278eca0bc594eb54", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646150023, "uuid": "33a9b9ef-fe1b-4f15-abe6-333fe6be278e", "comment": "Malware payload (Heodo)", "value": "7b3e49168b09c37f6865c8bb2b655b8a6091d886a685e04cf94a198e33dc4aed", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646150023, "uuid": "bf56fd3e-a236-439a-bcfe-40fda19ddf0d", "comment": "Malware payload (Heodo)", "value": "dd8974e1d7b4270b644535c82ca7e6e8f531181f", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646150023, "uuid": "21f3b3dd-4985-4869-877e-034da6a44438", "comment": "Malware payload (Heodo)", "value": "417fd30a20c420f487372d2075d38da8dd3773490ff5a7ba959b71ffa4be95db379db5d92887212aad84b7cf37f13891", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646150023, "uuid": "a9bd7f12-0d1c-4c1d-a7c8-b04b1cf7c407", "value": "T1EF13E12DC0A65999D727243CE6149BF4130C1D4E96A0FA9B1D54B3AC3B6A1F70B4FCB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646150023, "uuid": "4d8811ab-1541-45d4-9e72-5dbc4717f1de", "value": "768:ZqoOomihd8DOevZCwtofyKfcrND59V+L9Rw4eWrXcTqZ0VfIeg:3Oom8eDGylND59V4jwmXc2CVfIb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646150023, "uuid": "052f73d4-536c-438f-a85e-6429d2e7e997", "value": 41817, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646150023, "uuid": "9360b5fd-160a-4ffe-aa6d-fe0418ff2c2a", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646150023, "uuid": "7e7025ca-d1b7-450f-9da7-268b87a98ca8", "value": "Mail_30799.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e5363f5-9987-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646156695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646156695, "uuid": "87178d7c-bb2b-4894-b96a-6222f7fd328d", "comment": "Malware payload (AgentTesla)", "value": "974c8113dfdb0526ee4652aff3d83a18", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646156695, "uuid": "1792ea46-d175-428f-8c90-ad5aaf8ef4c4", "comment": "Malware payload (AgentTesla)", "value": "7b6925665b5abe73b532dac6bb6bc94fd0dbab662c77494d2d9cd9fbe6289b41", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646156695, "uuid": "219190ea-da3a-45e6-aaa3-a91331780834", "comment": "Malware payload (AgentTesla)", "value": "9bb9963de1ffa58e5be22993a470a8c00490ffd8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646156695, "uuid": "e02e1313-41da-4e49-8638-072239543141", "comment": "Malware payload (AgentTesla)", "value": "368d200a421acb5ee16b7f74863c64a8c55459cbeedf4d6a7885e943c84b294a5f732a79a8d00959eaf4597d4d9b799c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646156695, "uuid": "467aa606-b2d1-4fbc-bb84-5e7dbbb0914e", "value": "T19225BF4835D6207DE8368BB1CAC4EFF0DB6DF222D54960B654020E698A0DBBD8D45EFD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646156695, "uuid": "e00b2d07-2394-48bf-b845-121f0648f55b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646156695, "uuid": "5e5d1b0b-5382-4eca-8d02-9fa571071da1", "value": "24576:PjB6Qenna9RZ/ujUbohj68KIEmQpocGq:PjF9R0Ii/r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646156695, "uuid": "4e2c8bdb-0de0-4035-8588-b879483bb0b5", "value": 963072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646156695, "uuid": "09ea088e-20e1-49c0-b58c-eae81a8d12c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646156695, "uuid": "070e1b27-a4b9-4334-86c6-3dd78cc5e528", "value": "974c8113dfdb0526ee4652aff3d83a18.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f4af16f-9933-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1646120753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120753, "uuid": "15a40844-0de2-40fa-a36d-2a563055656d", "comment": "Malware payload (Loki)", "value": "bb6aa800c5b012aa0ff089b11cd834f4", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120753, "uuid": "b7f0e495-c1e7-4934-8123-36ab6f8f5c14", "comment": "Malware payload (Loki)", "value": "7ba5cc84fef00896ee861061e3eeea6128e42deeff3a757ac39f4da852b75598", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120753, "uuid": "cbd007e3-a6f2-455a-ab0d-8a388fc93645", "comment": "Malware payload (Loki)", "value": "a78807150ccad094c4e2b5dd670c851265ec6fca", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120753, "uuid": "8aebe05a-dd4e-4e54-8c6e-842eb6f03c52", "comment": "Malware payload (Loki)", "value": "0b58decfd8e30a5bca542709126d4d4cffb000ec4033e67ce97c44c866ef5dde0f84cbb732bfac450b18b623ae36fd50", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120753, "uuid": "881dd870-8f22-4177-9e2a-ca0a7e0975b2", "value": "T11E14022974B6CBABE1D32A76E14940A92F2ADCD914728C07104F774C5B7209AE373DB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120753, "uuid": "1052d013-4799-4058-b316-27f8d494e197", "value": "3072:TOrfYUZAhjnLKhDlJTcAnTWyFgLz4Nl9jO3zwAff8Znu5Q/YgrIi4I:6cUZqLoDlJYYwz4qcAn8Zi2ph1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646120753, "uuid": "079c80ae-f686-4beb-9274-112b30538f6e", "value": 191064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646120753, "uuid": "083ccd39-e3ff-47e7-8642-39306271aabb", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120753, "uuid": "a0f1785f-f5d3-4401-b712-9b3c6e06922b", "value": "Bank Application TT Form.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7256b49-993e-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1646125571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646125571, "uuid": "57401e03-b4a5-4246-b232-d5e879945450", "comment": "Malware payload (RedLineStealer)", "value": "afb0cf754df821bd78eeedc6770f19d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646125571, "uuid": "d3ac571f-4184-4c66-aacb-42b58b2f416b", "comment": "Malware payload (RedLineStealer)", "value": "7bd0fb482a6bce2de2ce3ce0297724b4ab110f082e94b0f64e32d03b308020e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646125571, "uuid": "ef4f85e4-4503-4f88-8822-c3b3123e9dd7", "comment": "Malware payload (RedLineStealer)", "value": "5b6a73736c9f35c7140b87b8e4b5c5c8e0490c4c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646125571, "uuid": "c8ff224c-f96b-463e-ab6e-037f211a8db1", "comment": "Malware payload (RedLineStealer)", "value": "bb256e272d48cd05c826814f8e7ab18b2f3ba5573219a60939aa4cfa2c3390aabb5587147fc2a03f4b63b3077e4974a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646125571, "uuid": "f5c0c3ba-83ba-4ab6-b85f-0a5c3e411846", "value": "T16E1633FAD596CE65C2CFD930BCCE886D3D5AA1AD59BD6C31D437F79080399206E060B1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646125571, "uuid": "398e33cd-23be-4e68-835d-f0c9c32c0159", "value": "445554923421947cbff896012e27345a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646125571, "uuid": "e42f1974-c30c-4660-b3ea-67f4d9dca4c6", "value": "98304:UPwjG0JmRRfFz90DlRfMQ8samJqcEK3Aud83TnXlPQf:UPgmvfFI90nmYYAS83TXlPM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646125571, "uuid": "be83fe46-8e11-4dc7-884c-ca31b9c5a179", "value": 4111816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646125571, "uuid": "171b9a9f-1571-4e68-a988-f717a2dadd7a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646125571, "uuid": "ad897457-33e8-404c-8048-991bea261178", "value": "afb0cf754df821bd78eeedc6770f19d9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adbd1e20-9979-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646150842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646150842, "uuid": "052a067e-52f4-4ac6-ba82-6254e66e08ef", "comment": "Malware payload (Heodo)", "value": "4df1dde935014883c7d37effc76ea0e1", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646150842, "uuid": "30643a6c-28bb-439d-a588-cb1c4d38dfe5", "comment": "Malware payload (Heodo)", "value": "7c1a87140b823b2e43a09ef77507e8d85af57bc0828e7c36cbf1048b491b023a", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646150842, "uuid": "0bdd3a95-3a32-4ce2-9787-9c4b6d8dbbda", "comment": "Malware payload (Heodo)", "value": "276659ec5be4732958486ff95eee327d38532a34", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646150842, "uuid": "766b9f91-cbd0-455b-ac5f-f7b4c9a20081", "comment": "Malware payload (Heodo)", "value": "c0185b5fa8d86da7110c1aeb14f1f838e00d44416ac4f9163a0475786770ced990133ed48b80c302f6cc9f74b0f5aa3a", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646150842, "uuid": "4f5a358e-02a4-4362-9d14-0ab5c38c4792", "value": "T18123E116C560682CC73E8C758200AA93720A7901D9D5EB993585BB4C3B96FEB53DF5CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646150842, "uuid": "f858e90b-71b4-4be5-8cfd-2f1d26ce6f42", "value": "768:ao9DOevZCwrvtOzdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Uh0VPPDks:ao9D+tT5fTR4Lh1NisFYBc3cr+UqVnDZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646150842, "uuid": "d5b00ec1-c4ed-4900-9bc7-224621aa0f8e", "value": 47696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646150842, "uuid": "4b073321-72db-46ef-974d-c41b28ab7af2", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646150842, "uuid": "b6630033-9a60-4d98-ba7a-7de26a3148af", "value": "SCAN 0103.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42845196-999f-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646166983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646166983, "uuid": "cdbbb0f3-0db3-4d1e-83f1-530c8c382056", "comment": "Malware payload (Heodo)", "value": "c06edf2301fafbc4a34c3f8c601af968", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646166983, "uuid": "48b75c20-e919-407e-8835-10d5c3425d51", "comment": "Malware payload (Heodo)", "value": "7c3bebd77373b56001fd8c9597f816cc9b6a31f1a2fa49a01e9721becc609849", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646166983, "uuid": "4a52de90-cd5c-4588-85f7-604e4886e772", "comment": "Malware payload (Heodo)", "value": "e63a9d28e723ecdc66804d30386a07c4196f4297", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646166983, "uuid": "7ce5e9e8-5df8-41fa-8690-7006fe1004ad", "comment": "Malware payload (Heodo)", "value": "de48d85bce85b3eda1e635bfdadaa34491644a0dd6e75beff3e9e6d33e22fc80a8084ebd545f930e936766cff010f1e0", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646166983, "uuid": "c027dd49-b18b-42f8-9148-b69a99aa6e53", "value": "T1AE23D025C1607828C73E8C759200EAD2720A7D04D9D5EF893585BB4C3B96BEB57AF9CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646166983, "uuid": "5f1ea05b-cc65-4007-997b-42d0425a66ec", "value": "768:+io9DOevZCwrvtD608zdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Uh0VPWft:+io9D7UtT5fTR4Lh1NisFYBc3cr+UqVC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646166983, "uuid": "4edd932b-d630-4859-adcb-294c71eb75a1", "value": 47699, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646166983, "uuid": "6dd9909e-b210-415f-b647-6688d4a5811b", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646166983, "uuid": "4c360548-4229-491c-998f-56a04e07f3ee", "value": "OPEN ACCESS EBOOKS_3.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "351fdf36-9947-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1646129165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646129165, "uuid": "810b50d6-e44c-4910-99a7-486e3c8e1fd1", "comment": "Malware payload (Loki)", "value": "26b3281a8e9ab7b4924bc1b8c69ab14b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646129165, "uuid": "98e25651-0aa8-40c8-9604-1d9c914083d7", "comment": "Malware payload (Loki)", "value": "7d6175992a8b8cbe6df0003479b2b6e50b9bd974470d728aca8900ac2e21a654", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646129165, "uuid": "a2c8ca90-6377-4ccd-b371-fd0ee03e0cfe", "comment": "Malware payload (Loki)", "value": "bcd4f6499df495ac8c4514e5f30c6fb5630a3471", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646129165, "uuid": "9f6ba394-1eb2-45c5-9a3d-b1e3b45d4440", "comment": "Malware payload (Loki)", "value": "b2583af43b705b62aab006696dd7a6db4e244a8d2092a5b0a1ce42847471b50b958d239603285299f47b9d276383060f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646129165, "uuid": "8f4dff55-6d67-4776-9d85-c5162732d1ed", "value": "T17F059E4835D6607DE836CBB2CAC0EFE1DB69F131D649A0B250020E598A0DBBD8D55EFD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646129165, "uuid": "09a7df07-7432-4046-bc3b-08f57ac6d74f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646129165, "uuid": "25ea8aed-0291-48d1-b62c-79f00a19fafd", "value": "12288:DHWPsYdcGqqdOl0chx0XCor4HPaiHw6p4RNdR2qq14InhrRq3fJ3kZ4EDnVyQNM6:qJOlTayC4HLHw6pGJts4I1afJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646129165, "uuid": "9afb9f6d-07a5-4b09-9911-ac9738233ac5", "value": 823296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646129165, "uuid": "cf698272-5e7b-4584-9ae6-c7c798f603d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646129165, "uuid": "00725909-5939-4aa0-89ec-86b426e5123a", "value": "Shipping Documentspdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "023d4827-9977-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646149695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646149695, "uuid": "27d1b2ac-16b1-402b-9943-f2089cd2d64d", "comment": "Malware payload (Heodo)", "value": "d3480a1325815357c42b402c2c2f5208", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646149695, "uuid": "6cc74c2d-9665-4e1d-a7ea-a165d875435e", "comment": "Malware payload (Heodo)", "value": "7d714a27583020ca998d7c723eff6d58a8f5471d613e17f9d016041f759fae5e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646149695, "uuid": "9136fe07-ed05-420c-86bb-a925a2d9c9ca", "comment": "Malware payload (Heodo)", "value": "fdbcfcfeb363f0ca544f61bba5dfb3bd57dc70ca", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646149695, "uuid": "0959d35d-e0a8-4d94-8ea1-9fb35fe2f78d", "comment": "Malware payload (Heodo)", "value": "c2da637710ea38d0deaa12b9ac405a2f2ee5154465d81dc490019153d91a55420864c4a502ad41229d7c0bf0d0947a91", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646149695, "uuid": "e6bad8c1-20cd-49cb-9596-daf7ba462549", "value": "T153B4AE11B790C076D2AA36342512E3B51AEDBC709AF5838B7FC07B7E5E315918A3835B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646149695, "uuid": "ffbb95f6-1e4a-4f4b-b76f-6ae8b0ba30b9", "value": "f08242131de62ca6d7c4b2727b491b3d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646149695, "uuid": "2124d53d-778b-48c8-8d88-6aebdca90893", "value": "12288:dbFLiEzuSo9guqHuWjr2pyb4W6SpktSuHE:5VWSo9guWz6ZE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646149695, "uuid": "5ed4e65e-a1b1-4db2-94fa-cbd344b42343", "value": 500224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646149695, "uuid": "fc85ab3d-b06e-4d66-99d2-b4d309749151", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646149695, "uuid": "4255925f-1b41-4a5e-879b-c56678f56d49", "value": "d3480a1325815357c42b402c2c2f5208", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2178aedf-9987-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646156620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646156620, "uuid": "93471e8c-f048-4e4d-b961-24d80033d654", "comment": "Malware payload (Formbook)", "value": "e670b4d2c5fcdf206efa7e2e736a7e6b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646156620, "uuid": "fe78ffb5-670f-4c7f-9f5b-6fce8b58d300", "comment": "Malware payload (Formbook)", "value": "7e65af7cb6f214c8a87161a506543901224736db559362d14cef094ce1669204", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646156620, "uuid": "590df9f9-d6d2-40c3-80c8-042aa27a3c5d", "comment": "Malware payload (Formbook)", "value": "2077c41520a4e9448e1fa8510e27dde369df1ce2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646156620, "uuid": "457891e3-935f-45a7-be2f-58061cfa2752", "comment": "Malware payload (Formbook)", "value": "97a721acd65aff1cf850b49cfa7574f7f44b51511e2dafee27b259d697da8c30f1caf7a60d6dd6ff85a063b26b344425", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646156620, "uuid": "060c0f84-3542-488b-a17f-11e7fa28356a", "value": "T1C17412C361C4EDF3D2D20532117BF77AD6BE528821820552CB8D1EE42EE61E7C765AC6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646156620, "uuid": "8d5d9454-5ec5-49f2-b015-fcc63807b4b7", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646156620, "uuid": "81ef6593-cdc5-4884-a7e2-091a23b9d6b6", "value": "6144:rGiXSquA+yEvMhaa19YQkgLN1GEuD2WCDjSn0eXHBzMxvUydhWUQHDxO:mqJ+BMEa19YAuyW+S0yQxvUydhWUQjxO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646156620, "uuid": "276898ca-63f5-4ee7-bc63-7416608deb7b", "value": 338985, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646156620, "uuid": "94d5d6a0-6bab-45fe-a458-1e57ad295cff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646156620, "uuid": "3a2370ab-b5cb-4105-a3dc-3facf421f18e", "value": "e670b4d2c5fcdf206efa7e2e736a7e6b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05447620-9977-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646149701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646149701, "uuid": "b6ddd979-ac23-4d3d-8b3a-8bf6b2d5eae7", "comment": "Malware payload (Heodo)", "value": "cd5d780fa053e3a084515893c844bbce", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646149701, "uuid": "de51577c-40a6-4645-907b-948e30fc698d", "comment": "Malware payload (Heodo)", "value": "7e6e57a10cab12934441d2caef945bde51f4678b4be841912516921650907031", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646149701, "uuid": "548f9d33-6114-42b7-a4d3-2904c198e8e7", "comment": "Malware payload (Heodo)", "value": "5cce730efaa73de6c00d578096243bba3b942d93", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646149701, "uuid": "1ed227f0-dccb-411f-909c-9fd3b4087b3b", "comment": "Malware payload (Heodo)", "value": "f92204f5ec2adc2330051fd057860ca3a5cd38b92eccc318a38a7165d10e5087acce62f556743065d75eb97aa9bb8301", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646149701, "uuid": "bbcf5bbc-6fe9-4187-8c67-f2107a338fa5", "value": "T12CB4AE11B790C076D2AA36342512E3B51AEDBC709AF5838B7FC07B7E5E315918A3835B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646149701, "uuid": "7bea8b97-4316-4591-99af-b0a6d8fcfb6a", "value": "f08242131de62ca6d7c4b2727b491b3d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646149701, "uuid": "086584e9-cce4-42e7-9334-cbe16d52a775", "value": "12288:dbFLiEzuSo9guqHuWjr2pyt4W6SpktSuHE:5VWSo9guWN6ZE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646149701, "uuid": "b66fc0bb-fb0f-444f-b0fe-cb95f9dec30c", "value": 500224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646149701, "uuid": "2af5f9de-03dd-46b0-a8f2-fe2339d13d32", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646149701, "uuid": "b0a35078-e2ef-459c-9a96-3ee5fc1e0873", "value": "cd5d780fa053e3a084515893c844bbce", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30c1ecb0-9986-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646156216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646156216, "uuid": "9d518dbc-6227-44fe-9ba7-2e56eb5ba0cb", "comment": "Malware payload (AgentTesla)", "value": "5ee25ee3bef6f1109e8e5c8afc529bfb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646156216, "uuid": "05750f63-082c-4435-af3d-5ffdefc00b96", "comment": "Malware payload (AgentTesla)", "value": "7fbfbbd33f5401e42301ed5323babb0352aad11f514dba03873e9d1770026d31", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646156216, "uuid": "f0db5eb8-3d48-470b-be3f-2a44d5620985", "comment": "Malware payload (AgentTesla)", "value": "c42b0a2d659da89cdef6be1cc1e3a2286c451c6b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646156216, "uuid": "60400579-4b72-4a94-aec1-75b989dded44", "comment": "Malware payload (AgentTesla)", "value": "3bed17612337bdc84320cf3283b30eb4e0802085eb53d6aef35a826e452ad390549a3a1dfd9da30bbe8ee4ec5106de02", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646156216, "uuid": "ac4b66b8-db37-4d01-9a55-acef56ac22eb", "value": "T18F15BF4838D6607DE8368BB1CAC0EFF09B69F272D54960B654020E199A0DBBDCE45DFD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646156216, "uuid": "4fdf72ac-c302-4cec-adbb-882cc0283f8e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646156216, "uuid": "765fa602-d3a6-4608-ae25-84b22bf093b9", "value": "24576:AEijPd58C2Nse3Sjt5/rCwTwm06geoAj:4rduC2NseiJ5/ewTw6LoAj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646156216, "uuid": "3d247546-c574-41ca-8494-2239c40ad94a", "value": 945664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646156216, "uuid": "15d6963e-a56c-4c2f-b5d2-280318df5d9c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646156216, "uuid": "12be1abe-9a0b-4330-9f61-c1391b80ef10", "value": "DHL SHIPMENT NOTIFICATION 284748395PD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d499d3cc-98fb-11ec-9275-42010a9c0029", "comment": "Malware payload (AsyncRAT)", "timestamp": 1646096791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646096791, "uuid": "65ee9d2d-88d9-4ee0-b4d0-7ba5a28dd25c", "comment": "Malware payload (AsyncRAT)", "value": "902226ed755e9c3b123fbd0cd3203e36", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646096791, "uuid": "cd70f0a7-5a92-49c5-8aa6-ff0989ca4450", "comment": "Malware payload (AsyncRAT)", "value": "7fe7baa9d94227c8dcf5722e21e7505f22f3958097f3d36f24183973aa58189d", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646096791, "uuid": "0427ab4e-384b-4bc6-956e-d7f252fc82e5", "comment": "Malware payload (AsyncRAT)", "value": "cef89902682a087ed4a136fa87a577b77dda4910", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646096791, "uuid": "97e2729c-befe-4e7b-9755-14c18012dc54", "comment": "Malware payload (AsyncRAT)", "value": "158f28047292d549984dc5e739cc638ac0958bbab3fbf98fbce7795a6e5876421b677965691d1d3fd920e7fc18d35211", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646096791, "uuid": "1c90cbd4-a275-48d3-ac08-e17dfa5d66d4", "value": "T199F4E7DAF172B135DCDC2D3ACFE9430062614E8F166A8E2E65A9B3744D323E79807356", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646096791, "uuid": "336560fa-1ce0-4594-9cdc-00b8e5b0173a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646096791, "uuid": "9befe080-0b91-4e9b-a6b1-4c675b0928d2", "value": "12288:H7qiNH+wawHwUOJ1LTcFNVBZqy5I2q54iDN23fxD:O1LQRz+GiDN2vx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646096791, "uuid": "9636cb65-0595-4d41-9a6b-63e0b7a0fdc5", "value": 784896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646096791, "uuid": "7d716c0a-d012-4d3c-a0bd-91a0cf7c563f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646096791, "uuid": "d18e719b-684e-493a-bd33-14392533dcc5", "value": "7FE7BAA9D94227C8DCF5722E21E7505F22F3958097F3D.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0865c06-9947-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1646129345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646129345, "uuid": "fa6e5524-50e6-4ff0-9b93-447f673ca1f0", "comment": "Malware payload (Loki)", "value": "e89a276d0bf7cc655a2b9399591ef77d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646129345, "uuid": "6e05a420-1213-4a2e-993b-1a7fbd639211", "comment": "Malware payload (Loki)", "value": "80b3d09d590350e23fc0d25b2e71f3f038a741503bab97caac2a9287474f8d7c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646129345, "uuid": "ae0e8254-1664-47d1-9e8b-9e1ff00ceac1", "comment": "Malware payload (Loki)", "value": "25b7b9b2fe73108b962a033c3a2a575f5f88bd27", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646129345, "uuid": "0f5586ee-b712-4e07-80bd-cbd9b7c2ce4a", "comment": "Malware payload (Loki)", "value": "f124d19a625d26d03735e0fc4fa2e879948560113b448653de3fe700306591810e340549d4e404375ea20a93ee7b6758", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646129345, "uuid": "84f0dd8e-2fac-4e2b-971b-04cd684eed79", "value": "T1BEE4AF0439E61038F9368BF2DBC0EBF1DB6EF221D58960F564004E599615BBC894AEFD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646129345, "uuid": "14efdc26-8946-49e9-bb61-5a0f564fb7b6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646129345, "uuid": "d3e4b4f3-0914-4d6f-a196-2323e87d0140", "value": "12288:cEebR/ImlantJ+Q9jV3D5rj6Bwnj0m1gdGzGZjqWpCRGKZN5dH7p:GStJ3Dp6kgd6GZjvpOpZL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646129345, "uuid": "2cfe9a44-f843-4be0-a6d8-8184f51ac6da", "value": 703488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646129345, "uuid": "3a848feb-086f-4b3a-987f-8d0ab4a35a84", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646129345, "uuid": "0cb66858-e8de-489d-8c6f-4f950e4fba6a", "value": "e89a276d0bf7cc655a2b9399591ef77d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab018454-992a-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1646116907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646116907, "uuid": "4ca31a59-f7de-4330-8631-0eb466cbb4d6", "comment": "Malware payload (Loki)", "value": "f436acf1eb2663e007167060e723327c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646116907, "uuid": "26513f95-c8b0-4c19-bb20-421f88cbab1e", "comment": "Malware payload (Loki)", "value": "811dd985bc85567c804627c31b98b0278c6823f2cb4722e935d4ac299eee4f2d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646116907, "uuid": "c37d1381-20ab-4ac7-b777-e83af9ca7f72", "comment": "Malware payload (Loki)", "value": "25b32e0e08623d898f818ba78f1f6150c8d7f5e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646116907, "uuid": "c51c3b08-c98c-4cf7-8313-c1875b428863", "comment": "Malware payload (Loki)", "value": "82d09a63eb2e46f02f8c3c97a38e46fd44dc001104e81d641c69e36bc238814c18d30df3217cd23d14b904c6646bf5c0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646116907, "uuid": "b7db227d-5d03-4ea3-bc62-44fcf21c4ab0", "value": "T1A464124337C0CA3FF9D2573421E6E765FBBAE3BD125A29522378AF697C05953000B2A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646116907, "uuid": "aa8a92c7-0587-4ddb-a846-93d0cc70eda3", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646116907, "uuid": "76b33ea9-5051-4a79-aa7f-f7a18e02cf53", "value": "6144:rGib0O4JRAcWEgD4G3II1D8iS+qsyn8XGqLDAGW8gBLVXgQG90kk:kOcRAlEYn3oiTq/NLGWjLVX2lk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646116907, "uuid": "c23194ab-76d6-4f66-8ef4-9c8b6825e39c", "value": 312685, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646116907, "uuid": "59a51ed9-f492-4c3f-a03e-aa0ebed80e85", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646116907, "uuid": "db4ab395-ae7e-4b3b-9263-b621807b763d", "value": "SwiftReceiptOfRemittance1-03-22PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a883b187-9927-11ec-9275-42010a9c0029", "comment": "Malware payload (NetWire)", "timestamp": 1646115615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646115615, "uuid": "1638c306-7c61-4c13-b12c-4840cd9f5186", "comment": "Malware payload (NetWire)", "value": "0aead88fe558b184c86355a085764067", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646115615, "uuid": "d7dff7e3-0000-424f-950a-cb650351776e", "comment": "Malware payload (NetWire)", "value": "818bed3da07ea9e48989e4d61e6190df849ada635bfdc53ce86544a2deaa8ef0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646115615, "uuid": "593936b7-72d9-4e71-9ac5-eb3988ebda23", "comment": "Malware payload (NetWire)", "value": "be6cbbb50d8e62a7b3ce12ce48da62956cf5d19d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646115615, "uuid": "af330ab2-e1e7-4cbe-ba47-acf5bd054efe", "comment": "Malware payload (NetWire)", "value": "0999894e828e16390f38c1e75232f81429370d514600ef4c66cfccef7a2f35922d76081fa9c45a7c19751295ef866a59", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646115615, "uuid": "6afc5b1e-578a-47ba-9ff5-1becd703a706", "value": "T1D7A47AC5E9819676D54B9630267CBE2A8A19AFF5306CCB1448EC3D0B3D31B1D3693DA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646115615, "uuid": "8b378e9d-6ca7-46f5-8263-ada99cae46c8", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646115615, "uuid": "e2ccb8e3-49f4-4735-9ff6-5d32ab21f940", "value": "6144:IGiZdPcmSAjS7fEie3lfyGR/n2xTJiX6+Ke2py9uPFOnPjWeSKYrWp2+eaHf3kN4:gdPcmSAjkfEbfmx87Ke2pw0QWz+2tXe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646115615, "uuid": "972f13da-aa4f-472a-a51e-e3ffb7612429", "value": 486255, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646115615, "uuid": "307a5545-eb53-41b5-8e5e-f7c4fa8998ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646115615, "uuid": "4d596ebf-22da-4cf6-98fe-3eaf6d98c219", "value": "ACCONUXXX78.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83d97024-9958-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646136598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646136598, "uuid": "52d2cbc0-6181-4738-9d8f-7954e5de070f", "comment": "Malware payload", "value": "fb7c61ef427f9b2fdff3574ee6b1819b", "object_relation": "md5", "Tag": [ { "name": "Daxin", "colour": "#652B35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646136598, "uuid": "595ba3b1-e60b-4595-b705-8c5dcd1c435d", "comment": "Malware payload", "value": "81c7bb39100d358f8286da5e9aa838606c98dfcc263e9a82ed91cd438cb130d1", "object_relation": "sha256", "Tag": [ { "name": "Daxin", "colour": "#652B35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646136598, "uuid": "0d6e8f0b-24d3-40ec-b395-7d10868a95a2", "comment": "Malware payload", "value": "1f25f54e9b289f76604e81e98483309612c5a471", "object_relation": "sha1", "Tag": [ { "name": "Daxin", "colour": "#652B35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646136598, "uuid": "30289432-023a-4fcc-b525-f0cb87b89f4e", "comment": "Malware payload", "value": "bc301fd9dd77f1a617441ab819ae1b95a01c99aa20fe39ea71954efe3186dc11484a7d44a620a669854bf45183bce67f", "object_relation": "sha3-384", "Tag": [ { "name": "Daxin", "colour": "#652B35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646136598, "uuid": "2ac7dad0-23a4-44ce-92f7-75423765705a", "value": "T18D437C0227920CF4FD429EB9982F3376A7379F56082B66865754FEB61D72141F90C3B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646136598, "uuid": "4f5a6e7d-7765-4b09-889c-c5b4d147ed79", "value": "420625b024fba72a24025defdf95b303", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646136598, "uuid": "337c95dd-a373-4ba3-8b02-c6cefbfc264b", "value": "768:LEt/o78vtl0gfkunuajwu8PJ8daK51hD16AvzSOjV7v23PvmOhq08nY+z:LaDHfkyjWBghD1zvOsVTWXBZ8Y+z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646136598, "uuid": "e705b179-6b92-44c5-b782-89d03e653a4a", "value": 59904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646136598, "uuid": "7b9a8de0-9165-4ced-9166-1f07198d800c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646136598, "uuid": "71ea6756-bae5-4942-9e35-686487603725", "value": "81c7bb39100d358f8286da5e9aa838606c98dfcc263e9a82ed91cd438cb130d1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0650bc58-9986-11ec-9275-42010a9c0029", "comment": "Malware payload (Adwind)", "timestamp": 1646156145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646156145, "uuid": "eed860a5-da72-40da-b799-40abedd0ae17", "comment": "Malware payload (Adwind)", "value": "5f630d11941b022c3011a57d334f24a8", "object_relation": "md5", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646156145, "uuid": "8e2bd3f2-fce7-4af5-9c55-aa862b3a96c9", "comment": "Malware payload (Adwind)", "value": "824280490530b3ce348216526de17afd61dabaa972619c59ea5e1b485d5f7fc7", "object_relation": "sha256", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646156145, "uuid": "a59d3330-78d6-4870-8668-fcb99aadfe0b", "comment": "Malware payload (Adwind)", "value": "9cb569f42f0c73b0820a4a8fee0cb1f05a047c4d", "object_relation": "sha1", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646156145, "uuid": "782304ce-0f2a-454b-b94f-a2c0e8cccdb7", "comment": "Malware payload (Adwind)", "value": "ac61071dbe4af464339d7e76431eddb3ae642d365cf5d2398c0d9ae463f9f44c7f47f8772be9247e194993db90dbf600", "object_relation": "sha3-384", "Tag": [ { "name": "Adwind", "colour": "#4B4813", "exportable": true, "hide_tag": false }, { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646156145, "uuid": "c6d6f584-c6a8-4af0-9c8f-4b16961c8303", "value": "T1C2D433789051A79FB832B370EDFE3180811C875627B971D21EF2688E18F6CDA35A9717", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646156145, "uuid": "18f0e6ca-fe43-4fa3-adab-a6c022fdcb68", "value": "12288:6EtH9Txxks4fRth515m6fFAJlR0BAlwSCOJHwbe3HO/38MRu:RxxkDRPaJlR0BqCoHz3Ovfo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646156145, "uuid": "e7747288-2362-4d26-9994-7c8e2d9334ca", "value": 646410, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646156145, "uuid": "75a03ec8-159c-4ae7-b3a7-776974a07438", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646156145, "uuid": "418bb49c-e2fe-4e77-a41d-d0118f77f8b9", "value": "SOA Pending invoice.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff616fd3-9933-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646120914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120914, "uuid": "c4910363-1a1c-49e4-a2bf-fe2ab8ad6d59", "comment": "Malware payload", "value": "ffa2ac5a69c7ace2a10d749a6f881f92", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120914, "uuid": "992f8c69-e61e-45c7-ba03-d1a6e570d2b1", "comment": "Malware payload", "value": "82473f3c78d0243f759552027033f81e1ceb7fc3317c235264c9102f87669122", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120914, "uuid": "becb005f-98e2-44a5-b126-3af9b84be6d3", "comment": "Malware payload", "value": "771e941ed6ea15df30b9405a233b15da937a3d41", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120914, "uuid": "ac50d40b-1f77-4e9d-88a1-23fbb5d6610a", "comment": "Malware payload", "value": "577d02d7d84eb1157f5094041837792148c3b4a6a2f60532203e1fd471bf798aa348ddbf91b98c41963d5acacb4342ea", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120914, "uuid": "c9609ddc-ab9d-45a4-8643-d5c44bd22f55", "value": "T121141294FEB59BCAEA246D703985E8B3B3CBDDF02D2115B5D02D7463797A4C2E620A10", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120914, "uuid": "d5dbda69-5072-411a-9bee-9cbf6b89f76e", "value": "3072:cLNvWhn012k/MDDnX6+K7M+cfy6M3PzBizptegEKgneK5Hn9BYjMxnqtjY9U/pu5:+v0012kEnQ7MbfizByp1EtneK5H9BYgR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646120914, "uuid": "dd1330d1-4905-45d5-9e5c-b335c828c41a", "value": 191128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646120914, "uuid": "f84822cc-2ea4-4e05-964d-1ee3a714bf1b", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120914, "uuid": "88001696-cd5e-431d-a3a8-bf3608a32f12", "value": "SGDKCC_SRL _Oferta.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea41a9d1-9929-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646116584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646116584, "uuid": "f7e5d46e-3d34-4122-95c7-f60cd0d539d5", "comment": "Malware payload (Heodo)", "value": "6296a01464e39cf75a5be08c63789596", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646116584, "uuid": "a628304a-d80e-4750-a7cb-4c8715f6cf43", "comment": "Malware payload (Heodo)", "value": "8282caaa7225096c6c9c4f37be428d22ddc10b5b06ce69950b0c3004c916750a", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646116584, "uuid": "015ed826-ff1f-4e03-857b-1a609e1b0e57", "comment": "Malware payload (Heodo)", "value": "164a338bbc7fcaa70b9331c11a8fd6d5abae8397", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646116584, "uuid": "200b747e-2acd-4e46-bf83-ab3bfa96c2aa", "comment": "Malware payload (Heodo)", "value": "e3cf3d0f1193ad3a9cbac72a98de0637dbc7a07bf2f0798631ee8e543decd6b99abb3722ba8763b626a8e022aed3fc80", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646116584, "uuid": "095712d7-d3b8-4144-bbff-2d03732d70df", "value": "T1D513D019C4665ADDC327693DD6149AF4120C0E0A89A1FA9F1C54B39C2B6A1F70B5FCF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646116584, "uuid": "807d7a98-803f-462c-8962-8aae33058832", "value": "768:u/omdH+DOevZCwttqyKfcrND59V+L9Rw4eWrXcTqZ0VP2HLp:yomdH+DoylND59V4jwmXc2CVCF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646116584, "uuid": "60274931-4b29-4f70-a451-5487a198ba1a", "value": 41827, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646116584, "uuid": "602dbe63-0480-42b0-bc02-cf876ddac644", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646116584, "uuid": "756026a0-9070-4812-b3d7-186ac5480a8a", "value": "Due balance paid.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c4ed4bf-99ad-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646173066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646173066, "uuid": "fcd41693-0464-4b4e-a3db-07e8f4d9f58b", "comment": "Malware payload", "value": "ea7ec06c42012ca16f51e2cd89acf0e8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646173066, "uuid": "85fb2210-3896-4d96-b794-99a8eb97087c", "comment": "Malware payload", "value": "82e345eef72bc6bda17faeee964df87c7cfc5eab2def7b8ea4ea39a1f6ae26f0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646173066, "uuid": "c86fc2e9-197f-4364-a404-65af36e17423", "comment": "Malware payload", "value": "8a8ee23cc3d5461a2eeef62c44a6c3686eb14ef3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646173066, "uuid": "af72aae4-f012-4b62-9319-e5da6685b1ee", "comment": "Malware payload", "value": "df6e4d506eb2e2cf0477eb4f8dcc30a07edc46d707d7b07774943f4d84fd33437c221396679d1575749e7bfb91d185f6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646173066, "uuid": "c362377f-b88e-40f8-ac03-e5c3f32372ee", "value": "T106B4AE11B7D0C072C26A35342926E7B656EEBC719AF583876FD03B7E5E301D18A2835B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646173066, "uuid": "dd4c0194-a8d3-41e3-8a03-0470423adac0", "value": "d02245ac5c961d83d0907c826d8ba5c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646173066, "uuid": "2c77185f-9f08-45ae-88ec-8237f3516fd2", "value": "12288:JhC1q3aXOwkiPs2iCtyj8OAIlgOkar//wJY8Itgm:Jgq3aFkiPs25a82Bkm8jm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646173066, "uuid": "8331f2c9-67ab-4559-b7bb-006b18ed1320", "value": 499712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646173066, "uuid": "3e0c0053-786e-428d-b741-c32a09c903cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646173066, "uuid": "cbba669f-2831-4747-a691-d0e7aedfc191", "value": "ea7ec06c42012ca16f51e2cd89acf0e8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98f20a45-9933-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646120743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120743, "uuid": "503e9580-cd87-4672-8111-bc574b35b761", "comment": "Malware payload (Formbook)", "value": "ef7610fd6958226fac68ee42767bf9b8", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120743, "uuid": "9f64fe9b-e8c7-4766-a641-9a1f5021cbb7", "comment": "Malware payload (Formbook)", "value": "8304690ff75f8019155bb094227c49cd8ac6227b0aa56a25c07667d722f95e5e", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120743, "uuid": "eaf9c8f3-1700-4d20-9a01-d43940bfb001", "comment": "Malware payload (Formbook)", "value": "84c5e3659ae7d14ddcae01ac754fa57510cf50bd", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120743, "uuid": "b3e86f03-940e-4225-b56d-60e2fc858161", "comment": "Malware payload (Formbook)", "value": "666ceb287c31ebcd450387f2af354ec9a20977bbddf450b6f97de20d221fa4f85946f41d2c4b00fba5cf5a0727f243f3", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120743, "uuid": "664736a1-a3ae-4813-943e-933ddb0a2fec", "value": "T1A0140210B1117B4BDA2F74373B5F351660EAEC38761268572C05F38DA9B1F85A8A7B38", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120743, "uuid": "3682a4cf-fd3c-405a-8f71-8889e464064a", "value": "3072:jrP7MxJdwCS9FH34qtSvtnfRyXuKVImuxAQq2pGwMxITkFmPVU7o7KSwa8o6AHQm:AxYCS9V34qtSlnfRyXuKV6IVokFmPVZH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646120743, "uuid": "b4d38a3e-4cde-4f85-9f5d-4169607154e0", "value": 190424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646120743, "uuid": "373a9f23-d858-4eb4-b89f-29fbf318d91c", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120743, "uuid": "4e76abce-37b9-47ba-a6ce-e8bad4d0a98f", "value": "February RFQ-DBX 01032022 EURASIA_SUPP - Q1.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "097e4255-9912-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1646106328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646106328, "uuid": "3ec6c7d2-7284-4761-9627-eed7e43257d1", "comment": "Malware payload (RedLineStealer)", "value": "e3312e798e52dad25f07d5b361e37d00", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646106328, "uuid": "a2ae16b0-f1ba-454e-b532-057858116128", "comment": "Malware payload (RedLineStealer)", "value": "843801a4f7d139f86e0e186a6075c276562f26971b663fc937e4329d3fa4abe5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646106328, "uuid": "44b77dd0-5eed-42f4-ae7f-081649a7a347", "comment": "Malware payload (RedLineStealer)", "value": "184f40d95138712fedf2971d894e2392bb412a18", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646106328, "uuid": "4ef3e402-4bfd-4c99-8515-36e665e2f023", "comment": "Malware payload (RedLineStealer)", "value": "9fbec795c160a06cb92d010bccae9d804d805d2fabde8a519d3bdd8af5ab8fe60be262f1f6e4b61711b70d5d8ce1a39a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646106328, "uuid": "f53ffe7c-28bf-4955-aded-b1eb1133dedb", "value": "T17E553301D306855BEFB2A6770B22A372EFD8FBC26DD483FB4216D294EE45B1A0D5016D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646106328, "uuid": "0da91c53-886c-4922-992b-6dee1b6d805b", "value": "a7fc9d359d9e98c86ceef977a50f9d6a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646106328, "uuid": "efcfcb6a-5a29-497a-827d-c7fa9bb924f3", "value": "24576:xqL1MXzooWY8MA+Bkn6WbFbuFqs3rgCMhtyONK+V3HPLA8VHkFXaZ:sxMXeT6ubmPkCMywLACU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646106328, "uuid": "48fcd86a-3b77-48e4-9281-d69586f151cf", "value": 1330272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646106328, "uuid": "3832658c-3cb8-4ac8-844c-a983a960d20f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646106328, "uuid": "362d51bb-ab43-4135-a439-262f32a44065", "value": "e3312e798e52dad25f07d5b361e37d00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56d8e739-9960-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646139959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646139959, "uuid": "f76bbb1a-043b-4616-a289-7653ae13b64e", "comment": "Malware payload", "value": "aff2c48da333d11105add195393803e3", "object_relation": "md5", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646139959, "uuid": "a29d4e55-742f-4507-9f6d-4dbe22c27b09", "comment": "Malware payload", "value": "8452d291e037b02bc541a27c734607703a3ef876c562acafbbcaf752f6a6e03f", "object_relation": "sha256", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646139959, "uuid": "103524a7-3604-4444-944a-b84fd7013ade", "comment": "Malware payload", "value": "6f7e9313eee730a6473f92f443618fb96ebc7c41", "object_relation": "sha1", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646139959, "uuid": "137a5aa4-d723-4ebe-8e3b-9a021c781bcd", "comment": "Malware payload", "value": "8ac2f3ec5a74a9f4aa03ede24db3debda72d83130899684a0741c2148944478c2c8dba242f337711864498f181bb9e9b", "object_relation": "sha3-384", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646139959, "uuid": "ddc95ab3-0960-4a03-a8b7-2dacfde0b2be", "value": "T188847D54A7FD5308F2F9ABB466D0BB490F6AF6B4AC08636D0B4436934D177808A76F31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646139959, "uuid": "bfa47185-f0ec-4026-88a0-5638c327d513", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646139959, "uuid": "16d99e2b-e3ec-445f-8f82-174eefe65532", "value": "6144:kXxIzm2ykVwCX7reb0wK9qzSQ37dstl8ryNsz/z8dwi/FKhRDAVhg:5zm2TwCX7r80b6dpi8ONkIwAFKhdYO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646139959, "uuid": "1a678f1a-1117-446e-91a2-634c2fb42665", "value": 376832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646139959, "uuid": "0e144f0c-4c27-43e4-bfe6-16eb8a3de28f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646139959, "uuid": "9d810475-dcb7-4613-b52f-694011da9165", "value": "123.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2d498fa-99a3-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646168890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646168890, "uuid": "6767bccd-f823-4bee-8121-785a44c12e34", "comment": "Malware payload", "value": "b3eccd20b7a0eebb8f9c536ada65b728", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646168890, "uuid": "192e0157-f3ca-4447-be61-7b1437e4356b", "comment": "Malware payload", "value": "847360ab4883cce301830fcab2bb92a37d5dc7ffb4eaf75b1fdd2f19496920e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646168890, "uuid": "e592aaf5-93b2-4dbe-bfe8-0f404bfc91ff", "comment": "Malware payload", "value": "4edfad5bfbc44eab3cbc28bc00227d905a9a95e1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646168890, "uuid": "36da7e82-27d6-4e57-ac22-e8bbf6eb0a22", "comment": "Malware payload", "value": "f67fe7e07fec2200709819267e994702e22d5eddc43364ce8efb8b1db2eeb6a1267594b929beac642b226a9c16ad9c62", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646168890, "uuid": "4b775608-cbe3-41de-8c46-3d635dba5952", "value": "T1A745BE0273D6D036FFAB92739B6AB20156BD79290133852F13981DB9BD705B1273E263", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646168890, "uuid": "fcb36455-f029-4420-8fd9-8d4bc653fc25", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646168890, "uuid": "efa4e4fc-894c-4e2d-ac0e-c8352e77a8bb", "value": "24576:xAHnh+eWsN3skA4RV1Hom2KXMmHa+fEbwbfIvcvSXM+e1xVD5:Ih+ZkldoPK8Ya+8bcvEUbf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646168890, "uuid": "a303f2b9-be1e-4a92-990a-79c8a877bac8", "value": 1259520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646168890, "uuid": "a80f846e-ed1f-4f33-8aec-b7c3c5df9c00", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646168890, "uuid": "af9139cc-5be9-4a29-82c3-01cfaf2d51cd", "value": "Main-Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "574e18e4-9934-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646121062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646121062, "uuid": "25bf7de7-2225-4f35-8fc7-6f7e9382ea7e", "comment": "Malware payload (Heodo)", "value": "37b62e1a1c306ece09f21291e03d7791", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646121062, "uuid": "3bba7e86-451d-44aa-9fed-df5ab7e91346", "comment": "Malware payload (Heodo)", "value": "8475bf4d60066554878c393151e8e23731687b8ba7de4d09c3226c1c0591c436", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646121062, "uuid": "8542ec32-78e3-4966-8498-1d95efab4ae7", "comment": "Malware payload (Heodo)", "value": "5bc803fc5735c603bd5dfa57ed6ea3f77b3c6659", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646121062, "uuid": "5ba7c7dc-7433-48c2-8485-70af8900ec33", "comment": "Malware payload (Heodo)", "value": "a914d3b706fce9b03a0c8331cef075986fddbde96029e3d0ee2759a34c3314f0ab4b0bcfd96d651e7e948c4c7bf813d6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646121062, "uuid": "8d716afa-20e3-4604-bb74-8c13c34efe8f", "value": "T12CB46B992251F077D11B503D0BCC2AAD7EEB88F09A6DF27FD2A3558D0F31190A62D993", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646121062, "uuid": "f95680b3-65aa-49a1-88ec-e1ad285a6be9", "value": "42fe0d732d1bb90c6a7a1bcfb8ef88aa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646121062, "uuid": "5e5e1dd2-7a07-475a-838d-54cbcc3365e0", "value": "6144:cH4C1DzgG1GCQw2HOOnPE10JQNqqtvrC4cHV9jp6YagzSAIVCL4Ry:cYC14G1GUgOOs14Qkqtm1xpdIVCLqy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646121062, "uuid": "97e9c918-aa32-463b-9ccf-e3980a633202", "value": 528384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646121062, "uuid": "35ead3ea-016e-4e13-b289-cc85cf1a1773", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646121062, "uuid": "ead74409-adfc-47a0-86f4-2fde9a967dd7", "value": "37b62e1a1c306ece09f21291e03d7791", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09e7c803-9943-11ec-9275-42010a9c0029", "comment": "Malware payload (STRRAT)", "timestamp": 1646127374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646127374, "uuid": "d80a9447-2b3e-4011-8d4f-a286a7a89e1a", "comment": "Malware payload (STRRAT)", "value": "77f1d2eee8159f8db26ff37745abd2d2", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646127374, "uuid": "06d1711c-e01f-417d-9033-2cf7735e6ce1", "comment": "Malware payload (STRRAT)", "value": "85ea19ebad6e8cebdbd3c188964228fab7512b8668633f621bf0d660b8f92a33", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646127374, "uuid": "f338bc1f-23c5-4575-a909-2d8e923969c1", "comment": "Malware payload (STRRAT)", "value": "c33fdaecf518370af7b097e8d8199115def40632", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646127374, "uuid": "ffb2fc2b-94d7-4626-9afa-246db75ad488", "comment": "Malware payload (STRRAT)", "value": "2a3336039f8b0b491731c1d1c0d0e06b8f45178587eb393fcbb2024676779e83285f76944d2d51e7c8017bae58a7def4", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646127374, "uuid": "061ad56a-ffe3-4a9d-a5ba-53a3e6077658", "value": "T1CDF3F26B3C6A98DCF14B4933E0004573265D41ACD51D902B76FC899A3E78C5B2B2BADF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646127374, "uuid": "359aee6e-bb0a-4d69-9486-00103d449471", "value": "3072:JL2n5ZUQKi5LwjsZSnBnzNUpyy71X9teomn7TU05FqkB5FrQiHjfNyF:JL2DUQKOwjsZopBJUNUoy7TNaS5FVj1u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646127374, "uuid": "f2018f51-21ff-4fa8-b435-485f661bf3c0", "value": 164917, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646127374, "uuid": "7f0879a2-150e-42ed-a23a-382927441183", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646127374, "uuid": "5fb7ed1f-7926-43fa-8a56-2d2d47619278", "value": "Order 192-22.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12b0af41-9968-11ec-9275-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1646143281, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646143281, "uuid": "966af080-e3b1-4fdd-ad4d-bf205c2fbe41", "comment": "Malware payload (Quakbot)", "value": "b2f96d0ea0a37cf20180319d711092cc", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama161", "colour": "#9F5DB8", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646143281, "uuid": "fa0261bb-8eb9-4d4f-bd96-c5d7b6622df4", "comment": "Malware payload (Quakbot)", "value": "860cd04f3d73082378c753bd8f706acae736cfc8d569697b3d2897ce63fb512b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama161", "colour": "#9F5DB8", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646143281, "uuid": "fffc5ac1-1946-4804-a033-ec319fe27fec", "comment": "Malware payload (Quakbot)", "value": "f66e55c7c05b6aa69c2a339544aa0fd98a7aa7e7", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama161", "colour": "#9F5DB8", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646143281, "uuid": "d32deba0-c895-4644-bbc2-6c9f879c9694", "comment": "Malware payload (Quakbot)", "value": "f1563b52e0768fe1761a0f8afa7c5d0a85ff3b39846065812fa9bd3ac20ecea9af4b8e53eda04829fb239aefa5e6c1f0", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama161", "colour": "#9F5DB8", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646143281, "uuid": "c977b031-9f8c-49dd-96c6-3d87e8baec60", "value": "T14F25BE71A2E115BFC1733B7DAC3F61988C24AE512D14DC4CB7CD1E8E0E296A227255BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646143281, "uuid": "3aac1f81-7a15-48ce-b1bc-175dea07244a", "value": "39e575b47547313526712cf504793169", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646143281, "uuid": "be93646c-c15e-4723-b049-340b7799d3db", "value": "24576:8Sdk/wBjirEIzNmNsdU5xB31FFbDt3xywiDSR6bs2:8Slmg2NmNswxB3LZB3Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646143281, "uuid": "0f4cdc74-44b6-49ee-ad51-1ff863d2fc2d", "value": 1040384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646143281, "uuid": "f4338344-a25f-4b58-8e95-ae22673aedeb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646143281, "uuid": "15f6b901-32ae-4538-82da-efcf1dbbb9f1", "value": "860cd04f3d73082378c753bd8f706acae736cfc8d569697b3d2897ce63fb512b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d2a2eac-999f-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646166974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646166974, "uuid": "971c8d2a-b046-49ed-a94d-c47c52652044", "comment": "Malware payload (Heodo)", "value": "fc369df1242af549ecf9cfbf90f68b8d", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646166974, "uuid": "77916cf2-4263-4ce5-8cbe-87ee05d37503", "comment": "Malware payload (Heodo)", "value": "87387aae04ee1bdbe5db1ec3cd5b0c75ed9c5fe17588553ac33e7518d41b0e30", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646166974, "uuid": "e07cffa0-5f71-4bd8-ac70-6aee078d1f7f", "comment": "Malware payload (Heodo)", "value": "63871f7a0a579b8df29e445bcfd918f685627faf", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646166974, "uuid": "083e03a0-a965-465e-a754-4c9adf38f70e", "comment": "Malware payload (Heodo)", "value": "ddf1b60521d084fdbc8cbc5e1e44f494f0126651646c9d9c4f8b2309a2c5b262cf2ffb6e695deb5ad79fb3855a09bbdb", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646166974, "uuid": "9c9e906f-0981-4f24-91a8-f9b8d73e8c62", "value": "T1B223D025C1607828C73E8C759200EAD2720A7D04D9D5EF893585BB4C3B96BEB57AF9CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646166974, "uuid": "99f943f0-4c34-49cb-bd6a-7deed20e0be6", "value": "768:uio9DOevZCwrvtD608zdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Uh0VPWft:uio9D7UtT5fTR4Lh1NisFYBc3cr+UqVC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646166974, "uuid": "466b3e82-1099-40d5-ab4c-2c1802393bf6", "value": 47699, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646166974, "uuid": "25f1d140-1226-481b-93b6-30ad77ae31be", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646166974, "uuid": "904cc461-f37f-4dcc-9a1f-e95e1b005ce7", "value": "Ommega.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c140d68f-994a-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646130689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646130689, "uuid": "9fd533a9-e57c-4188-8d45-d9157c382c67", "comment": "Malware payload (Heodo)", "value": "20f1450b04d01f82ff84d4f8fdf57c27", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646130689, "uuid": "49ba4083-b887-402e-87f9-dd818ec242c5", "comment": "Malware payload (Heodo)", "value": "876ed2c8255e5d6d723901f25098cb57e068d34d8822e2835f4584671c9a1905", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646130689, "uuid": "d396c4b0-3442-48d2-8ffe-e3a69122d73f", "comment": "Malware payload (Heodo)", "value": "ed13a521147a6f165bbd8552f4d3f9201cde1cfe", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646130689, "uuid": "76924a50-b8e7-4422-81af-936525822cc5", "comment": "Malware payload (Heodo)", "value": "1548678360471fe19687dfb5e0494320cd713daad2f2135752e87171e22c993892ca0312f4318edfadcc6248c70c9e49", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646130689, "uuid": "798485f2-f0e1-465e-b59b-5b618e1a0425", "value": "T10BD47C82F7429EF2C00B03347C32B2586BADEAD5D2158D6B9398A5AE1F35573493DE43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646130689, "uuid": "d9c62421-e0f5-4dfe-b77b-35c80a107e1e", "value": "e0b213ccd96f46d30dcd8e225f4e9fc9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646130689, "uuid": "7772c90c-c2e0-471c-8d48-f0d95e973f68", "value": "6144:XjPgWGbb0OEmS9Vzf5WI9nI1LSfcamMyhKmZHNRuIfv7YtaIIo0cm59CH7PQ:X0bEtf5WyI1LSfcTfxhstaICRLmrQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646130689, "uuid": "af1b2fba-3c35-4095-929e-c0805a1a92c8", "value": 602112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646130689, "uuid": "61906a3f-6db3-4745-a6d6-f64c19d5081a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646130689, "uuid": "08325c90-168d-43f6-8908-a056824f1867", "value": "zX2wmciln.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d488145e-9985-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646156061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646156061, "uuid": "a7944b20-0161-40bd-be56-74c1ea362416", "comment": "Malware payload (Formbook)", "value": "bf0cb315984eb9b16d492b686865661f", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646156061, "uuid": "33b67cd2-4041-43b9-acb1-2d2b96f1431c", "comment": "Malware payload (Formbook)", "value": "878da59e5989465017c84120368122aa9aefdfa32c81d90ad33e9e520e559f19", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646156061, "uuid": "ddf8c72f-49e6-4092-82bc-efae031e63bb", "comment": "Malware payload (Formbook)", "value": "45770c0b16e09ecdc0a87828784bd129b8e6db1d", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646156061, "uuid": "320980a9-3768-4dab-b010-8a0cd06da40e", "comment": "Malware payload (Formbook)", "value": "6880301d14b634761db028c9b73d625971960e09cc0854e8cd93ff4267a11b6afea2ad30d9504f66fdd3bc68ea6b03ad", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646156061, "uuid": "70c624bf-8ca8-4304-aa5b-8926f48ffd61", "value": "T1FA1412DCAA3184BAD0AF40BDC85DFA635A6AACC4D44887ADC4C13F3D85B4C56CC95D36", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646156061, "uuid": "f3d1535b-7d47-498d-acac-be2ec4be8b49", "value": "3072:vO9Rx5Sv6sbt1zG5gJzpAq0C+3uBE6ilMAb6rw0xqkZPO972Ym7TbGth:G7x5ob3zG5gJm2nE6iaAeZxJ897BmaP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646156061, "uuid": "53e19ce2-da02-4bc2-a56f-f4e2d191c59b", "value": 190440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646156061, "uuid": "4f32e33a-a448-4744-bbaa-abb4c2388576", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646156061, "uuid": "08f853d8-a745-438b-bcdb-ce5f9bff80b8", "value": "Premedion Order.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9151198c-9985-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646155948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646155948, "uuid": "07adc4fc-7291-44a6-affc-3149789fed0f", "comment": "Malware payload", "value": "5653dcffbfcd1c73df0d4aece91fcaeb", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646155948, "uuid": "31008b97-f33e-402a-adff-0034b18a1f2c", "comment": "Malware payload", "value": "87985625a3631ba720654e849dca05162c8741ef8c253ca688022ad6cefb5f67", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646155948, "uuid": "21762ca9-4e26-4109-ab26-d7674025f354", "comment": "Malware payload", "value": "4870369a9f4f4fed05c26c2a3423294a8cf65208", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646155948, "uuid": "1c78c323-dc33-49d2-8314-d23159e571cf", "comment": "Malware payload", "value": "18044294130a243bf3e1d65569378d5ec49b3877c45713bf60fa7663cbd69d36bd0e94f1a070262229539b02e60dd2f7", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646155948, "uuid": "50e6ae99-b474-4cbb-89a9-02eed482a558", "value": "T16C1402657814B53AD1D72B30FDA18BD40E39EEC952039E8A59BF3B4DF730898092586E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646155948, "uuid": "311dd17f-9b06-4737-a155-9515a70b00d8", "value": "3072:davXf9WnGCwc1KK9pWAu1VIzi/jooTOtBUo6gYlal1m7Gfkmzqvt2TEfeZnkRk5:cvmGK9pEDoiO3D6xoqvtLfVRk5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646155948, "uuid": "7f33eec9-3521-4471-aeb5-acc1328ad152", "value": 191336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646155948, "uuid": "2bf98bbc-fe7e-4bc6-b66a-baa7ddcbdea4", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646155948, "uuid": "52000f02-ef9d-4372-9c6b-f04b82b4bb58", "value": "+9053598666_1118-081312-109.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d734ba06-99ab-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646172387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646172387, "uuid": "a1110148-64f9-4061-9a4c-d109421493f0", "comment": "Malware payload", "value": "c3eaf451a2a2d1e254b8cf2d45635488", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646172387, "uuid": "be6f8858-68f8-4d09-905a-a460dd0fabf2", "comment": "Malware payload", "value": "87be2723927e6e6dd27ffb4fd1a5087aca8c7663e427913dda9d52228a18e184", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646172387, "uuid": "0c1b343b-73fe-4c20-8bf3-aa20566b84cd", "comment": "Malware payload", "value": "5f6a940122def932158f598305c6adcd6d2ecd2a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646172387, "uuid": "c793c85f-1e95-452a-bda4-39a6b1ea4b57", "comment": "Malware payload", "value": "e9f89f3047331b6c95c27fde63ac7e37aede93192624f9f07287c536a1e645e4f750846e27d94e79d5d0872110668b50", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646172387, "uuid": "61febb06-0cb6-4edf-9e16-d853bbe20014", "value": "T127B4AE11B7D0C072C26A35342926E7B656EEBC719AF583876FD03B7E5E301D18A2835B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646172387, "uuid": "26e4bdac-3db8-4f5c-a5db-5bc3b0758895", "value": "d02245ac5c961d83d0907c826d8ba5c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646172387, "uuid": "ee760e5b-54fd-4210-a3db-e109c75603f3", "value": "12288:JhC1q3aXOwkiPs2iCtyjsOAIlgOkar//wJY8Itgm:Jgq3aFkiPs25as2Bkm8jm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646172387, "uuid": "37300b73-5ff6-4114-84cd-1288bff79f48", "value": 499712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646172387, "uuid": "ffd1295d-98c6-4c6f-92b5-8ef9adc10c1f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646172387, "uuid": "ac5c5a2f-a9a9-4489-8980-8e3bb0b11b12", "value": "c3eaf451a2a2d1e254b8cf2d45635488", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3c70153-99b1-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646174958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646174958, "uuid": "b85fb6b2-cd15-4711-bb52-5a6b1b126100", "comment": "Malware payload", "value": "f54dedb6afa2063384a0f11105cd256b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646174958, "uuid": "d10602ae-5456-4edf-8f85-25036e764e6b", "comment": "Malware payload", "value": "87d42e0b5a727ee50d7046549995701deeedc6186ca91e7665a71c5c91fca466", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646174958, "uuid": "d5faf236-8973-418b-a0f5-26c68c3d5411", "comment": "Malware payload", "value": "228b15eb81277de4002b0728ba58b2336c9292be", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646174958, "uuid": "a0484002-fe1d-4d02-bd2e-5de994d245d1", "comment": "Malware payload", "value": "5c198642f561cd77875f49da9795ba273a7cf405ff6ce36a7763fd2f2b4f03496cb1f53448b7a75510b68bbc866e5f2a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646174958, "uuid": "511b7e63-a732-48f7-a5ba-9d49b2d55313", "value": "T150B4AE11B7D0C072C26A35342926E7B656EEBC719AF583876FD03B7E5E301D18A2835B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646174958, "uuid": "a5f3f5e4-4904-4e8f-95ab-255ca038a46a", "value": "d02245ac5c961d83d0907c826d8ba5c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646174958, "uuid": "1a6d0f0c-5107-43e6-a7ef-8630473d3327", "value": "12288:JhC1q3aXOwkiPs2iCtyjeOAIlgOkar//wJY8Itgm:Jgq3aFkiPs25ae2Bkm8jm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646174958, "uuid": "35ac6540-f284-4b4c-b86c-562bc77e038c", "value": 499712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646174958, "uuid": "aaab884f-dd07-40d7-94cb-76807b32246a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646174958, "uuid": "90c90836-6ec1-4941-b8c9-03ffdb0afdd7", "value": "f54dedb6afa2063384a0f11105cd256b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7875d48-9956-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646135799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646135799, "uuid": "6b7c3ccc-b164-4039-ac31-0e8b280401be", "comment": "Malware payload (Formbook)", "value": "0c59e39f0471cb94b2fcbea25ff3bd48", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646135799, "uuid": "3780de7f-e9e6-4250-b778-7ce5e2023471", "comment": "Malware payload (Formbook)", "value": "8835f1b054292518021c1af86499d45e5e7f232038155822d291d476a8447c7e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646135799, "uuid": "966715fc-b413-40bc-b529-cd2c159ff8df", "comment": "Malware payload (Formbook)", "value": "04639db96b295bbdf6c892e076f1a614b588e2d9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646135799, "uuid": "ac376490-95f4-42f1-8d06-7a74d6f001d9", "comment": "Malware payload (Formbook)", "value": "7a6a92dc855a7eab2013d206a2391c876c03bfebc5ff75eea978dd9b4da340e6b7f9c6308a6372b6f1b281f5136174f2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646135799, "uuid": "547356b4-581e-4744-ad49-742bc90b8ba5", "value": "T1D0742302F2D9CDBBE15145790BB287EDEFB1E1891F722817036D4E7CAC529934A296C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646135799, "uuid": "a657a5cf-303f-4615-91fb-2da1356c7ff3", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646135799, "uuid": "85e511ea-babd-4555-9855-1fb942299ea3", "value": "6144:rGic1uSFrmsZsI8l+d2oeWk0xDgLXZTYAWHi+CBInXi7E+Fa4gcEsDF/:CuWrmsqdzWTcFTCTbME+8cvJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646135799, "uuid": "eca43417-9473-4b6a-851e-d725d30395a0", "value": 341620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646135799, "uuid": "a6eb94d5-84a8-4b78-aeff-4e9f3f6bd113", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646135799, "uuid": "37dbde3a-e7c8-4706-ad82-b0978d4b1e76", "value": "Q45319.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2da2b666-995f-11ec-9275-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1646139460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646139460, "uuid": "c3bf5c26-c482-4ba1-9534-7f7deef8b6c9", "comment": "Malware payload (Quakbot)", "value": "a1a07f422d760705b40dd6dafeca00f5", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false }, { "name": "ZW6465", "colour": "#C4CEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646139460, "uuid": "117b4936-0bc7-44da-b986-9602e366c8bb", "comment": "Malware payload (Quakbot)", "value": "8895c0736eeabc711ad0316c6a42e3f158843cab7275be0f55ef62b9e3d5c57b", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false }, { "name": "ZW6465", "colour": "#C4CEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646139460, "uuid": "fd22f8e2-ed43-47dd-b3c9-478da894d523", "comment": "Malware payload (Quakbot)", "value": "c2d5c9ed61aa50f05841aa5ea3ac7df4d1b0b062", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false }, { "name": "ZW6465", "colour": "#C4CEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646139460, "uuid": "7b3bde8c-4a00-4159-8564-0852cb8086f9", "comment": "Malware payload (Quakbot)", "value": "d833638565052d1cff2361b304320976b5ae190e1dad75e6b163783002ef7dfbeb645a0afe0dfe29cd43caf8c9edea78", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false }, { "name": "ZW6465", "colour": "#C4CEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646139460, "uuid": "4aa0c33a-0033-448d-88b0-426acdf3cec0", "value": "T1E6440200B821A171CB35B97D61F2471202C11F15BB21C9C9336EADECAFB6DE72B959C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646139460, "uuid": "d04ee0c7-ee98-4d2f-b4fd-797881cbd0f8", "value": "6144:ijXuwmXNnZKKH4goy/pIGw7w/b1T/oJrjafmH3n0S:ijXWXNMKuy/aG6w/bp+iI3n0S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646139460, "uuid": "ce1b14fd-bf14-4c34-aa0c-e4f7b1267719", "value": 268457, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646139460, "uuid": "812a170d-fb9c-44cc-bc84-ac143f05d337", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646139460, "uuid": "55bc621d-ee9f-4cff-bcd0-fe7ef3c624cd", "value": "rroarbe.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "390ba85a-995d-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646138620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646138620, "uuid": "f970c958-5a60-4d69-ae43-db1c10813a6e", "comment": "Malware payload (Formbook)", "value": "9a7d3f627cdeb801915f45546dd1c92d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646138620, "uuid": "373f3b30-4c2e-4ab1-a241-4802577496ff", "comment": "Malware payload (Formbook)", "value": "88bb642fa9f97d5046c53bad86bb3ccc0bfa0c4f98b10e2c11c30f48254afbb3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646138620, "uuid": "0d2352b9-d0d5-4672-8045-839be6c3fc8c", "comment": "Malware payload (Formbook)", "value": "dc19505e5e549befe4a911e000f6c383af73c542", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646138620, "uuid": "192eca75-9c43-4297-836a-a9df5a15e203", "comment": "Malware payload (Formbook)", "value": "4177a6b338d4fd108bf670a2fc928f90969321af464a9319da9a4e991b4fb5797597aacb3675ad3be9d647733adf4d68", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646138620, "uuid": "ce448e4c-4000-465c-aefa-68d1635541b9", "value": "T1862512082368872EFDFF43B1F46900218BF5BD177A99D76CAE40A49C3873B90E651967", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646138620, "uuid": "536d161c-8d20-49d5-8b51-5847b1b3c3c4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646138620, "uuid": "845910e7-0324-49bf-bd5b-772e40bb2ff2", "value": "24576:7PCWyuLkdNQWigkpJY+IHERDUl98v3/j17/UYYN6SE0FPb:m1uLkvfigknY+lRDf/h7/U7db", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646138620, "uuid": "90685f7b-8c8b-412e-b8eb-538d89796b8b", "value": 985600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646138620, "uuid": "f0f50809-8d91-41c3-b086-53f3e7d76b03", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646138620, "uuid": "eed9e927-e1ac-4ee7-8ff4-e3301c80f8c7", "value": "Artisan_20221003,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a010c790-9956-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646135787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646135787, "uuid": "a614bbb0-a5fc-424f-90a0-08a749544728", "comment": "Malware payload (AgentTesla)", "value": "11c058c413549ebf4715798ac5412858", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646135787, "uuid": "38b9dfe8-6208-43b4-a4ce-3049b1ea2674", "comment": "Malware payload (AgentTesla)", "value": "88d2c7a6aa1b551356f3a3408435a288c8197bd80825af341849d91f4bc2f088", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646135787, "uuid": "b1666a29-ac24-4365-950b-822520cb84dd", "comment": "Malware payload (AgentTesla)", "value": "e78748fc01119ba396b0ef733a5ac53cbe843740", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646135787, "uuid": "9c003137-21ff-4044-9af5-3d6f39c4defd", "comment": "Malware payload (AgentTesla)", "value": "a606868f79b0baee83a07bac83323a8d78b8da6e75a2faf3629c5807e1ba5297adff5f22869483022a681f4836240c22", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646135787, "uuid": "19731361-2f4e-4399-9104-05b6b1a11ffc", "value": "T1D044126924E888BFE6574B306A7177EAD7F342361752003BA7D91F2CDF161C39920AC5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646135787, "uuid": "9adc4a4f-fe81-45bc-91d5-5af97a2b9d66", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646135787, "uuid": "e95ea8e3-bda0-45a6-9d9f-148d18c9988f", "value": "6144:9xDLKoQVKz4l123aCNj3XrbF8+xGgPsTBG1Ckg9cDuwd5C:H7/47eaCNj3X18+QSsT89nC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646135787, "uuid": "395ac8cc-e42b-4c4f-982b-212089a81463", "value": 272603, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646135787, "uuid": "f2e76381-9ac0-4c87-906f-dd0fce14f7eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646135787, "uuid": "e7c7af7e-3930-411c-84be-cda327f459d0", "value": "New Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5b0a540-9984-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646155687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646155687, "uuid": "3c037430-3921-4418-89b2-66946cb30e2e", "comment": "Malware payload (Heodo)", "value": "bb61825f072ecc21121186314c481ac4", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646155687, "uuid": "f3a4c161-986e-42ee-8029-d7b11c3260b6", "comment": "Malware payload (Heodo)", "value": "8913ee70481a3f4b18ae5504e9009a1dc6c8991f9631e33599633fd6427d1360", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646155687, "uuid": "ea08955d-08b1-43a5-96cc-2d5579639bac", "comment": "Malware payload (Heodo)", "value": "e55966f69e6525532c62688c956a8683d45ecfd8", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646155687, "uuid": "d355b418-d3ee-44e7-b378-4ad6bf8c7d02", "comment": "Malware payload (Heodo)", "value": "06271730e54b7487464933b499b61081f5e626841486b81865481f591f883bcadb94130eaeaffce0070adcea2fd34c12", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646155687, "uuid": "1ce6b056-bc45-4aae-b1e7-62c8fa241df6", "value": "T18523E129C1606828C73D8C759200E6A3720A7901D9D5FB893586BB1C3B96FEB53AF5CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646155687, "uuid": "4bfdf119-ffe7-457c-b38b-14e90dc25ae7", "value": "768:2yMo9DOevZCwrvtE9WzdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Uh0VP9HW:HMo9D88tT5fTR4Lh1NisFYBc3cr+UqVk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646155687, "uuid": "65e437c7-03da-4954-a887-c1608591c277", "value": 47703, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646155687, "uuid": "e69b9e56-1be4-4d70-9dd1-0bcdf2eb7e49", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646155687, "uuid": "04876299-edb4-43a4-9e5a-88a9713491f1", "value": "504-9739510373.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b1c42e9-996f-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646146328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646146328, "uuid": "b9f91150-9c1e-482a-861b-e6e112ebdc53", "comment": "Malware payload (Heodo)", "value": "7459b6e00cb9ca0408b302b3794940f3", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646146328, "uuid": "220fa59b-fc16-4e84-81b1-0cfe3183b3f6", "comment": "Malware payload (Heodo)", "value": "8921a44d21a0861335ab8d21e8a2094bbc26a365cb2b461dfa637866ce73c1df", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646146328, "uuid": "5bc6e664-d17f-4205-a696-d69965026b8b", "comment": "Malware payload (Heodo)", "value": "98d2bfac5b67eb5cd3839c2f2b5f26f911c8e128", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646146328, "uuid": "f8cf1571-5dfc-46a7-9aff-da600a57f222", "comment": "Malware payload (Heodo)", "value": "5331d88816888fb9937b6a9c7770271cba008715b773cb83ddd5f6e6a46461907038d87abea81f1c1ad9040b2604320f", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646146328, "uuid": "e996fdea-6f95-41df-b727-51f52221adb3", "value": "T1C213E029C4961A9DD737293DD6148EF4124C0E4A96A0FD8F1D44A3AC276A1FB0B4FCB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646146328, "uuid": "62c8a7d3-3ca7-4cb6-8fdd-f0246d17e29e", "value": "768:vomihd8DOevZCwt79yKfcrND59V+L9Rw4eWrXcTqZ0VfEw/5:vom8eDNylND59V4jwmXc2CVfEA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646146328, "uuid": "1d8c84a5-635d-4723-a734-46a727cd6aa6", "value": 41813, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646146328, "uuid": "b190803e-241c-453c-908c-3571b5565b63", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646146328, "uuid": "583ea64b-0d68-46d6-89ee-befdae270034", "value": "INFO-8084.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8fef607-9932-11ec-9275-42010a9c0029", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1646120394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120394, "uuid": "4cd71373-a5ae-45ee-9de9-2f0ed23bae4c", "comment": "Malware payload (AveMariaRAT)", "value": "c6a7f482e0a796c802619a36824bc1bd", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120394, "uuid": "cf275cf6-3157-46c6-9222-0247109105e4", "comment": "Malware payload (AveMariaRAT)", "value": "892597399a743fcd05f4e0f6f3f97b3133b8ede796ca2270b7589d6c8f88c499", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120394, "uuid": "0a2e24d4-6247-4f76-8c0c-2569b40bf88c", "comment": "Malware payload (AveMariaRAT)", "value": "0799096a238701c6f062d0c5d099fa6fd0d034ce", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120394, "uuid": "a2416407-58f6-4efc-b9fa-918b1d7464a0", "comment": "Malware payload (AveMariaRAT)", "value": "9dc8343253eb3dbdf16ae8ebaaf2bb364e6d3c39a7d704974555ef7cd07c42170f93b4906da2077b13360d51e7dcc0a8", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120394, "uuid": "ddd7fcf8-f5e6-4266-81df-8b66207f36fa", "value": "T1925435A0682F0976E748BD0E50E1704A1DF6FEAAB0C19732539FA964DFD46F18EC0857", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120394, "uuid": "8ccdb3c3-720a-4db5-81ce-88496a844f5b", "value": "3072:iGe9uXcR06QRQe9uXcR06QRQe9uXcR06QRQe9uXcRZRNbjv5dzFtr5RDAw5wfQ:ZnxdzFt1RDAUwI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646120394, "uuid": "c1ae513f-a300-45d5-aecc-35c4c9d83abd", "value": 293060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646120394, "uuid": "e40f09fb-5b8a-43d6-8474-a6af11405529", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120394, "uuid": "3f921bf5-9890-4cb4-bb89-5cf2e5a10b05", "value": "EX775713397740.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71fbf731-9933-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646120677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120677, "uuid": "09d81fc5-4f2f-4255-bcd7-6645ef884eeb", "comment": "Malware payload (Formbook)", "value": "bf32de73ff0533bd89845e1428e693aa", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120677, "uuid": "4aef3069-5e49-4fdd-b329-c6123dbe440b", "comment": "Malware payload (Formbook)", "value": "89695131fcc1a65998cbd4bcab26f9bb4a04a31da882501def4aa89d6df3dffb", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120677, "uuid": "fd901422-d66a-4b55-a434-0a23ec8ea0d6", "comment": "Malware payload (Formbook)", "value": "ef17af9a7aab2e9898d190c4a6b7d90cb1a0e3e8", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120677, "uuid": "fbbe814a-d04d-43f1-9288-013bb7f72aff", "comment": "Malware payload (Formbook)", "value": "56bb80558e0ffd51b71bd65dfc3d3a5c09cfd98bee781d03523b3ca744ccb4eaeb2a4b09e1ca3db7cb7b73a45ce69690", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120677, "uuid": "9043cfd9-cc04-46e2-8ef7-14c594111119", "value": "T1D214129B7684593DE7EFAA3046F19996340E4CB74220CE17ECCA378ED6B09440ED52A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120677, "uuid": "f452cae9-10bd-45e2-bae6-692492e8da85", "value": "3072:eHGpFXTi3VGXt64ORdjhHueBgs5rhZ1cYRXKT5QzydeCo4WsZ5CIOWNuMImL:FpFXUVY04gdtjh9R6TKwm4WMCtWNxD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646120677, "uuid": "b33490b8-77d2-44b8-b443-83f830e69bfe", "value": 190616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646120677, "uuid": "048db91a-64b9-43fc-a3b4-8e4d6ece7a81", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120677, "uuid": "506a9a6c-d8b9-43a8-a754-769cdd92dd76", "value": "Enquiry 220062 Krause K + K Modustrebinje.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c12c9972-9989-11ec-9275-42010a9c0029", "comment": "Malware payload (AsyncRAT)", "timestamp": 1646157747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646157747, "uuid": "4a835477-c801-43d9-990f-917c2829c003", "comment": "Malware payload (AsyncRAT)", "value": "53c6b343d652c822d90ec3bbc8c16c76", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646157747, "uuid": "3a0e838f-3606-4e84-98f3-4fe32b209b7c", "comment": "Malware payload (AsyncRAT)", "value": "8b38234bb9f08443a05ab626ef0a38ccee43b302a81b8127cba39a39972b5eca", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646157747, "uuid": "2502df17-972e-44bd-bece-3fead589f412", "comment": "Malware payload (AsyncRAT)", "value": "2c0ebfb62b4302788a90c9af9280bf4b3275ef79", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646157747, "uuid": "0be637ad-9563-4afa-a8e3-146eba46f91a", "comment": "Malware payload (AsyncRAT)", "value": "14111220f78e780b58e46e9ff17648b3e34f4c593660b8120e17300a33746b9d81933977b732261d46a8daa88f12e516", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646157747, "uuid": "e2a9f1a5-f551-45f3-914c-c9f4617ead39", "value": "T1E574E19E4BC6C692EA9452BEC9F337F52B30CCA4E026865785663C1839737B97F805D0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646157747, "uuid": "0be6b644-41ac-4b25-a211-491dd0d8c55b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646157747, "uuid": "5e08ef04-731f-4f04-8072-f88fef2d0505", "value": "6144:4enEl0uEopZ2WUzMlQZ4KMXqjGoHvmi0fiklLnoiRXyXesKwBP/DGDMDSj:nnq0uZZreAqqnLnoOUesrPrGS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646157747, "uuid": "2b80ba49-9218-455f-8423-a4c9a5bf95ca", "value": 342016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646157747, "uuid": "6ca6f24d-7b22-43a6-86ce-e8bbbe582888", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646157747, "uuid": "25dac408-cf60-4d9f-a7ad-9ac81f6af8b9", "value": "53c6b343d652c822d90ec3bbc8c16c76", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1d80540-9957-11ec-9275-42010a9c0029", "comment": "Malware payload (LockBit)", "timestamp": 1646136246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646136246, "uuid": "a41736a9-dd1e-425d-9819-d825f62cf801", "comment": "Malware payload (LockBit)", "value": "28fefa4d1c1b17ee1deccb43ccf918c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646136246, "uuid": "d7d24396-85a6-4191-a03f-acb63849351d", "comment": "Malware payload (LockBit)", "value": "8b3d44f099888635fc995a5362159bbec7da1954eaa2fed7ba41650447cf2277", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646136246, "uuid": "e9476d40-e6b8-4988-9ded-08f9366eea48", "comment": "Malware payload (LockBit)", "value": "eef5e40a538cc7b077c4d5e24d6820852b3869e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646136246, "uuid": "92d59dfc-f7a0-424b-bd02-43da4e84c7ce", "comment": "Malware payload (LockBit)", "value": "c9ccbf14b5e5a7a23810d7e8b0d042b7ea4554ed37264bb13ca430b0793e2d1110d32c38de616b75181b34e45482d6e1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646136246, "uuid": "19ab9dfe-dfcc-4780-b7b2-0e51690cd7d9", "value": "T198253A0593018F96C813207951FE8DB3A877073192BF1CE6A78466DC83B2FA5776B366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646136246, "uuid": "9d797f19-d63e-4512-b93f-7d19b1dbc3aa", "value": "216df81b1ef7bc2aa8ec52bbeef137c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646136246, "uuid": "445e1b4a-7c82-4252-a5ed-2ec18efc57c6", "value": "24576:uLjr3s2nScu1i1tz3f++5kRzFxk7rMxNeR1R9qpdtF:Ujrc2So1Ff+B3k796n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646136246, "uuid": "84465881-d250-4c50-a037-4e4bdabae839", "value": 982528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646136246, "uuid": "15f35f95-9003-491c-a0b3-2eddbb432206", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646136246, "uuid": "ee29694d-5324-4f84-959e-de796fc46a84", "value": "8b3d44f099888635fc995a5362159bbec7da1954eaa2fed7ba41650447cf2277", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c1a8f68-9937-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646122251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646122251, "uuid": "c1a1933f-c9b5-46ea-b119-2a155cb3b4c5", "comment": "Malware payload (Formbook)", "value": "e41b3d0f25d582205941108e2b0d1efb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646122251, "uuid": "b4cb25fe-f1c8-4a44-a4f7-8e843026a0b4", "comment": "Malware payload (Formbook)", "value": "8bc02da97643547d5839c46725fdde87308623dbdd1e479d8f7e76c7405ac5f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646122251, "uuid": "ed7436a5-5d31-4396-9f1b-8fcdd2a696ee", "comment": "Malware payload (Formbook)", "value": "2ce363236829eef6c03e79465b0f3b6b25a113f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646122251, "uuid": "3a054c08-ebfd-4b53-a0fb-9fb42dc9551e", "comment": "Malware payload (Formbook)", "value": "d2426d40164c8daa7c3130052c70988eac64245567c27e5fecdbd8abc34645f38351e24fade14e11f5d938ae0a6556ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646122251, "uuid": "50a52f2b-7d6e-487a-ae93-422e763573ce", "value": "T1A07423926F40C4B7E4D51DB112B69ABCD2F962DE106A18071BC05FBF2E602E1C65DE3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646122251, "uuid": "d0111b31-2309-4946-af9d-50acd12780e2", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646122251, "uuid": "34426fbe-9d93-414e-b0d2-d9182ad28027", "value": "6144:rGiAmColJHhOCrtQFe3AwT6Sm4Wd4QDWhiV2kP4r3fnN8Fkx2uWBfrNDxH:kmNlJBOS4M6Pd4QDWA2kP+P/x1UpxH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646122251, "uuid": "a2dc0a9b-0720-489a-a548-759a45fc9f42", "value": 339192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646122251, "uuid": "d00d2009-a8de-43a6-9837-eb2660542666", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646122251, "uuid": "1e10ae99-5b37-493c-b835-aeeebf2f2b94", "value": "e-dekont.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12716ce0-99a6-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646169909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646169909, "uuid": "6f03b3e8-1f76-4f43-a6ea-ed0340215713", "comment": "Malware payload", "value": "b2ee4b6cd2f861f7ef19941abc86e656", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646169909, "uuid": "2b356ac2-4eba-4b20-af77-2e944195fbfc", "comment": "Malware payload", "value": "8c0f4ae3dadcc207ffa5bbce9cfce86abbd86d34a803ea441bfc915f93902089", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646169909, "uuid": "d76cfd1e-eb51-42ac-b5ba-cda332b1776e", "comment": "Malware payload", "value": "b144f69fa12ac5d54a3a60e3f403e8639fbc8547", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646169909, "uuid": "ea9b5ad8-e99a-4580-8f28-26994bbd92ab", "comment": "Malware payload", "value": "410aefe4be9eebc03927fb2d3e2127766d70b4a0b67f46797729779d71edf8fa37fd285010458f7a84d27ceca172ebb7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646169909, "uuid": "8c253230-d682-4508-970b-0a25c1ea68fd", "value": "T1A6D4D0753B881BA4D13D5774013484D027F5A94AEB22DB1F3DE602AC1FA2E669B33793", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646169909, "uuid": "a5450dbb-3e9d-41aa-80ea-781e5f7dd9f1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646169909, "uuid": "f1b4249c-e4ab-43e0-b1d5-79eeda368436", "value": "12288:FKXhcOG4Q051mQ5dhQyKt/4pMwejU+63:mrG4QRKdr4GMwE63", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646169909, "uuid": "c16a0c85-507f-4541-bf05-a00b3642fa63", "value": 655360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646169909, "uuid": "c46a383e-3157-4bf9-b996-e17de810d65f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646169909, "uuid": "f670773f-11b9-4ad7-954e-d6a32f5a05c8", "value": "b2ee4b6cd2f861f7ef19941abc86e656", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a9eee8f-9956-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646135778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646135778, "uuid": "fa687c4c-a240-4965-be5a-0e164a1051c1", "comment": "Malware payload (Formbook)", "value": "128c3759e5c86a80ac220a702f92e709", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646135778, "uuid": "771a36b5-a4e6-47e3-9b88-b45ec9ba8a89", "comment": "Malware payload (Formbook)", "value": "8c164f84fd80c7fcaa87f60f8cc37289dc2670b87a014469416cd7ab6e699691", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646135778, "uuid": "eaa369e9-c1c2-40cf-bbad-31fa265e0757", "comment": "Malware payload (Formbook)", "value": "ad5f4504cf9c6234f3679517a52f63fd5f9dab0c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646135778, "uuid": "d80b59b5-d264-4cf7-aeec-1657ab3e15e3", "comment": "Malware payload (Formbook)", "value": "2ed36a5afd3203445bbf9fe5162cd27bd1fb10ad089b5320478edd83a161b3adb22907cc4fdc09fad8c556861892ff3d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646135778, "uuid": "218b6523-519e-410a-9f82-6f381dfa0a0a", "value": "T1DF05CF4839AB5F3DF5B19BB20DC0ECB4BA99FB331C08B3BD78516256C661B409842677", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646135778, "uuid": "3eb884fd-576d-479e-8ddb-67beed02823f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646135778, "uuid": "e777d268-c326-44e1-9f83-e9bca412a8ee", "value": "24576:pK777777777777gY9lJ1dPG5hoGgRMUwu93bL0gH:g777777777777rQ5Xgsk3bLjH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646135778, "uuid": "f98961b0-8be4-4c8f-bf90-6675d5928a0b", "value": 803328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646135778, "uuid": "1a28a9a9-e302-436c-8aec-08c040eaea59", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646135778, "uuid": "82fd72b4-c186-467c-8f94-d349f9a62a70", "value": "8wmHXR7KEFYYJXL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ad52cdd-9901-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1646099190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646099190, "uuid": "0fa2f812-87af-4ef0-93d4-bec7ede8c5ef", "comment": "Malware payload (Loki)", "value": "d5ad42d32af9c05ff50165ad8778cf15", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646099190, "uuid": "4e8cf5d7-84be-4b6f-8b0d-b9e2a463e49f", "comment": "Malware payload (Loki)", "value": "8c4a31342df6ff294593054eef07264ffd3e44f4daed25199b1fd1df92d4ff2f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646099190, "uuid": "caf425ed-db01-4d33-a058-8e6cf63cd64f", "comment": "Malware payload (Loki)", "value": "aaec60509f5e23aa11bb518bf9c7475d0e369917", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646099190, "uuid": "2dc15b2a-de31-4848-a1c8-c77c67979798", "comment": "Malware payload (Loki)", "value": "2d251c112bd559598e307e1bd916588d0dc4096ee47481d7dff7ef2782d94b5c5c44de959e6614f83b755ce3873bb58e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646099190, "uuid": "7db8fd5e-04e0-4507-97e8-f55b4b6fe72e", "value": "T124642303B9C1E953C96D9BF215738FB0BE7DC7C242268E978750AF0A385F2532A205B5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646099190, "uuid": "ab10ee19-b799-4b44-82b6-ce9f6f31c735", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646099190, "uuid": "ba7f6c17-f7ed-4291-9b36-2b581d8fc6ee", "value": "6144:rGiA23o2D8iElsvf8j28kYqp9sNMC0c36y7lSk9bziSNw7keBWoexIEFi:U/BihX8jhkY66zFK4ZziEw7P9QIEFi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646099190, "uuid": "cd8c85a8-4ee0-46f9-92b4-5d78774c297e", "value": 313480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646099190, "uuid": "eb0414f7-1705-4c1a-b19e-70addbeebcd5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646099190, "uuid": "a2f529ee-d721-47a6-9539-e40aef24e610", "value": "PAYMENTCHEQUE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c16d6cfe-9937-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646122528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646122528, "uuid": "d6e97767-056b-44de-9224-1639f3c1bd61", "comment": "Malware payload", "value": "1a19bed249e54fe6ed84cab37c6c5095", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646122528, "uuid": "dc5472d8-9e58-4f06-b1ca-75af693cc226", "comment": "Malware payload", "value": "8cadeb76415443a10004494486e0ec0dec75ac26ba6806fb0c8a9db0f66f4907", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646122528, "uuid": "629e491f-ff9d-4c5e-a15c-d44aadbbe0cd", "comment": "Malware payload", "value": "f33556bdbeb86f45c234b2dbabad8fcf40892fdb", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646122528, "uuid": "3c106426-3973-4602-91a0-8f734665341c", "comment": "Malware payload", "value": "fff6cc5e9f17a273231c07be6fc3a66480000824187b49c2cdace2e76638a872ff8c3b38369b8482aa7f7449f29db165", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646122528, "uuid": "eade04ca-595c-471e-9fef-1615cf8c9a26", "value": "T178F56B23B244B53FC06B1A3A5537E25C9D3BB77566229D1B57F4088C8F366802B3E64B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646122528, "uuid": "4ded06b6-f8b8-4e2c-b22d-2b246d384fc4", "value": "49152:Yxfp8PZskrFWwddauSOSeDbOds0aNZouTVNarDCGPBwDOYLEA:gp8PZN0igfrWnOYAA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646122528, "uuid": "25e1e129-9106-405b-8ffa-8d01476bcb46", "value": 3388416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646122528, "uuid": "c3548cee-4831-4bd9-8550-aab85e700c09", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646122528, "uuid": "46cbdcd5-c0df-4c0a-a154-6a6063d8d8c6", "value": "NFS.IplaceDanfe2802.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "062b2444-99b3-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646175472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646175472, "uuid": "7d2e44bc-c96e-482d-97e4-3bf7195b1791", "comment": "Malware payload", "value": "dc2d4cec94e456055a4968aac89503d9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646175472, "uuid": "923ecb22-3d13-441b-8a74-bf0f83061038", "comment": "Malware payload", "value": "8d21adc1f07c80566794e4bd86e82c63fa79edf1ad9a0523bd0559ead2f09863", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646175472, "uuid": "d38a7965-ec9a-430e-987e-99db25dfcc2a", "comment": "Malware payload", "value": "cd5d56773c6f53b15425dfb7d719b08dea89e28d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646175472, "uuid": "d95a31ac-7ee8-44fe-9eed-0c1b8b64ee66", "comment": "Malware payload", "value": "8ef8499ee553d7322afc0ff552b5739a62de752d3d63100a02f99874265a5da7654b679d417fc129bf3078e1657d57dc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646175472, "uuid": "7a4b2fce-e3bd-43e5-802f-d663daf3456b", "value": "T1F0B4AE11B7D0C072C26A35342926E7B656EEBC719AF583876FD03B7E5E301D18A2835B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646175472, "uuid": "dd82aaa6-e2ee-47f6-bf3b-bff7cd5a6b6e", "value": "d02245ac5c961d83d0907c826d8ba5c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646175472, "uuid": "3941f75b-28f1-4d01-997a-659e12b9d34f", "value": "12288:JhC1q3aXOwkiPs2iCtyj5OAIlgOkar//wJY8Itgm:Jgq3aFkiPs25a52Bkm8jm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646175472, "uuid": "1bd64781-53eb-416c-90ab-002818d7fbc7", "value": 499712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646175472, "uuid": "537383e3-c403-4492-b467-7f22ab42de49", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646175472, "uuid": "66a9ae26-d70c-40d1-84bd-e7d409c9799d", "value": "dc2d4cec94e456055a4968aac89503d9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65f86c69-9958-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646136548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646136548, "uuid": "4f95b425-f370-4b0c-995a-18bb7f422083", "comment": "Malware payload", "value": "79df0eabbf2895e4e2dae15a4772868c", "object_relation": "md5", "Tag": [ { "name": "Daxin", "colour": "#652B35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646136548, "uuid": "28a20d09-0098-4ff4-9f99-af5559157602", "comment": "Malware payload", "value": "8d9a2363b757d3f127b9c6ed8f7b8b018e652369bc070aa3500b3a978feaa6ce", "object_relation": "sha256", "Tag": [ { "name": "Daxin", "colour": "#652B35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646136548, "uuid": "75339c0d-fe78-4ce1-b5de-7f3fdf9192d0", "comment": "Malware payload", "value": "d02403f85be6f243054395a873b41ef8a17ea279", "object_relation": "sha1", "Tag": [ { "name": "Daxin", "colour": "#652B35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646136548, "uuid": "b1ea5529-9ea6-4f1d-9dba-a8c8e97c731c", "comment": "Malware payload", "value": "341fac5a876d324bcf2154f5549b930fc3d1e8b4efaf72e13604ab735624b6c76ab8a2b748c0df5ce7ae8349805feef6", "object_relation": "sha3-384", "Tag": [ { "name": "Daxin", "colour": "#652B35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646136548, "uuid": "355f90a7-0b58-490a-8f0e-d7f2281d90d5", "value": "T1A9636CCA22A41079D4BBC27DC9A1963FE7F2745113600BCF826147EA2F13BE5A739325", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646136548, "uuid": "140f5434-f399-47e7-b85f-e86761b25c6b", "value": "c32d9a9af7f702814e1368c689877f3a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646136548, "uuid": "629d56e2-05be-4987-9e1b-2e15cc424939", "value": "1536:ARM1VWgS1lYpKCNTzc8jt4riPJdBnH2dXDGZ838tGVxJ:AhgUup7NQiP9H2dz08ssVxJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646136548, "uuid": "203de0a3-f7be-440f-913a-ae575695dd55", "value": 72272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646136548, "uuid": "5feef246-69d1-4a05-b00a-94d2a8ce2bd0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646136548, "uuid": "3d227d21-f9b8-4f8d-97ed-564a9d51b852", "value": "8d9a2363b757d3f127b9c6ed8f7b8b018e652369bc070aa3500b3a978feaa6ce", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "567fb852-9958-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646136522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646136522, "uuid": "952f4295-7e27-4a7e-b413-530ce90227d0", "comment": "Malware payload", "value": "491aec2249ad8e2020f9f9b559ab68a8", "object_relation": "md5", "Tag": [ { "name": "Daxin", "colour": "#652B35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646136522, "uuid": "223a2014-1308-402e-ad9a-668c3c321f39", "comment": "Malware payload", "value": "8dafe5f3d0527b66f6857559e3c81872699003e0f2ffda9202a1b5e29db2002e", "object_relation": "sha256", "Tag": [ { "name": "Daxin", "colour": "#652B35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646136522, "uuid": "569976dc-bd6d-4cbb-b96f-49cc38f4c450", "comment": "Malware payload", "value": "8692274681e8d10c26ddf2b993f31974b04f5bf0", "object_relation": "sha1", "Tag": [ { "name": "Daxin", "colour": "#652B35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646136522, "uuid": "e21db117-49e1-4092-b99b-b5413e63f59a", "comment": "Malware payload", "value": "da104555ff389075f458fcced063f2169ac8e93997c031d68dc7fa4093304e7ecf5bf6a0d63e8d89025cf50a72ca22c3", "object_relation": "sha3-384", "Tag": [ { "name": "Daxin", "colour": "#652B35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646136522, "uuid": "d5b17e48-49ec-4198-8663-eefb3adc2eff", "value": "T14E535C00E240663DF9FB00F2DEF6666A261E9721530518CB26DC6C997B6E6D27F304DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646136522, "uuid": "20522b8c-9246-4bf0-a80c-652c838cc866", "value": "ea37e43ffc7cfcba181c5cff37a9be1f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646136522, "uuid": "47cfd45d-8636-4f8a-9720-b16e17f5e1bb", "value": "1536:b9M1+VhfVezgZ/mwtpkejfOv8ShmGRmC:b9MMey/mwnkIfOvrmi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646136522, "uuid": "d7e55bd2-aa37-4c31-ba7d-f350a4c39339", "value": 60928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646136522, "uuid": "4d76a87b-f17d-4b97-a094-2292aaaf1dbc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646136522, "uuid": "175b83f6-5b22-40f9-9c37-319003157242", "value": "8dafe5f3d0527b66f6857559e3c81872699003e0f2ffda9202a1b5e29db2002e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfca33e9-9985-11ec-9275-42010a9c0029", "comment": "Malware payload (njrat)", "timestamp": 1646156026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646156026, "uuid": "406b729c-df18-4ed2-97ec-2b63be613d94", "comment": "Malware payload (njrat)", "value": "40923027d8996312a54a8c610ad99e2a", "object_relation": "md5", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646156026, "uuid": "cd761626-17a9-43ea-9dcb-ea08238ef555", "comment": "Malware payload (njrat)", "value": "8e3e9e8304ba72a172b5f023d73117542869e2b277698a1b14e0296331c23e96", "object_relation": "sha256", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646156026, "uuid": "090d66a5-1d44-4463-a0a7-eef6aa229e5b", "comment": "Malware payload (njrat)", "value": "a5fde212a3a573e5dc1f9fee7d18c77d77c0c6e3", "object_relation": "sha1", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646156026, "uuid": "ac5aa2a9-56a0-49b4-8366-a5964acde3b8", "comment": "Malware payload (njrat)", "value": "bb2244de92037cdf35911557fffafa8ca8422f3637295bff2d4470101902027c6951a35bd46a9b2df759649b5c6c4895", "object_relation": "sha3-384", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646156026, "uuid": "00fc7918-4f3f-4e45-98d5-99332462dee6", "value": "T1B714021A37914A62E2E529B957AB8E4CCCF67D56AC35B10DF3DC76189873C52C883B30", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646156026, "uuid": "754d89cf-1573-4634-a7ec-6a2b866504d5", "value": "3072:2kNsfiBDVN7kDGoW6YsyONU4Ws99aPqzNm6pXHCxzNADpRGXUmq0J/95Y6Duu:XNHNkDG49yp4Oi5DpXCzIRGE0TEu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646156026, "uuid": "e7b3aaec-1594-4cf9-b1bc-60ab269dbf50", "value": 191352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646156026, "uuid": "220f548f-f455-474a-a7e5-a9aad9559769", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646156026, "uuid": "9fbc5fc1-4f23-4b9b-bf7f-2bb6f530c84c", "value": "89.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "510c161d-9934-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646121051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646121051, "uuid": "ec58702d-e75d-4b80-97dd-09aac77f3335", "comment": "Malware payload (Heodo)", "value": "43c6aa79f28f5ae394aca433339ed844", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646121051, "uuid": "34fd2e3c-38ae-4f18-b1bf-f86376eb9aae", "comment": "Malware payload (Heodo)", "value": "8e482846091fdcc0272254d3721a956d333c914bc3a3b8d9684a3efcccdb2bcb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646121051, "uuid": "40d7650b-a9cb-44c9-ad36-41fd06fe6a9d", "comment": "Malware payload (Heodo)", "value": "9ff66e159ee4af83cd29e37d05c3b195f40f4695", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646121051, "uuid": "258217a9-85da-48c1-9598-a24bc356dae9", "comment": "Malware payload (Heodo)", "value": "3dcb99bcda7a16fa1b8ec4f1f293ae0ab75c5287a94d4a21099987f58643977216ebc3999d822ea4269efd74c840cba0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646121051, "uuid": "c92ccae4-4b5f-4390-9197-806f22fb84a2", "value": "T11ED47C82F7429EF2C00B03347C32B2586BADEAD5D2158D6B9398A5AE1F35573493DE43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646121051, "uuid": "7391e3da-ac3a-424e-80f4-0ed4fece357d", "value": "e0b213ccd96f46d30dcd8e225f4e9fc9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646121051, "uuid": "3d9fa20b-d583-42a4-97c8-b6f2fff9e54c", "value": "6144:XjPgWGbb0OEmS9Vzf5WI9nI1LSfca9MyhKmZHNRuIfv7YtaIIo0cm59CH7PQ:X0bEtf5WyI1LSfcwfxhstaICRLmrQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646121051, "uuid": "4a47b5f1-4280-4103-a63d-7bd9396b8530", "value": 602112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646121051, "uuid": "6a8aa4ce-7dfe-424f-accc-9e774c3fc3e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646121051, "uuid": "e4516f65-a7df-4126-b999-b278863f0261", "value": "43c6aa79f28f5ae394aca433339ed844", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a62b566-9933-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1646120611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120611, "uuid": "32c5aa6b-6dc5-4e6c-9a95-a8f140da0eb1", "comment": "Malware payload (Loki)", "value": "677a1e2e74606d40a6fa631494d80d63", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120611, "uuid": "9ec0d517-c6dd-40bb-b6c3-c5e85c2bbdb3", "comment": "Malware payload (Loki)", "value": "8e998bff6dd432b35454d446d554a3444c2c11299bf851b70be156e8dad27c62", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120611, "uuid": "389b324c-e463-4053-a489-816399110a9e", "comment": "Malware payload (Loki)", "value": "4725febb7973716c1730803ca1804eff4a7d29da", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120611, "uuid": "9eb34180-cb86-4b56-9803-feec7de1723a", "comment": "Malware payload (Loki)", "value": "c920618c779515c7c898cf086c66d4196cb2f625371c0673036bcd99594bcf213b0473793d2fc0eeaab865fc187b2277", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120611, "uuid": "6360d2f4-ea7c-439c-81a4-0ff03f0dacd3", "value": "T138141293F7A8485BCED867BFDAF6690F52B49E2C81995E2330577389AD3DD0108011BB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120611, "uuid": "cbe8216d-fde0-44b1-9d6c-8a24ae4dbe35", "value": "3072:HuKYnynsPJTfqwtT8XQYbonVFkOVPyEbTqEhmaq9uWRkoKsY4xETQSMOx5sGPxwt:enHxttAGVF1Lb5hQZ/xE0SMPGPgudg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646120611, "uuid": "80e34650-8180-477a-a2eb-0791e52d2781", "value": 191192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646120611, "uuid": "1de695e1-01f9-452a-a7dd-188cbd6a44e8", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120611, "uuid": "ad5bf7ab-b87f-4886-bcc6-9bb200e4015c", "value": "PO_14220429.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b80d242b-9943-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1646127667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646127667, "uuid": "8d88b1c5-bd1a-49ae-bf33-bd9db26dd4b6", "comment": "Malware payload (Loki)", "value": "371e33bb34fd9109ef266b7b8eb06615", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646127667, "uuid": "81e252e5-37c1-46a8-88d3-b2a22464ca9e", "comment": "Malware payload (Loki)", "value": "8eb9ced7e44fb7c3c123a4816cb8285e7ec329cdc713b2dc52445c76dcff14af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646127667, "uuid": "6b9057df-488e-43b3-804c-7934dbf4012f", "comment": "Malware payload (Loki)", "value": "3aef6afc608792c72d9f6df6a3c948336b98e563", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646127667, "uuid": "9fe9f694-e082-4844-b62f-0e2320115cf2", "comment": "Malware payload (Loki)", "value": "5927b9c8bd49661b0a7ef38ba44d5cdef483cc2e1388bab9b999a716a8d3b99afb63e69fdd2f899fe4a27469672eaf2e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646127667, "uuid": "1fcda6a8-73be-4232-8327-0f001d620b96", "value": "T14664236276A069BEC29012B42637F97BDB72A3C00CBA4D9F5BD83DE373544474E480AC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646127667, "uuid": "5dc07110-10db-46e8-90f4-7acb711e85ba", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646127667, "uuid": "75f708e7-e8f9-416b-857b-89cd2ab78a0d", "value": "6144:rGiyiK2c5FgeuqGbBDU9ZssV+3weZ2JUOpik:Vnc5F/6eVMw1Jl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646127667, "uuid": "626a9b0b-ed36-4eef-9d65-fb49d730b645", "value": 314011, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646127667, "uuid": "36ada827-0858-41d5-9081-f0f0457e8df9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646127667, "uuid": "b9bde08e-adbf-47dd-9d6d-14ab2aa26f53", "value": "371e33bb34fd9109ef266b7b8eb06615.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccb406d3-9977-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1646150035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646150035, "uuid": "63ad4bcb-b75c-48e5-b8c6-2a3b9f45328c", "comment": "Malware payload (SnakeKeylogger)", "value": "407ece9f1045fde4a406b18c7912de72", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646150035, "uuid": "4a49c7b2-8a26-433d-a58f-db5d2d13a5f3", "comment": "Malware payload (SnakeKeylogger)", "value": "8f78d374b0031852c70c06fd4075e1f8db47aad358f4ab450e141ba282b935ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646150035, "uuid": "70a9ed59-8211-4030-add9-f9c8c9df7ef8", "comment": "Malware payload (SnakeKeylogger)", "value": "c95a177558bd9623ced33615268cf3c1c65e2abf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646150035, "uuid": "d7840e65-4992-4179-9401-ecc31f4fc0ce", "comment": "Malware payload (SnakeKeylogger)", "value": "6f74b695b9d75c4b6cfce6febce86306a000e724ce7f279b15f1a5cf72a9de8912fe3add715c80bcf6c495ac61c4b878", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646150035, "uuid": "2af195f6-fd47-4a8a-bb60-100fd0c70bf6", "value": "T13005AF0838E6607DE8368BB2CEC4EFF0DB29F131D54960B654020E599A0DBBD8A55DFD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646150035, "uuid": "94ae2256-1f04-4b41-b707-d30249786f2d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646150035, "uuid": "14373313-fe47-4524-86a2-cef4cc56469e", "value": "24576:JegcpHsl/4l2RS3fN4ROebzH2fwVdDtLtFSfkEu:JegAMNxgvIZbzH2fIDjX3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646150035, "uuid": "e9d18c0b-08c9-415a-8566-ee648f329201", "value": 865792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646150035, "uuid": "efa9a64b-7deb-4e36-ae78-b490cfcc04f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646150035, "uuid": "48a9e920-c576-44d7-b23b-93dcac65d94c", "value": "RFQ letter for the procurement.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e32708d-9929-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646116376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646116376, "uuid": "a1dbc103-fb65-4dc5-8d09-af1fc8591c35", "comment": "Malware payload", "value": "6dea5497837d9d56b2463cf1d554a6cd", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646116376, "uuid": "dd1b2116-db16-4a95-877f-4aa087ad4949", "comment": "Malware payload", "value": "8f93beaf42ccad2f81b2dc6e76187b5e01ed116e566df7bff7d858dd7feb93bd", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646116376, "uuid": "953bd792-5810-4d19-b29e-1098854a0ced", "comment": "Malware payload", "value": "c3eaad74b8631f393825c72f09c375270a3a65d1", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646116376, "uuid": "b8616bab-c8aa-4e52-9d0d-879e91d2dc47", "comment": "Malware payload", "value": "2b497961b7ebc7b9c444f8b446a203a996f5e1784a78ff82e679f38f8a90dac224bba10df5ce7968cb88547f955faa5f", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646116376, "uuid": "768745dd-14ba-4977-af87-7b8159fcdf82", "value": "T1DC84230C632C958E543F33BFCC2B2E44D50F17972B2CC9654DA1A632A8A8C55F1679FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646116376, "uuid": "13e84687-3d3e-43f6-9600-8e2b70f787f8", "value": "12288:9S0P6U4SktmZjuMWDdLMFk9OPb0W0T7T+sC:s+J4LtvTDdgGn7K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646116376, "uuid": "728ba706-97bb-40a1-a68f-762cae1c4b7e", "value": 394058, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646116376, "uuid": "a2aad98b-79b7-4ffa-8863-bedf3f063b42", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646116376, "uuid": "b7b10f76-4d44-46bc-b465-c6ba3665f45a", "value": "RECHNUNG 28.02.2022.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20b1cb24-9919-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1646109374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646109374, "uuid": "26bb5a2a-d483-4d72-af76-abed1ea2e968", "comment": "Malware payload (Loki)", "value": "e49ec30377f5977209243b74d9f2e8c6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646109374, "uuid": "c271bb23-fd4a-4508-846f-f1bc9221bebd", "comment": "Malware payload (Loki)", "value": "8fae654a8e1d95245cc0277a8b2e319ca9b735e9e0d169cc31fae440b491f903", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646109374, "uuid": "32907bcc-26a2-4cbb-9c7c-1d9263d35fd3", "comment": "Malware payload (Loki)", "value": "aba893cabe977d4fbecfb5670153dce275fdf8cd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646109374, "uuid": "e8db97a6-5523-43c4-8f7d-54d727ca2668", "comment": "Malware payload (Loki)", "value": "0c7e842467a3bb016305561f654a73d5d2197c8077c492cf0ca5dc46b1b9e0c758c38c5b3612359fac0c8828dda11ff3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646109374, "uuid": "6ebd1eb5-530d-44b8-b991-69c0c3a768a1", "value": "T1A674222B52C1212BD0A685329EFAEAB9FB7C41C253E036471BF02E7E39655B3241D1F5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646109374, "uuid": "12ad3694-225a-4be7-8609-7bc74da761ff", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646109374, "uuid": "acc54c37-1f27-4c65-864d-320f75840301", "value": "6144:rGiU+o0JLtvO9hpG6t47563sqVUGRr8DFl+qHR7QZQYcKfU5Obsq6nH:Ip0JLcHpG6t4NqSQSg0R0ZTcKfsObh6H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646109374, "uuid": "c3670425-889a-4612-95b9-645515e857e2", "value": 339369, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646109374, "uuid": "7c294e1e-0175-4780-99de-51ebc23683b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646109374, "uuid": "293c7d97-0dc3-4692-977c-0f9b2c6439b4", "value": "e49ec30377f5977209243b74d9f2e8c6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6fc9d22-9935-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646121625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646121625, "uuid": "9fe0ecd3-2575-4cde-9bdc-0b1fabbaf3b7", "comment": "Malware payload (Formbook)", "value": "c34066dfca6f8711411697802664eade", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646121625, "uuid": "b7627180-7940-48b0-b22f-cb783835dcf3", "comment": "Malware payload (Formbook)", "value": "90704bc2a430b67f0dcc7cd39bd38754d17fd932bc34f966b80b179981a0f91e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646121625, "uuid": "565401fe-aaad-407f-b39c-d98c7a03c5c0", "comment": "Malware payload (Formbook)", "value": "828770a57f9c887bc8cf761ce6240cf7d03f3043", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646121625, "uuid": "61945054-4665-465c-bdfa-4f0ed1755634", "comment": "Malware payload (Formbook)", "value": "1b96b145bcada194a152e5385f535ef8130634f4167b482a5e72e77a7344a01c800dfbd12ffd327e86119774e5720ae6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646121625, "uuid": "1080bd29-979a-4147-a663-1c9033a0fcb6", "value": "T1F4F425836807B8D9E92F1FB904FB9CF831636DEC6853AA15E5703F2FB6720190E11569", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646121625, "uuid": "388920b4-52e4-4271-a9b4-c0866abc3a96", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646121625, "uuid": "4b186713-145a-4e51-b590-6f4fc4a64a56", "value": "6144:9GiMz887yuETBEd0XohUGJnc6gsQsniu31gfXS5vNTnpj487ZBq1JBr:1YElxX6UFRsiu3y/SzTnpj487ZBkJZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646121625, "uuid": "fa700262-2010-45bb-8a28-4b2dc3f4cc5b", "value": 734416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646121625, "uuid": "122ca54a-d525-478b-a8c6-beff2f2db5d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646121625, "uuid": "17cbc9e3-3a93-4a01-a59c-978bad251e20", "value": "REF. NO. MS-DGP-220137.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdf42ab6-9977-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646150037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646150037, "uuid": "22383ae5-b0c9-4258-aa01-987fb730e6cb", "comment": "Malware payload (Heodo)", "value": "fcaaca3794811119da3afd99f763d47e", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646150037, "uuid": "438626ea-1236-4195-8ed4-3539a501f59d", "comment": "Malware payload (Heodo)", "value": "91108c235de9595903bad6b63fc7f4b1e44585ddd873b6f34866348380132422", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646150037, "uuid": "ec455cb7-89f8-46a0-9f3b-41d468d6d31c", "comment": "Malware payload (Heodo)", "value": "b384f7c0b737f43dc06d6ccd1a16ac90fd29fb98", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646150037, "uuid": "265f373d-f884-4d41-b650-e945026a75b1", "comment": "Malware payload (Heodo)", "value": "a4d976575a1c3c6b529d81b4465f13dcaa43cd2e0f45efbcd0b01d1fc27a86107b90af8df40025c360f088da36c166f2", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646150037, "uuid": "7ecd42dc-0ac8-42fc-ba53-3ecd531d8fa2", "value": "T1BF23E129C1606828C73D8C759200E6A3720A7901D9D5FB893586BB1C3B96FEB53AF5CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646150037, "uuid": "5b4aca0d-ebf2-4524-acdf-3810906ac642", "value": "768:ayMo9DOevZCwrvtE9WzdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Uh0VP9HW:TMo9D88tT5fTR4Lh1NisFYBc3cr+UqVk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646150037, "uuid": "ddf1462e-1c40-4b75-9b2d-d9c78558e3e5", "value": 47703, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646150037, "uuid": "74459938-8ddd-4525-a145-e7f985f64bb5", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646150037, "uuid": "392a15b8-8687-43a2-8b1b-0369418e8236", "value": "untitled 6950.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac57c526-99a4-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646169308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646169308, "uuid": "4f20f64a-cb51-4f5e-92b6-251ffd8cd66d", "comment": "Malware payload", "value": "5b6080f6cd5f7c80fa3f73a8207f4bb2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646169308, "uuid": "3af81680-26b0-475f-a955-27eb8656f80a", "comment": "Malware payload", "value": "915657a1cdec26809fd313c591bdb5841424080bd33c07197e251bf8a40e19a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646169308, "uuid": "26289c01-4d7f-4087-a8e8-b814d1a3901b", "comment": "Malware payload", "value": "723506fad25d08df1ede34feb6a8e6a120b44810", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646169308, "uuid": "2767efd2-e96f-46ae-8da1-e4776c644864", "comment": "Malware payload", "value": "1c5ec18fe9f47be2309eb34a3934e46bb6903355854203fb1dda9989dfb3cc9064243e4a0569ea7f1b71992b99bdb54c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646169308, "uuid": "31ffecad-ce4d-41eb-bde1-a6ead87fa6a4", "value": "T19F0622C0CB150125C16E35FCA81363B9E3E3DF9059F8D66206A67E9936B5CB760AE343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646169308, "uuid": "abb839bc-fd4c-4500-b33f-5f42ebc59773", "value": "38a7a81fb7a1b63fb17b662dd71c3913", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646169308, "uuid": "0067e8fc-45bb-43eb-8665-83d22d06ce6f", "value": "98304:xKxR3U90WMnftppAw4I62o5JfZ6quJgnf5IBoEVBbJiz:CRk90WaftQBzBJfRuJGhIBooBy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646169308, "uuid": "7868b93f-60fe-4b43-b45f-76fd14f2455e", "value": 3955200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646169308, "uuid": "3866a03c-a44a-4dd6-8ec1-8e15caf19003", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646169308, "uuid": "acafe641-fe0c-4d07-935f-e8bf24d0387f", "value": "jg5_5knj.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "464c93d3-993a-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646123610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646123610, "uuid": "df825dc9-d261-4aaf-818b-d07a1a77515a", "comment": "Malware payload (Formbook)", "value": "6e021e8b2ae801e2f394491804aaba21", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646123610, "uuid": "ff2552c5-e403-426d-9341-0e2af705b70e", "comment": "Malware payload (Formbook)", "value": "91c8ca0003d8027d9236656107a5b23d2e896373584a845dda966a7efcdf12dc", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646123610, "uuid": "e8a7e577-f684-4db2-92ba-f54894e6b467", "comment": "Malware payload (Formbook)", "value": "c6dfccb49b975f021795eacdfbcfb287da7c706b", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646123610, "uuid": "211a3150-d48a-4e4e-9749-fcecec2c0c75", "comment": "Malware payload (Formbook)", "value": "91af6a69cb78de6eb1746e00f74746d02e24f820c5062d4af838249a5d2fe429e750cc2aaf869fd81857c3a9c74ddf51", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646123610, "uuid": "35d7c898-9477-4c8e-83d4-13a7433186cd", "value": "T1DB4523326981D2A7E1A70831D973F734E3ABE15152B10627736C9F9F6F3DA4250398C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646123610, "uuid": "319f5a14-d718-47de-b8a5-a8f8a1b3ac89", "value": "6144:EGiApuWx0VcjaKpf+cBhMD+hRpNCIrO9RhvkTf3tOAm5:RptGV2b+KHnrOhvg/wH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646123610, "uuid": "4799bee0-1d2e-4f51-b8ba-085f062c6b13", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646123610, "uuid": "22053edc-304f-4aac-89cb-a6054502466b", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646123610, "uuid": "2d2946a2-d4c8-4a75-8e3f-a135bcd6cc93", "value": "Order-519635209-pdf.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e598a71-9985-11ec-9275-42010a9c0029", "comment": "Malware payload (AsyncRAT)", "timestamp": 1646155836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646155836, "uuid": "be7cee07-af65-4610-aded-61f774d2c1b9", "comment": "Malware payload (AsyncRAT)", "value": "82149440c5f1eeaccc292e398d458cd6", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646155836, "uuid": "7b5e43f3-5188-4ab8-bcf9-bb0d194e9f75", "comment": "Malware payload (AsyncRAT)", "value": "935355ba86dc77ac36d721e2bdc4f1b88d8de2e5c4fa9869a4b47e9597f127f4", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646155836, "uuid": "9eed585a-fbc4-417b-b685-055b3874aa28", "comment": "Malware payload (AsyncRAT)", "value": "85ecf5d12c8859a1dc41bfcfac2fb444fe709551", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646155836, "uuid": "af1e59d9-a304-4cef-b893-73e26136a3a1", "comment": "Malware payload (AsyncRAT)", "value": "41fb6c212dd5da6249a4b68080531604650a6ca64a0d70420147fe6986c004329a1eaeeb2c14c41e8acf6f535039c8f7", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646155836, "uuid": "84fb598f-4e43-4719-b1b7-6dcd9dc6bc19", "value": "T1D0126D7C37641883EE524473D6B6FF5606E7F2B78EDA5B98B32CE6B12B1B3214160244", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646155836, "uuid": "8ac0c469-4092-4ce4-9184-7c1a2d23929f", "value": "192:nUG/RzwSg+nuYRlOuYoZqt1eR+Rx4IRZUXttSj8ST+UlRm7KbY:nvzbn8uYoh09q9tSj7tG7KbY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646155836, "uuid": "2bdf2c4d-85fe-4585-84cd-c0b215d71904", "value": 9538, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646155836, "uuid": "cb331e0e-8c69-48b7-9b99-f916f8bf2525", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646155836, "uuid": "829e3849-093b-49b1-ae1c-108913ae4761", "value": "Pratka Econt 5300133634052.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e142714b-9931-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646120005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120005, "uuid": "76f534da-1358-41d7-b992-1a11df458d9d", "comment": "Malware payload", "value": "697827b99a814a6e926c90d4f5b7df4a", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120005, "uuid": "100f72f0-2a4a-4380-b522-efa8f6a0d772", "comment": "Malware payload", "value": "939e4bc8d813e2e5a2338e194773192db8a2053c739b57a607a7e398f748c051", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120005, "uuid": "6b0bf619-aec7-401a-a5e6-c76e9025fbe8", "comment": "Malware payload", "value": "0ce6aadd4611e039a703b3cdc0f630c80152b804", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120005, "uuid": "3d9d23a7-4aca-4877-9af5-6a856447b1b7", "comment": "Malware payload", "value": "bff08e1ce91c88724a64449d0201b670ae78bdf7d7667877fc7981800717f8527f8cd8ae124077598f8458763c5922d0", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120005, "uuid": "83be7dc1-8c17-4cb3-8124-d46d1f16f8f4", "value": "T1602533F310ADB5FEC0A4AEF0522B5F77446B1FEE593A0930DD65232FA49A403C256D29", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120005, "uuid": "7dce1872-9d57-4f26-bcce-816bb5c3ff50", "value": "24576:8nvfuJosHxDeOW0z0/9g15pS1MtVb30CQwt8K/SDt:8n+JoEeMz0/9gHpSekCQwt8hB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646120005, "uuid": "b307f296-53bb-4760-b581-438a6ca5c8f2", "value": 978675, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646120005, "uuid": "63ea0d6a-0276-4972-be3c-fc7c3e1f40de", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120005, "uuid": "bb7e9188-9913-4971-9532-a666eeabaded", "value": "maersk courier document.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce2fb4ee-9968-11ec-9275-42010a9c0029", "comment": "Malware payload (Gozi)", "timestamp": 1646143595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646143595, "uuid": "de4913e6-bb4f-4b03-a0aa-40aaed4f9a4c", "comment": "Malware payload (Gozi)", "value": "1dd7db4fb3dcb6d03f572b1cde1df05e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646143595, "uuid": "cc5acae7-4c2c-47fe-9302-62ee60f82a71", "comment": "Malware payload (Gozi)", "value": "93d5291a8c81a426309d688c3b44552824b3dcf4239948154877e895b22de285", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646143595, "uuid": "3f802a7f-a9d1-40c3-a9ae-57b1b29a357b", "comment": "Malware payload (Gozi)", "value": "9f3d3825f6407befe92e0c5f92ba789c749a7f2f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646143595, "uuid": "6014e628-575e-4c30-85eb-fd5546023005", "comment": "Malware payload (Gozi)", "value": "9335f9213f9af194fccff06ff9764538a7c4415d44a37e574edae6f78a023c73713d3573b851ab4d5714b0517b604129", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646143595, "uuid": "c0f89654-b143-47f3-88b9-1c96c04aec27", "value": "T1D3345D6AA2E50A96FD7BD6B9CD53C227D7F338491A64C31F13B0CA965F47321B218342", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646143595, "uuid": "ee02e6e6-f75a-472e-897e-d4f97d7053c3", "value": "6144:RyihnaKbEFhck6xW3SJ5gtS3z9pjFAl2kO4aWLpf:Ryih1EF2k6S/SD9pyl2jypf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646143595, "uuid": "920a8387-97d9-4815-8002-6c1c38da2bd4", "value": 236544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646143595, "uuid": "bb5a5824-fc16-4314-9123-e91d2d81e454", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646143595, "uuid": "2fab96c2-88a0-4c2c-9ba7-aa48d0a61519", "value": "10640000.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01bb0339-992d-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646117912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646117912, "uuid": "dc654173-edd2-44a9-93cb-699c402d4e4a", "comment": "Malware payload (Heodo)", "value": "056b756f082a145ca1f2445c199e35d7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646117912, "uuid": "ba193f4c-1a64-47ec-b935-7b2ac44aef10", "comment": "Malware payload (Heodo)", "value": "94b48a68a93d617176b09386dff94149253c28264af202196ceb66622d42b6d1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646117912, "uuid": "9aabb47b-85da-4508-bedb-73ff13df19d3", "comment": "Malware payload (Heodo)", "value": "e58e6a93e5293f606d779917105cd29da0448235", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646117912, "uuid": "e9eceba3-b9ce-407e-a6df-b7e10d6f65f4", "comment": "Malware payload (Heodo)", "value": "ed675c2b9eee74dcaa0691c29e7191abcbb45272f30fa071c4888e11ff0673514429f4c81df5c4f86f8eec56c378d052", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646117912, "uuid": "443636e8-81d4-40b9-82eb-8fff91172abc", "value": "T149D47C82F7429EF2C00B03347C32B2586BADEAD5D2158D6B9398A5AE1F35573493DE43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646117912, "uuid": "e329ee24-1b82-42ea-8a7a-2cc3bbd830cd", "value": "e0b213ccd96f46d30dcd8e225f4e9fc9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646117912, "uuid": "8d18d3ff-0e12-47c1-8dae-5c9bfc4307b4", "value": "6144:XjPgWGbb0OEmS9Vzf5WI9nI1LSfcanMyhKmZHNRuIfv7YtaIIo0cm59CH7PQ:X0bEtf5WyI1LSfcOfxhstaICRLmrQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646117912, "uuid": "82e8b9b3-c73b-4409-810f-bb84d00cb998", "value": 602112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646117912, "uuid": "bfde173e-aab1-47d1-a23a-7782ff77ec50", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646117912, "uuid": "161efe59-60d3-4db7-beb8-b3a03a127f30", "value": "056b756f082a145ca1f2445c199e35d7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6756ca2d-9961-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646140416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646140416, "uuid": "b3c44f2f-837a-4e6c-869d-06586d24510d", "comment": "Malware payload", "value": "88cccc7371fdfdea5fc19bef8a7540ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646140416, "uuid": "2ad7c6b3-2532-4e74-a3f5-8934df639288", "comment": "Malware payload", "value": "94f2223d176033f6193ec0e1f8c63ce32a09821191eecc5958387e111bca2088", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646140416, "uuid": "6d4236c3-a674-4fe8-be9e-562d2c737a07", "comment": "Malware payload", "value": "65bf415bccb9f5ad44d3f1611f30b74871781019", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646140416, "uuid": "c7b4d866-a7cc-44c6-873b-8147e1cb0a51", "comment": "Malware payload", "value": "34086d44a524f7536dba18a6d58d3a32f5f497e6f02da3c8e62a1987fc509272d3cd93008a53bab9ddd44c7c9d15e903", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646140416, "uuid": "e6792a56-f209-49c1-a8db-dfa2327e2af7", "value": "T192C38C4132D3413FE9A1967259A84A91C6EFFD2129B9CFC76B8C217E8C741D0173AE63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646140416, "uuid": "3a25cb7b-18cf-46ea-be8d-b65971a3c459", "value": "971f3f0b77b45ee5dd5e2c85cfc3039d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646140416, "uuid": "66ecf527-62c1-40ec-9e03-1932f5158e20", "value": "3072:1xt2ILTXX0HuqX1sVGK3mCWUBdVt9AAs:VP30OwgT3X5e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646140416, "uuid": "10aafb05-c71c-4981-99c6-f35f3dafcb23", "value": 129024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646140416, "uuid": "9ee77496-eb38-4118-b755-5686ac6a4a1f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646140416, "uuid": "a01ef1a1-76a2-4fa7-8bf7-d667d7956ad1", "value": "SecuriteInfo.com.W32.AIDetect.malware2.8831.20074", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f479bfc-9998-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646163891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646163891, "uuid": "1993f41d-de3b-477a-aec4-ed83376a7e1a", "comment": "Malware payload", "value": "8b51b13648b558522d13ce0908daffde", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646163891, "uuid": "8fb2af81-a8e0-4f82-a3dc-2c3858071933", "comment": "Malware payload", "value": "9513ed3ec529bf0497094653d14463cdc845aec005df69d5f337f819ac18bf37", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646163891, "uuid": "39d6b346-fdd1-468d-92e7-78c7dd2f4dc4", "comment": "Malware payload", "value": "a65c65336215ecddfb40f0167ab02b5b91b79dcb", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646163891, "uuid": "0669b019-6c5c-4fbe-b842-9519abb707fe", "comment": "Malware payload", "value": "84cbe92aa96ee73cc54f5e53b3fe647861fcba4b9f68338b77b733b6eebb5d206ef28172f5a0d9fe9fb82a1dd372b12f", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646163891, "uuid": "fdc75753-41bb-4ff7-b09e-5e5ca4b13637", "value": "T1A823D025C1607828C73E8C759200EAD2720A7D04D9D5EF893585BB4C3B96BEB57AF9CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646163891, "uuid": "e94b34ae-229f-4fa5-a065-52e014118135", "value": "768:uio9DOevZCwrvtD608zdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Uh0VPWft:uio9D7UtT5fTR4Lh1NisFYBc3cr+UqVC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646163891, "uuid": "640d78db-1cb1-4d0e-ad4e-83885268ad27", "value": 47699, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646163891, "uuid": "a0586321-cb32-41c3-b5e4-fda804e841ad", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646163891, "uuid": "96261706-468c-4e29-8169-8a2fee55c5aa", "value": "EXT Payment status.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a12eb1ee-9978-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646150392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646150392, "uuid": "5ad7044b-073f-4184-8160-71137689ac78", "comment": "Malware payload (Heodo)", "value": "683df520cf0e18f8307ccf65f9b608b7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646150392, "uuid": "f81d94f6-ee04-44d3-89e3-69a788c559d7", "comment": "Malware payload (Heodo)", "value": "9565e6779bb25474ffb2a3be1ab4a9adf90fa2adc3798deeed719e1dccb3b713", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646150392, "uuid": "225303fc-952d-412e-a402-c3e32b8f8340", "comment": "Malware payload (Heodo)", "value": "7b6317c38b6761a603a04e019a9ead2034c029d8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646150392, "uuid": "a7088dde-b821-40af-a1d8-127542572441", "comment": "Malware payload (Heodo)", "value": "ed07667dfa14133fa081a2f4733000e9735e4082de75ea34d96037435f2d71948220611d2401ec2a7f4b937468cb78cc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646150392, "uuid": "2be6c97e-bd34-4ff1-89d6-c52b062085b0", "value": "T138B4AE11B790C076D2AA36342512E3B51AEDBC709AF5838B7FC07B7E5E315918A3835B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646150392, "uuid": "99486485-fe25-4bc0-98a6-f3e63a15f0e6", "value": "f08242131de62ca6d7c4b2727b491b3d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646150392, "uuid": "3e8bce5a-3489-4d8a-a07b-feaa9a88b9af", "value": "12288:dbFLiEzuSo9guqHuWjr2pyC4W6SpktSuHE:5VWSo9guWO6ZE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646150392, "uuid": "e060cb39-9acf-4c9e-925f-7032f5cb244f", "value": 500224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646150392, "uuid": "bc9950d6-e2ea-4697-97dd-e995fbfc5d63", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646150392, "uuid": "e71f2e60-4ebc-4941-8465-9922028988f4", "value": "683df520cf0e18f8307ccf65f9b608b7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb1d0067-9989-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646157737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646157737, "uuid": "b90f81dc-ad36-40df-baf5-9e1ffe6775fc", "comment": "Malware payload", "value": "b73fd744a06524f04f0582822348f1bc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646157737, "uuid": "6d790282-8a25-440d-a94a-1ea897932c3f", "comment": "Malware payload", "value": "9577df8b7e48bb30b9bd48e49c548d45cc5cc4a9bf1b93aa79f4ab35fc977cb3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646157737, "uuid": "5b428c2b-9aca-4cf5-8792-7938ae0fcef0", "comment": "Malware payload", "value": "7718b7e624ad54643cc240c42f8f336f9511f62b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646157737, "uuid": "064d6ba8-141b-4f97-ba2c-292bfe1f6c99", "comment": "Malware payload", "value": "22ae7ceb54175e08af64c15508e942d5d8868600bca4ba3630648b81244a45f23ba0e6cfa3d0783af1912a17abf5927f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646157737, "uuid": "145f25c7-a459-4843-b288-ca890f77acfe", "value": "T1BB15BF4835D5103DE8368BB1CAD4EFE09B2DFA21D54A60B250023D1BA63D7BD8A45EFD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646157737, "uuid": "65c04e85-4d1a-41e5-beab-840e906c0d44", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646157737, "uuid": "ea62dfc5-48b0-4fd1-929f-9c37f9b9996c", "value": "24576:I3+PfG+loLiIT3HK+QAc504h16ZLIEGa:h6O2XKJ5nh1wI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646157737, "uuid": "8ba63c20-49a9-4921-94aa-6ffce0837eec", "value": 933376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646157737, "uuid": "2fc1c4cb-0aae-4a0d-9a5b-744560e6e85d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646157737, "uuid": "2d38c5d5-c948-472b-8c85-8f1a07e09631", "value": "b73fd744a06524f04f0582822348f1bc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa3c55b8-99b0-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646174459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646174459, "uuid": "863c8b99-1a10-404d-b58a-6fafd9a88740", "comment": "Malware payload (AgentTesla)", "value": "5d7d4bc001fd85b4c59b493ec54b5f3a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646174459, "uuid": "470869a2-aefb-43f0-8a8b-365d60a3bcc6", "comment": "Malware payload (AgentTesla)", "value": "95834dce2c6a97d8f8574750d3d790da5bc6ebfa43612b414213c394aebfc7d9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646174459, "uuid": "e9de0bd7-cd27-418e-b38d-e1a9656a60a5", "comment": "Malware payload (AgentTesla)", "value": "da7fb47d0a3a7801e7aaf4e7ce2d309ad808e75a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646174459, "uuid": "648e2171-6ef8-49cf-8380-10d1db7ff613", "comment": "Malware payload (AgentTesla)", "value": "8a2c4c2d44c5f7296721246d6402a39de9864ff0198cffbcfb017561d6823575e95e70fce900c4238014809b9167e334", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646174459, "uuid": "149b27db-1ce2-46ca-9a48-06efee1416a9", "value": "T1750423E310C462FAFC0E7172C50D67A822E659995C6EA749A7CBEF065D3F084884F5F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646174459, "uuid": "60fb1f39-5ffe-4ac8-b860-233b30559169", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646174459, "uuid": "0d607809-5a11-4b9a-aced-1dba04d47d56", "value": "768:obxc2hKUPWzAzoYIltXwW0+o6dW5Fza6POey4ocEYg:obxc2hKsWzAz6EW0+3d+LPOe2cNg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646174459, "uuid": "aab4df23-ed40-43c6-8110-05723e884d80", "value": 179200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646174459, "uuid": "2caf5285-e0b0-454f-bfa2-dd718e8db02c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646174459, "uuid": "b6ebe03e-7789-4060-8f98-a68923a2f754", "value": "0004364380010940655.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bb3a2d6-9956-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646135780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646135780, "uuid": "ed44cc79-03ef-40f2-90f6-4857ef311bb2", "comment": "Malware payload (Formbook)", "value": "8ad21207dda2f1d5b61a9bc2e1a070e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646135780, "uuid": "696449b3-d04c-46ea-867a-bee7bf9dbbb1", "comment": "Malware payload (Formbook)", "value": "95fa273215e28b4452c387973d6292f2a5e26827f1b4122e1c9df0ab2479f195", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646135780, "uuid": "03f158bc-4503-4915-975a-c0131de464d2", "comment": "Malware payload (Formbook)", "value": "8115ae276d8a6605833a45fa10c319476c07f718", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646135780, "uuid": "5e9da1a1-e07a-408a-948c-8b2f6618585c", "comment": "Malware payload (Formbook)", "value": "e1b8741f855bead5193a9d9bd46fd2fa10527e22dc7ed0a81dae90ca0050847719799c3de3628d749879361a16b7bc39", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646135780, "uuid": "3dd16cad-e8a0-465b-b6af-30c158d9a145", "value": "T19705BE143AA75F3DF1B94BB658C4EC64F769F6235C09F37E78502186CA52B408D822BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646135780, "uuid": "07f7fd2d-3d4e-4917-abda-4b194cce4ae1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646135780, "uuid": "9dc35d79-7213-4be6-86fc-f322110e2eba", "value": "12288:9gB6AKvN3h7jjJKYkOwm2xfkpJWAom52H+AG+UUakD98fuk921Dl:GkNnKQexcWDkYxqUL9Pk9eDl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646135780, "uuid": "af8e17a8-0896-4849-a5fc-3d112bb00f9d", "value": 839168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646135780, "uuid": "cc6d8deb-838d-47db-bfd8-5ff8d1fb6cd4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646135780, "uuid": "9b29c5f6-96fc-4fc2-b5a7-8fbc3796c357", "value": "Bank Swift.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74da0b38-9941-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646126695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646126695, "uuid": "b2b92abd-60f0-43b1-86de-e8670577f7b6", "comment": "Malware payload (Formbook)", "value": "284b2c8deb3c323ef533a1943380ec08", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646126695, "uuid": "3b68c888-e9a7-4c38-b106-e8c41a9c90fb", "comment": "Malware payload (Formbook)", "value": "9655ee4ca1167f87d9245041ab59e861d6b3bdde7897a3b4cb2deee8550bdaaa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646126695, "uuid": "a6717e75-c3c8-410b-b299-ae59874cff53", "comment": "Malware payload (Formbook)", "value": "1d5546bab8eacf30867cb7e457a7483b8df37986", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646126695, "uuid": "cf80e432-d34a-4d49-857d-c2f658f2e13a", "comment": "Malware payload (Formbook)", "value": "0fac1e9b9b828816ea76f075cd0637cb4c212241ede550d73033719d4adc087d511d52d9489a09269297697ae002a300", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646126695, "uuid": "379f6385-27da-45c6-ac23-8bd5523577be", "value": "T175F4BF0838E65038F8368BF2CED4EBF1DB6EF221E48960F554000E559A55BBC8959EFD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646126695, "uuid": "e8158660-cc48-45ad-aaf1-d8288009a2c0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646126695, "uuid": "b5d72a8e-cac2-4285-9663-33d2536247c0", "value": "12288:LEvYR/IH+VvofyjjXYUazAQFK1qO1YdfXJkK0qhZ1earb/cIGHY2CCW:rjjITzAWCqO1+V1earbXGG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646126695, "uuid": "e11e6f65-5e76-4a78-ab91-d157d644999a", "value": 774144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646126695, "uuid": "f973cf3b-eff2-491d-a2ba-5d8122073fd1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646126695, "uuid": "0a062250-4fba-4c70-baed-41e8fa21ef7b", "value": "284b2c8deb3c323ef533a1943380ec08", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53743d07-9958-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646136517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646136517, "uuid": "9ca343de-269b-4c8f-96a9-e97e88f1764f", "comment": "Malware payload", "value": "14580bd59c55185115fd3abe73b016a2", "object_relation": "md5", "Tag": [ { "name": "Daxin", "colour": "#652B35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646136517, "uuid": "86d9f07d-44e6-424e-b649-301fcb773f0d", "comment": "Malware payload", "value": "96bf3ee7c6673b69c6aa173bb44e21fa636b1c2c73f4356a7599c121284a51cc", "object_relation": "sha256", "Tag": [ { "name": "Daxin", "colour": "#652B35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646136517, "uuid": "7a709a3f-5b47-40a5-a2e1-753d446ba8cd", "comment": "Malware payload", "value": "71469dce9c2f38d0e0243a289f915131bf6dd2a8", "object_relation": "sha1", "Tag": [ { "name": "Daxin", "colour": "#652B35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646136517, "uuid": "4489fd86-b248-46fd-8fd0-44c4a25a16e0", "comment": "Malware payload", "value": "fd9ed6c885710d174e86ebc06f2f4b24f692aa2153554de2de3d13c80ce33b2712690f3d9016f5b5601fb9b8bef21a40", "object_relation": "sha3-384", "Tag": [ { "name": "Daxin", "colour": "#652B35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646136517, "uuid": "003e1726-d236-424c-91dc-cb0421c671eb", "value": "T182B20643F7950FF5EA631A7A18A33B15613B6E390B1569C38F60399A5DBA3D029313C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646136517, "uuid": "0f4759f5-f00f-41ab-9848-6e5f5e8bb77d", "value": "a7bd820fa5b895fab06f20739c9f24b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646136517, "uuid": "13c4d0bd-2be3-41f4-8cb5-cd56a55e73c3", "value": "384:dzah3aVobot8kQevwrvFkydyszfVpyAKweg78m789g+gsW8EV:dzoK5IFjysrBKwqg6EV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646136517, "uuid": "d54d4f09-1d72-4791-8c5e-8afdc9696073", "value": 24064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646136517, "uuid": "e6e7b511-7bdc-4cd6-b248-d228fae7a9b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646136517, "uuid": "3efb6b25-f9ea-42a0-bdca-aa5b3ecaa408", "value": "96bf3ee7c6673b69c6aa173bb44e21fa636b1c2c73f4356a7599c121284a51cc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b301db5f-9975-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646149133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646149133, "uuid": "3d07a3f6-9881-4282-80e9-fadd4b5d8bdb", "comment": "Malware payload (Heodo)", "value": "e0ce6c4726302111a1e4e566712316c4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646149133, "uuid": "9773b1a5-1769-427c-93b4-637e0b62270a", "comment": "Malware payload (Heodo)", "value": "9702dab10e56ebf816d52b3549fab2640bc9643e64633419707af41a6524ab73", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646149133, "uuid": "986d8e60-0e83-48fe-9c09-1d4d61132f6d", "comment": "Malware payload (Heodo)", "value": "15feafe6114a2a981efa00ee2affaa34eb6285d1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646149133, "uuid": "45b8eb9d-b750-4c12-aa3a-2ee10671e499", "comment": "Malware payload (Heodo)", "value": "50fd109eaac1558b2b371ff08d96d3a88561eab6936748dad5d2fd5f5fb315fcbf807c1baaacde6d18526fc5b28a2e48", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646149133, "uuid": "fa5c8601-7434-4d67-9b15-362ccefe0e3f", "value": "T14BB4AE11B790C076D2AA36342512E3B51AEDBC709AF5838B7FC07B7E5E315918A3835B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646149133, "uuid": "a432fdc2-9a4c-4089-96be-de52ee04f46d", "value": "f08242131de62ca6d7c4b2727b491b3d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646149133, "uuid": "7663d7d6-5003-401d-9ddd-b5d731d43df7", "value": "12288:dbFLiEzuSo9guqHuWjr2pyg4W6SpktSuHE:5VWSo9guW06ZE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646149133, "uuid": "f2b12cd8-4c28-4525-92c0-d5b24e9a5185", "value": 500224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646149133, "uuid": "2bf87889-5621-4dbc-9856-72837c798946", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646149133, "uuid": "a91df9e4-51ee-4a89-8bf6-9fe1d39c391e", "value": "e0ce6c4726302111a1e4e566712316c4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce49a94f-99ab-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646172372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646172372, "uuid": "f540bd65-c85c-4b71-82ee-0a8ed6a78e56", "comment": "Malware payload", "value": "c771febe09cb3e774ffc5fd1e1e03b97", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646172372, "uuid": "3e3e2c35-9bbf-4780-a962-7b4e16a9e0ac", "comment": "Malware payload", "value": "9706155cc3abc97eb4d511e732776c9b2f3a2a01b5416c20e5739dcba8d9f32c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646172372, "uuid": "c058fee1-9457-4646-b670-77fe472051a5", "comment": "Malware payload", "value": "89e2813661689c3e4d1a5cb5ae2ee12b7b358b06", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646172372, "uuid": "804d0090-6e3a-4162-8c05-bd47b08402d2", "comment": "Malware payload", "value": "0136045a7462f548d0d4d846d541fd22d55409f4f1f0aca25cd356e04d0332c290fabcf5a21cd80105ccf416f05896eb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646172372, "uuid": "25bacccf-dc7d-43c3-823d-833be99ad70c", "value": "T17AB4AE11B7D0C072C26A35342926E7B656EEBC719AF583876FD03B7E5E301D18A2835B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646172372, "uuid": "1a91618a-0740-475e-b9aa-1e31d35a4480", "value": "d02245ac5c961d83d0907c826d8ba5c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646172372, "uuid": "3cf4ec36-107c-4857-a1af-eeb69a9efa58", "value": "12288:JhC1q3aXOwkiPs2iCtyjrOAIlgOkar//wJY8Itgm:Jgq3aFkiPs25ar2Bkm8jm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646172372, "uuid": "8c94f124-5504-4678-b330-d5cabfd6f57b", "value": 499712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646172372, "uuid": "28644c69-24ea-4e9f-829f-2ff4269095bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646172372, "uuid": "4b1cc870-26aa-4b6d-854d-7486c26b7b31", "value": "c771febe09cb3e774ffc5fd1e1e03b97", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16e667af-9944-11ec-9275-42010a9c0029", "comment": "Malware payload (njrat)", "timestamp": 1646127826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646127826, "uuid": "4b869451-1dd2-4b3c-8440-f28afd80805a", "comment": "Malware payload (njrat)", "value": "924dce8fb4e56e2358b829bcf30470fa", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "s-400RAT", "colour": "#97A491", "exportable": true, "hide_tag": false }, { "name": "s400", "colour": "#326229", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646127826, "uuid": "565ea826-9522-4f16-9b12-2c1de625026f", "comment": "Malware payload (njrat)", "value": "97b2d807f8c07d9dfa4a7fce2b85f6ae6030b425982ac257ba226bdf357f42bd", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "s-400RAT", "colour": "#97A491", "exportable": true, "hide_tag": false }, { "name": "s400", "colour": "#326229", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646127826, "uuid": "f5012ac6-c9ac-4222-b6e5-7b050c4c47ae", "comment": "Malware payload (njrat)", "value": "f9d7c814de672c435767136f6a09d22d24185ee0", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "s-400RAT", "colour": "#97A491", "exportable": true, "hide_tag": false }, { "name": "s400", "colour": "#326229", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646127826, "uuid": "f656f69f-4e3c-4f38-825b-3e817a296b06", "comment": "Malware payload (njrat)", "value": "5a85d49571c5f5a4c9d7476516a54baa33683656c62ae46663d5e07e4d4aa078efaa555e6fdad05bbf487673bf6bb1d2", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "s-400RAT", "colour": "#97A491", "exportable": true, "hide_tag": false }, { "name": "s400", "colour": "#326229", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646127826, "uuid": "e0a35ca5-3e94-40f7-8e6b-12004cd8b040", "value": "T12254412C3A450AB2ED1D8D3049420A5FBF6E0BC772CCA9A757DB15CA874F1667D8D88C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646127826, "uuid": "5cb43942-2611-4d9a-bc2b-f8b64d2f6f37", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646127826, "uuid": "fa25cc3b-9bd6-4e49-839e-78c3fe56c00e", "value": "3072:R+aKHw+kMs37GHos0b+cQMTyBm541DB5CKhGnZYuA2MMppTPCoraFXnmTz4dKnwF:R+tQMUri1tQOoSpDOSVCbBsbpwAz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646127826, "uuid": "a72572d5-3fe1-4750-9c3d-c3ae4057c45b", "value": 299520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646127826, "uuid": "893fb57c-c4db-468a-8af0-ae5940d1597b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646127826, "uuid": "da24818e-699d-4043-966d-4b10ec9f83df", "value": "s400", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39a414ca-9974-11ec-9275-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1646148500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646148500, "uuid": "456691c7-5016-4bf9-83c5-bb3570896a8e", "comment": "Malware payload (Quakbot)", "value": "15e86cf5648d503eacbd6353f4eecea0", "object_relation": "md5", "Tag": [ { "name": "obama160", "colour": "#127CED", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646148500, "uuid": "f1035d5d-f318-4dbb-a3f1-154a1dfd46ba", "comment": "Malware payload (Quakbot)", "value": "97c2b871d574dde2a068dbccb244a0838575ec0d160b74cde09224fd19227f8b", "object_relation": "sha256", "Tag": [ { "name": "obama160", "colour": "#127CED", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646148500, "uuid": "4e97aab5-262a-46f7-9158-1bdd4f34f667", "comment": "Malware payload (Quakbot)", "value": "bbe988dec07def1279d9ad5a0b4193b56da5068e", "object_relation": "sha1", "Tag": [ { "name": "obama160", "colour": "#127CED", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646148500, "uuid": "f5d52deb-00c1-4aa6-895c-de4b81761c77", "comment": "Malware payload (Quakbot)", "value": "ad9b9e5b564225bd2c00d50ced40c1d9b04ea084f7fd9ebda8d4b63a7f4b077c1cff96a1d2b64aa0f460e3191335c786", "object_relation": "sha3-384", "Tag": [ { "name": "obama160", "colour": "#127CED", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646148500, "uuid": "82e7a690-7253-421b-bd56-931e3f46eb68", "value": "T17974123CE1265806C758E83DC61E4AF8EA0201CA3892FA1B56D4BA1D7DB65F35FDC1D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646148500, "uuid": "4aed15be-67ac-4a43-815b-bd3b94d415cf", "value": "6144:6O2Vjy1WyndEXJF48WIMpuqaqj9NDsA/DUzYeeKjmFQH3K:6Ooy0jnnWIMpucj9NsSQY/KjmFQHa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646148500, "uuid": "30e02f06-2649-4dec-ad38-feb5a648781e", "value": 341145, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646148500, "uuid": "ff1a01cf-efaa-480b-a69c-d3284c14db11", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646148500, "uuid": "f39012f8-e43f-4d79-b21b-dd8c143d6660", "value": "Service-Interrupt-1734251127.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b11a2983-9923-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646113911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646113911, "uuid": "1abee34c-7c59-440c-b39a-8f7d64e04706", "comment": "Malware payload", "value": "610402d12f0104739f6977684d023a3e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646113911, "uuid": "8807ae54-c9b6-4f8d-b5f7-8230953b49ea", "comment": "Malware payload", "value": "985868676595cdcdc7c3939cd45c4c26c7ce076ac64458d5fec417458112f96a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646113911, "uuid": "04e82a90-87ce-443c-81ea-8b6e30070ea1", "comment": "Malware payload", "value": "9f8f2973797742c7616cfd915d8679846b81576f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646113911, "uuid": "b91d7730-1739-4f1a-a7df-822956e4e202", "comment": "Malware payload", "value": "05694c1ed3538901dfb0c93c06c2552837faa241c1e12620e33de5946d9c11d9b432d0bf574bd5cbd9e755c407ea05c2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646113911, "uuid": "1ae3897e-82bc-4ff1-8afd-f9bc61ec9034", "value": "T10CA37E43A5CCB576CB9B02372A94DA3811E82190D7484B02FBFD397ABFC6AD1358E355", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646113911, "uuid": "66511b9c-4569-4601-ab4f-0e1cb7aa7d4f", "value": "4753904c40d638a1bc745c65b88291d5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646113911, "uuid": "1702b8e2-0a9b-45d1-9fbf-bac2a1d3e793", "value": "3072:MprDpBDpkDpJDpwDpODpJDpBDpLDpJDpBDpkDpJ:2rVBVkVJVwVOVJVBVLVJVBVkVJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646113911, "uuid": "1a7ba135-d7dd-4862-a5cf-492b1238f433", "value": 106496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646113911, "uuid": "81fdd734-46df-4e11-bdef-a973dec71746", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646113911, "uuid": "ff78c83e-b3b8-41b1-85dc-9e187ec75f7f", "value": "som1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8da84ee-9985-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1646155988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646155988, "uuid": "75a34bef-e152-4ca9-b099-1c15555ea05f", "comment": "Malware payload (Loki)", "value": "c3b9d37271949c183684311bfa8034ce", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646155988, "uuid": "0006751f-c6f7-41aa-ac7d-a55fba5a10ba", "comment": "Malware payload (Loki)", "value": "98a9103ebca530225b6ba0acb71056e1eb4d188ee3da1f91e454228b5cdecd8f", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646155988, "uuid": "a93c5a94-32b0-4af6-b892-d7b091e6be83", "comment": "Malware payload (Loki)", "value": "ec992aa75cc67aa3e8fb83af606c38dd555de9de", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646155988, "uuid": "03443162-14a5-41f2-bd1d-4a9148decc95", "comment": "Malware payload (Loki)", "value": "4fe425b07d737c12a7e33bf5086e6d22bdc12c0fb02a5dda3375e05a00effaea999620ecb58f912c6239978b1ae76169", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646155988, "uuid": "58a7cb38-9754-4ed1-8674-fc20fac07a2c", "value": "T1FE1402B3275B5CB4FB3A4B3192A361908E5C8D3C96CC562F978C768EB974ED40F09624", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646155988, "uuid": "221658a3-3519-45d1-bea5-3771aac90279", "value": "3072:cPOxMpQkRmeamKoHM64TjRp7Yu9rcNOfzqEAzNQIBLzVizEM90mZJQ5EPxE5VNNd:PxMpGYAjP7Yue0rHAzNQA0lS32ZuNTXJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646155988, "uuid": "c2583486-027c-488f-9506-95c28a745b0c", "value": 190520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646155988, "uuid": "94b93ac6-2470-44e5-8690-0692225620a8", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646155988, "uuid": "0f8ddee6-6bd3-495f-803b-1ab20eef6e88", "value": "Objedn\u00e1vka EUI894MD5684633.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f131085-9934-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646120941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120941, "uuid": "42316848-18db-4317-b4c7-0e2f1ada2bad", "comment": "Malware payload (AgentTesla)", "value": "bceb2947beb83dc477225c807859c4d4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120941, "uuid": "fe4c4d28-74c5-4e59-8590-d2ae8a39a487", "comment": "Malware payload (AgentTesla)", "value": "98ece5051eb90dacb3a7cc149bebe8d5a225ac5ce8511e52b1bdcc43bfeab066", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120941, "uuid": "00161234-c490-45eb-b7fc-c104cd4e490b", "comment": "Malware payload (AgentTesla)", "value": "33fd8b2e05c15110fc7f253d34ac5868fc516210", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120941, "uuid": "c2bf9ffd-cc6f-491a-a313-1279bc980fa0", "comment": "Malware payload (AgentTesla)", "value": "df953c2b4f30aa141e4ba6a6f754874e7070a08d77fa09dd70708180d03fb4b79a8aad52c5bc8f6bdd552eee96467cb2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120941, "uuid": "16a82a55-f2b9-461a-8abd-49b3959f3b8f", "value": "T1F81412C335686996D2968A3142066AE124FBCF871FC87419706A3F293339CC977B8797", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120941, "uuid": "e610179a-4048-4349-9fcf-fcf27072df1f", "value": "3072:RsSnI53i8ntZ/vcjrWiAFLyFNumPMqNSXGMAs3qVMQII7OgHU9fweTnI/xNLyccm:RAf3cja/8WmPMqoyVMQ5KIkfBnI/bOcx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646120941, "uuid": "335aa503-adfc-4208-b962-c2a0359a4b28", "value": 190936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646120941, "uuid": "58340b79-7ced-4d76-9c25-c1ff2c40b358", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120941, "uuid": "6daefec6-81f3-469f-970c-a01e09d23950", "value": "RFQ #246601.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2516173d-9933-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646120548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120548, "uuid": "6fa47c00-b3bd-44e8-b5bd-844936e80c84", "comment": "Malware payload (Heodo)", "value": "8df89c7b350b4e04289b877e53f3d5e0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120548, "uuid": "720b8425-d91a-4cc6-ba3b-3b0dc405e114", "comment": "Malware payload (Heodo)", "value": "98fd2b85201df89ba0cf02397dbe50e24ec406e7e338a9852dd673c21590b944", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120548, "uuid": "9d197d24-eff6-4403-a399-99af9a61a5a6", "comment": "Malware payload (Heodo)", "value": "bcccff069e661af1e8a093e331d93783c61cdd9b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120548, "uuid": "707e4e45-a80d-4a0d-a965-a570b5761f8d", "comment": "Malware payload (Heodo)", "value": "514b0effeb65e87e7fd6eedb3ea0b1bb6b6e984494d9023ce27421138c3dd1cbb801260433527ea38613f8e2145560fc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120548, "uuid": "93111fce-c814-44f4-840a-f2064fc08dc0", "value": "T11FB46B992251F077D11B503D0BCC2AAD7EEB88F09A6DF27FD2A3558D0F31190A62D993", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120548, "uuid": "055ee379-b5ca-433f-8e7a-e737e0252c7a", "value": "42fe0d732d1bb90c6a7a1bcfb8ef88aa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120548, "uuid": "718af244-0549-4a92-8211-738f715c8143", "value": "6144:cH4C1DzgG1GCQw2HOOnPE10JQNqftvrC4cHV9jp6YagzSAIVCL4Ry:cYC14G1GUgOOs14Qkftm1xpdIVCLqy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646120548, "uuid": "26a13ed3-f0e0-4118-b77c-545050c66c96", "value": 528384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646120548, "uuid": "6cee6ae7-e726-48b6-963c-a79e885f99aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120548, "uuid": "7c21818d-0b02-4053-820e-6dede0a5b03f", "value": "8df89c7b350b4e04289b877e53f3d5e0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae116fb6-99a3-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646168882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646168882, "uuid": "39e91200-7998-4a07-b9ed-f5ba3f94bfcf", "comment": "Malware payload", "value": "bb3a3b9c197abc71a2720573665bb213", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646168882, "uuid": "5fe1a2b6-2039-4836-8865-661652430c58", "comment": "Malware payload", "value": "9904015ffab7c7744e0329faa4b4ed68c61f1a32c26779f9bc188d47c7d9a6a5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646168882, "uuid": "cddfbc4d-27dc-47eb-90a6-6c24535b7e22", "comment": "Malware payload", "value": "6a4d4ff4bab6ad30b060e0fd9e52dd4eac1c2b2e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646168882, "uuid": "62043989-4fb3-408d-bda9-772878098e67", "comment": "Malware payload", "value": "2a089abcdd33ea9d8046fa5a7e159aec6d3ae427fccde07b0e2e16251370280187b5d4d8c60555de4c25e7f2360e8801", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646168882, "uuid": "9dd53736-e74c-4096-bb66-a4b36faa43b1", "value": "T1F7B4AE11B790C076D2AA36342512E3B51AEDBC709AF5838B7FC07B7E5E315918A3835B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646168882, "uuid": "2e4a3f6f-dc63-4538-b123-bbf80e19cadb", "value": "f08242131de62ca6d7c4b2727b491b3d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646168882, "uuid": "b8debecd-0fa4-430d-96e8-d700ed5f67ef", "value": "12288:dbFLiEzuSo9guqHuWjr2py94W6SpktSuHE:5VWSo9guWJ6ZE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646168882, "uuid": "13b998f6-005c-469d-b881-8ddaef672c6d", "value": 500224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646168882, "uuid": "c5f7dd79-7d27-4270-a78b-43f119308688", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646168882, "uuid": "cef151b4-a72c-490d-88c9-cabf9148c7e1", "value": "bb3a3b9c197abc71a2720573665bb213", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25e8d2ea-9933-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646120550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120550, "uuid": "60d8f1d7-613a-40f8-b9b7-843ca51e3c12", "comment": "Malware payload (Formbook)", "value": "d3b0890958fc3038c2affa9b15d55732", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120550, "uuid": "d084db1e-5223-493c-ade7-aa5c9a3a04d0", "comment": "Malware payload (Formbook)", "value": "99270de85a3bac3a39ba03973c1a317a3006396b16f166afdb667cdd515d8fc3", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120550, "uuid": "ee717152-2cd7-42c3-81ef-2d4264d135ec", "comment": "Malware payload (Formbook)", "value": "ffec3490eb109a6e661e4e845f16c5571e79f2bb", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120550, "uuid": "be3d2f8f-0530-4c29-b0bf-c9fba5094fc4", "comment": "Malware payload (Formbook)", "value": "075982442a11ae279b13f0d574ad98ad375f2e6742d5805512da69e9f1202bc0fcad8ed0378c1ea179548ea9814489a2", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120550, "uuid": "cad57819-cbaa-4abe-a250-46b06e9b519a", "value": "T14A1412D67F910313F4B6B73151948D1089A1CE87B2197A47D3833B3EF536B81E8AA74A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120550, "uuid": "69dbcda2-a817-4783-862f-742347cc88a7", "value": "3072:4ktGpzS6ljndvGQT2yii/XDeLTCMRWomc5Qp6o22/sC9xo2Gv9drwnuSiPmPKM42:HczpdvVSyiMXDeKMRWoF72ovwnuJM50W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646120550, "uuid": "982260bc-af2e-48bd-8da9-e02b234f924b", "value": 190408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646120550, "uuid": "ff9020c6-6568-4852-96db-8c356fd36847", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120550, "uuid": "9d7c741b-b7df-437a-b3b2-a36f9996b3bb", "value": "BYS-ORDER 10058 SC TRIFTECH SRL.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16359b54-9986-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646156171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646156171, "uuid": "d80ff4d1-d9cd-4689-9a29-cb5f57614619", "comment": "Malware payload", "value": "82a109663711ff522335f9b32ca13a44", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646156171, "uuid": "ba3b1849-61d8-4116-91f3-22fcc76f03fa", "comment": "Malware payload", "value": "992b01c5a49f04f3f55c4486b2850ada9b0cd17a32770b7f83063d5474f10258", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646156171, "uuid": "10f97c07-c80c-4bdc-a9b9-431e04120c16", "comment": "Malware payload", "value": "4b89476f81f8b1d86462e0c093cec1589751c186", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646156171, "uuid": "939df225-978d-46a5-9648-8c8f90225299", "comment": "Malware payload", "value": "5fe7855e51f8c474675d3e9fe7df5a0499d57f73eaaba22eb1938b300c2c172650bb972fcc0e13e72ad93304d202c564", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646156171, "uuid": "4d802bbd-41f3-473b-b391-5997b17f4428", "value": "T1DD04C776AE2E8793CB7A22458CC03F4A2702FBA521D040E7619D049FDFAF115C6936BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646156171, "uuid": "01c4441f-5093-49d2-8224-1f125d9cbee6", "value": "1536:GwEn02RNEqMcoXWkYoNmQopHowZ/OCd8XaYCS5AVe8KzEr3CGGmmJ9LcoXrl0RTd:112wbVMGqpu0CX3Vo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646156171, "uuid": "ff8c1bb3-f90d-478e-9796-ae3ee3ffd35b", "value": 189763, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646156171, "uuid": "891f718f-f591-443f-89b3-19d99c3ec727", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646156171, "uuid": "12bb50e3-23f6-4284-b4b7-6c3c2ae46169", "value": "DOC 0321 PDF.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53be36ae-9933-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1646120626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120626, "uuid": "ecbb117c-4b81-4976-b4fd-80fcb7379dc1", "comment": "Malware payload (Loki)", "value": "3ff19d4280b56e7dec2b1bc723fc6299", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120626, "uuid": "91e85656-b439-4bb9-984a-14abd80d37a5", "comment": "Malware payload (Loki)", "value": "999b2f02d0f927d5f39f3671d66f75d441fd197d89a1be4687006d29e6eaed38", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120626, "uuid": "99d04f80-376b-4972-9c39-3b848d75f5ba", "comment": "Malware payload (Loki)", "value": "03477d30ef7b64289a874f7e95db2d47e4ea75e7", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120626, "uuid": "7c417491-330f-417a-828d-0fc6198b6a7a", "comment": "Malware payload (Loki)", "value": "febc5f6b2c3fbb44b7717ff21b536b20b42b45a993c7058e63d53833c0266b6a1591a3e7554185d3337f6a33812094e6", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120626, "uuid": "8639abe1-c1e4-4226-91ae-5ee7b88d5153", "value": "T1C5141231B90A3914CA7190367F7BA231C1F9EC062A48E51258F73C51763EF5A3E6A3E4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120626, "uuid": "45aebb9c-571e-4223-8e15-7848dba2948e", "value": "3072:sj9ieGeKnevfy2+vWRSpn/Nl53PQNtDCUO2539lFrJkkB+XWrKyZQTfD+A9X1iyu:Cse50qD+O8plX3oNtDRO0jrJkkBdGyZP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646120626, "uuid": "c46055b4-cbd4-49ba-8244-cb7c2fa587e4", "value": 190616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646120626, "uuid": "d5084c50-9caa-4699-aec5-8bd870104de5", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120626, "uuid": "c06c82f0-a2a6-449c-9641-57b8aaee84a4", "value": "Proforma Invoice.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c81248a-9970-11ec-9275-42010a9c0029", "comment": "Malware payload (Renamer)", "timestamp": 1646146894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646146894, "uuid": "ba1ff35e-5ae1-42c7-8ffe-92fa0bb15c7f", "comment": "Malware payload (Renamer)", "value": "1fbde983832d8ed3e1efbd266172c950", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Renamer", "colour": "#E80499", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646146894, "uuid": "a9e341a5-7bb1-44b1-8825-6630f05bc6f9", "comment": "Malware payload (Renamer)", "value": "9a6baf125f3312798b220c8bcc8b68d03cec7398e0a11591e32904456ae72b96", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Renamer", "colour": "#E80499", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646146894, "uuid": "38bfe570-df24-47b8-80f0-8158a9044d58", "comment": "Malware payload (Renamer)", "value": "e69a88440c8eefc41c2e48d252c2eccf23e0970a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Renamer", "colour": "#E80499", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646146894, "uuid": "2c6ed289-edce-46bd-8cb4-0fc2a64bf393", "comment": "Malware payload (Renamer)", "value": "43cc4043454ea297533a25173f0c8d80342842ff4461a9d37cf51874e71f6a0e2148d913d5a42981edcdc074b075b1a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Renamer", "colour": "#E80499", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646146894, "uuid": "ed2efcee-0be0-4020-9cfc-4b1008f1c9c0", "value": "T10675F10B9DEF1177FC552B70D42648B310FBF9F60E464722B6E1EA0D2A70FA165384A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646146894, "uuid": "06307336-3c6d-43c2-b1e7-bfba0e524fed", "value": "2f095340e94ca508e3b83fb009ebf4cc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646146894, "uuid": "39632bd3-1406-4822-8929-41a3e79ddcf0", "value": "24576:ScCT67wHqWis4l+jIACFr5hqjiLDpSJDN93pqb6W8cU4gLQOA:jCpn8t74iA3qb6W8cU4Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646146894, "uuid": "3cf94e45-5376-418a-a7ea-9b5588342245", "value": 1576960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646146894, "uuid": "8ca7888b-5805-4483-915c-33593ef8f889", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646146894, "uuid": "0896a367-2ab6-43e6-ad39-5008904445e2", "value": "1fbde983832d8ed3e1efbd266172c950_img_000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12979846-9929-11ec-9275-42010a9c0029", "comment": "Malware payload (NetWire)", "timestamp": 1646116222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646116222, "uuid": "1d4825e6-0310-436f-b4d4-1e424eaa6860", "comment": "Malware payload (NetWire)", "value": "7ca03a524246c40d38e8e42e194fd4de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646116222, "uuid": "9af87f42-30c4-4fc7-a875-76b62ea27fea", "comment": "Malware payload (NetWire)", "value": "9b697bd07f78c00751511ba619ba1a018d3628378d7e2d6c7ba35ceb9e99cac4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646116222, "uuid": "b9c79689-f904-45da-b0cb-7b7e636af744", "comment": "Malware payload (NetWire)", "value": "5c67b18a2027fabf5a2c07cd4a1e9534aa623192", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646116222, "uuid": "04098a0e-d306-4f0a-8225-632e49d159b3", "comment": "Malware payload (NetWire)", "value": "21964c4b31d095b619e692902989fa6a220fa08139b59c6259d988c861ccae1d317d103d6a369b74cc338a0eec2b54e2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646116222, "uuid": "8b496586-79bd-401e-97f0-b25eed8a67ee", "value": "T19CA46AC6E9409576D54B9631227CBE2E4A1A6FF4306DCA1448EC3C5B7C71B0E36A3DA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646116222, "uuid": "1fead718-6586-419c-8eb1-ad19e3feec96", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646116222, "uuid": "69f06398-bd9e-45d1-8d46-8b364c84e138", "value": "6144:IGiZdPcmSAV6UVPaV9iT8yN9BpaPRkXaXm8lbiJBefcKLVXg23oOEyB:gdPcmSAPPge8y/qWXaXm8p4KLVXnEI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646116222, "uuid": "8a9a038f-9bac-4361-9f6f-fc1ca05f9ffb", "value": 486155, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646116222, "uuid": "d3937f2b-540b-4d8f-a4fe-a81530b82fbd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646116222, "uuid": "d05abdf4-b902-4829-93aa-2dd5e6be4317", "value": "SMCB005.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "507a4c01-9958-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646136512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646136512, "uuid": "e62bb098-cda7-4755-bc78-5fa1e3bd2a9b", "comment": "Malware payload", "value": "f242cffd9926c0ccf94af3bf16b6e527", "object_relation": "md5", "Tag": [ { "name": "Daxin", "colour": "#652B35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646136512, "uuid": "87b42132-813e-431d-b664-d563dae983cd", "comment": "Malware payload", "value": "9c2f3e9811f7d0c7463eaa1ee6f39c23f902f3797b80891590b43bbe0fdf0e51", "object_relation": "sha256", "Tag": [ { "name": "Daxin", "colour": "#652B35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646136512, "uuid": "00135205-7692-476c-9e50-f94f28c8f37f", "comment": "Malware payload", "value": "53f776d9a183c42b93960b270dddeafba74eb3fb", "object_relation": "sha1", "Tag": [ { "name": "Daxin", "colour": "#652B35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646136512, "uuid": "0679a27f-b062-4713-a447-8e6b5a7dd29f", "comment": "Malware payload", "value": "98ddc4e249e4dc00c92c62a112903817af261c80a02ee6d93fdbbed54a1e4de931501db2d17031af158a40dbb4e94d80", "object_relation": "sha3-384", "Tag": [ { "name": "Daxin", "colour": "#652B35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646136512, "uuid": "92960048-53bc-4a69-8866-96c5f6310fa0", "value": "T1CE920603D7824EE1DE1218BA4D53377A723B9C790B0A29C3CF74F9B50DB9311362A656", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646136512, "uuid": "1cfabbd8-5dd7-43fe-b92d-965a8905c3f7", "value": "a09170ef09c55cdca9472c02cb1f2647", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646136512, "uuid": "e4bc5ca0-4f74-4b95-9819-f2f4dddee439", "value": "384:mUlo/J86xgC5xfeCeDPTVcy37Cwv2KDTDs7C4Cg5bL8+yE:mzRJDjeCeDPTnevKDTDs79vK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646136512, "uuid": "af164c54-d8c3-45b8-ab5b-ac54a6f8d5b9", "value": 20992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646136512, "uuid": "7f64f970-bf6a-4a6a-9fff-f4388886f8f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646136512, "uuid": "74464370-f454-45a4-b784-093660a470b7", "value": "9c2f3e9811f7d0c7463eaa1ee6f39c23f902f3797b80891590b43bbe0fdf0e51", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7fef75e-9931-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1646119989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646119989, "uuid": "1fcec3a3-c7e0-4154-b8d5-9059261505b3", "comment": "Malware payload (RedLineStealer)", "value": "61cdbe8d9eabea25bf527e97fe5d970a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646119989, "uuid": "58abfc32-af33-45b6-9c8b-0161d57fccb2", "comment": "Malware payload (RedLineStealer)", "value": "9cf23d0f84927f21d9c64833b8f94b549ea1ed8f224424318faf0afd50d91381", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646119989, "uuid": "52633ae4-6437-477f-a2be-701e67d70c59", "comment": "Malware payload (RedLineStealer)", "value": "9e323d00bc8cdb2dd3c75688fd9477bbbfce31a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646119989, "uuid": "bb88055f-ed38-4313-9c6b-48c1d61810e2", "comment": "Malware payload (RedLineStealer)", "value": "bd6457f5452a415bfe63c8eb168e83ffe7db1da4495c35ef004eb5274d102ee3593861faf853ea7c599b2df45eb29ca1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646119989, "uuid": "999105ac-95ba-4006-9b44-2bb6b976b7c5", "value": "T1255533036EBABE23D6C9267C5EBCDEC67416462650C5CA4C328000A557E8B79F5FFAD0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646119989, "uuid": "04d9c9ba-b815-4d2c-9ec0-8b16511fb146", "value": "af6857c781dfdd4a92085a009ef0df60", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646119989, "uuid": "de51255d-80a1-43f7-905d-59e66106b37f", "value": "24576:BnMOdbXHVJ1zll7U3ZJyc/kQGnzczCoGKvR2WcaeOI8rtfQyoLojRzVQRINPa/d:BMOdL1J1Bl7U3tkQGholpfNIHFotzOI2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646119989, "uuid": "b31df260-a482-4387-a950-c7f0042f9ed2", "value": 1331712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646119989, "uuid": "956f51e0-7f25-4cb4-80d3-12f2420c1d19", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646119989, "uuid": "c3cf5385-3eaf-43c0-8838-461016283770", "value": "61cdbe8d9eabea25bf527e97fe5d970a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed02fb0f-9986-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646156532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646156532, "uuid": "da53a7d7-db02-4dea-813f-d6337b108738", "comment": "Malware payload (Formbook)", "value": "77c4c15577df0b8ed521d561b9ddfe98", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646156532, "uuid": "0340b9c6-9785-488a-aa2e-030f911c2ab6", "comment": "Malware payload (Formbook)", "value": "9d42e6621d13c43c63721e4f9b4f63c00ef1d7e97cb0fe061bd19cbcc6e2e735", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646156532, "uuid": "93b8e321-855f-4208-a2bd-29e3219bb1e4", "comment": "Malware payload (Formbook)", "value": "a77558ac34449954136d35b38f6a1505bf9417ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646156532, "uuid": "758ca9eb-75a2-4ad4-ad9e-383e562a166d", "comment": "Malware payload (Formbook)", "value": "55a3747a9afe1c75e32fd9e3e630d3dffee3522fb1605b09bb627a2a8052c518b145f1916198b083c0bae755741fa692", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646156532, "uuid": "98f7bd88-b73f-4ac3-b135-3f8f58f2fcea", "value": "T16D15BF4835D6203DE8368BB2CAC0EFF1DB6DF122D64961B654020E29560DBBDCA45EFD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646156532, "uuid": "593ad172-9d98-4f4c-a62b-8056a79109eb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646156532, "uuid": "d33c8466-4107-4b45-a3bc-0751ae639aa3", "value": "12288:MfIqT58eG1LKEfL5uF+t+BAE3dlyO8PhERw9XGN0qIHqu47veJCryve8hJ4EoC3c:+8Bg2LUF4ydlyO8PQyXWT/6JCeV74", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646156532, "uuid": "ce3b5a8c-4f25-4b1b-a1ce-d3713c5d07f7", "value": 906752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646156532, "uuid": "5ac6043f-92b7-48fb-8381-ad88d1238b0e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646156532, "uuid": "541228a3-841f-4561-b381-39cf0ceb9422", "value": "77c4c15577df0b8ed521d561b9ddfe98.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d1da66a-9949-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1646130091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646130091, "uuid": "4b2720b3-c840-4010-a9e7-a4dd4117a928", "comment": "Malware payload (RedLineStealer)", "value": "b1f0d745afee95dd59e3d7664927a435", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646130091, "uuid": "7ca0abc4-e4cf-4370-8cdf-6c64168fb831", "comment": "Malware payload (RedLineStealer)", "value": "9ecbeb3b7dcf4ca651b3d3b59dd97a7b4e45ef033407b948fe327231f0dd2c8a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646130091, "uuid": "f2be74c4-7ac6-4cc5-8c54-bae914159452", "comment": "Malware payload (RedLineStealer)", "value": "99dfd4ad7a4f00a94e3f10bdc49096d0244b6512", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646130091, "uuid": "3f4d6924-03bb-4569-aa9d-ff2b4a5eb7d3", "comment": "Malware payload (RedLineStealer)", "value": "0922a346454bf9ccee1f8977de95af35f7d9643050adc07d00aa7feeebc36a842ca0c6ce018844878be09dbb3b4057aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646130091, "uuid": "016c9e4a-56f9-418e-8f1f-3e1378075cbf", "value": "T181A34AA067CC5664E2FE4F706CB8119447F4E083A802DB9F5ECA70DA1F76B80E6567B1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646130091, "uuid": "04c7c2a1-488e-4fce-b234-ef4aab93894a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646130091, "uuid": "e98d2d48-40e2-4ae4-877b-8b1ed288be0a", "value": "3072:LucUJyuC6Yz0/kgOtfy/kBBMY9pZLT6tgnqOyu:LucMicMlXd6tb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646130091, "uuid": "f24e2c85-88c3-4c0b-83bd-f8361800f7a6", "value": 105472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646130091, "uuid": "9a5f80cc-8f31-49f6-bd9e-2c6a245b4ca5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646130091, "uuid": "11049c37-6e3a-4faa-984a-a824d8926f06", "value": "b1f0d745afee95dd59e3d7664927a435.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba1daf0e-9942-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646127241, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646127241, "uuid": "a971687f-3f70-49ca-9407-a31f6bf69ba3", "comment": "Malware payload (Formbook)", "value": "1d7e5d52daae05976bc354a4c063e1af", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646127241, "uuid": "f8821afb-51b6-4f86-96f0-647d2dd543ed", "comment": "Malware payload (Formbook)", "value": "9f033092c39f84850b90bbeb99c2fa53bb621a8467cdf399f77e08bfa892548d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646127241, "uuid": "efe4c9fa-7d87-47a1-a85d-58fc32020619", "comment": "Malware payload (Formbook)", "value": "a90b4b9ebe9ed8fe1bff262639229136efde32f5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646127241, "uuid": "894423a0-095c-4902-82d3-c196eb5b1b69", "comment": "Malware payload (Formbook)", "value": "bf11dcbe05c0d54c78db5ad094421d0682350b991f48f358bd28e611cd46c27adc3275406ca0e0adab0bfbf1c272054d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646127241, "uuid": "b00c1eec-a30e-4061-872b-23379c0e4cc8", "value": "T12A15BF4835D6607DE8378BB1DAD4EFE0DB2DF232D54960B250020E69860DBBD8A45EFD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646127241, "uuid": "154c48a6-c2aa-4030-9c4e-1208ae000d13", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646127241, "uuid": "5707a708-6518-4621-8d21-1775e16dbc40", "value": "12288:tgVZRCoisGK/bGiuRRz42OKNa/tjVnkpiWuZMQsySpJHMrGiqtzg1p65IFR/7:ajisHDg14PFVXKQsyAJHiFqtzg1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646127241, "uuid": "df0230d0-a4b7-4aec-abc4-8153383dd603", "value": 890880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646127241, "uuid": "fa0d249b-00ff-4cbd-8672-575183d3abad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646127241, "uuid": "4fa6dcb5-7936-4c71-99f5-a233793b3597", "value": "1d7e5d52daae05976bc354a4c063e1af", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc573ffb-9975-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646149149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646149149, "uuid": "dca22580-c951-4349-bb0d-2d53777c3aa5", "comment": "Malware payload (Heodo)", "value": "58854b1b6434ef1535464b4f8b8af04e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646149149, "uuid": "b2eec276-5f94-4ce8-bda3-baf541ba7d16", "comment": "Malware payload (Heodo)", "value": "9f2dbfff89ca14ff1f739a3ee2daf786c31382d16c034442513d4c225940970e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646149149, "uuid": "6a61578d-b926-4945-b81a-3ce7fe75da97", "comment": "Malware payload (Heodo)", "value": "260b38a63b7edc35d019dfeccdabd74232191cd1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646149149, "uuid": "a61caddb-05ad-49e1-8031-a13c28c68046", "comment": "Malware payload (Heodo)", "value": "ad63000c37c2e731d81dbff669429705c5454505ceb5971bda07f53dc84be610b00083f4fccb85bb3f3a43b37c0e9b79", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646149149, "uuid": "fb8b3958-0a2e-4bb6-a1aa-628e8f5b89d9", "value": "T101B4AE11B790C076D2AA36342512E3B51AEDBC709AF5838B7FC07B7E5E315918A3835B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646149149, "uuid": "00510849-a5b3-4d72-9b32-1f64d61995fc", "value": "f08242131de62ca6d7c4b2727b491b3d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646149149, "uuid": "51b6e103-edb0-44ea-927f-741821165682", "value": "12288:dbFLiEzuSo9guqHuWjr2pyT4W6SpktSuHE:5VWSo9guWb6ZE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646149149, "uuid": "cfd252ab-7327-4ea7-9926-b7281377e4aa", "value": 500224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646149149, "uuid": "edf7fc0c-1fc6-4f1f-a048-fd13723a6632", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646149149, "uuid": "98b34460-1238-4858-a56b-136548155484", "value": "58854b1b6434ef1535464b4f8b8af04e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe83a0a2-9976-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646149689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646149689, "uuid": "9f8f784b-f5b8-481d-82e6-a650dafbafd3", "comment": "Malware payload (Heodo)", "value": "5ab8410ff8fbf25b5fa6dc1dc8c1f288", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646149689, "uuid": "88983d63-720c-4eb0-96e1-e910db51d849", "comment": "Malware payload (Heodo)", "value": "9f2ef79c44b0bea1235e5082022ecaf61a8056cddf124261513eceff54973014", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646149689, "uuid": "7b0529ba-2297-4e90-a4f9-048a861ce699", "comment": "Malware payload (Heodo)", "value": "e75bf157b1d9ea023a11aa4eb8ede90b8c4b4b3d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646149689, "uuid": "84f2ff84-01a3-4d6e-af01-314b8e7869ed", "comment": "Malware payload (Heodo)", "value": "c122ff0310b41594c4d8f9f801d1a71ba75133d86588c6110335c527af0c8ca463604b83a15dfbb59ed3024dd488f1fe", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646149689, "uuid": "d32c2400-7304-47b9-aa98-2b4480c3b05f", "value": "T136B4AE12B790C076D1AA36342526A7B51AEDBC709EF5C3876FD03B7E5E301918A3C35A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646149689, "uuid": "39d8fa10-85de-4586-a2ea-bc09688e65b6", "value": "f08242131de62ca6d7c4b2727b491b3d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646149689, "uuid": "0ca083a7-60e0-48f6-ab3c-5ac3a7e14477", "value": "12288:jE3TMKM/JjdkdO4+BNhOwyL4h43JopSz/o:jE3TM/JjdkSm3Ko", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646149689, "uuid": "89589084-00c3-4807-8acc-b188551a1e16", "value": 505856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646149689, "uuid": "52e6030e-3b9c-4b54-a773-ab1281822a40", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646149689, "uuid": "e2d450c2-7fb6-456b-bd41-94c66bfd04c8", "value": "5ab8410ff8fbf25b5fa6dc1dc8c1f288", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17c389b0-995b-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646137706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646137706, "uuid": "471b07cc-e67e-4f61-9c7f-3b79b636eccb", "comment": "Malware payload (Formbook)", "value": "a871d83cb44146e1bf79593c9ee4b034", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646137706, "uuid": "4336b0ea-eeb9-4eb3-8d93-4900f915d9dd", "comment": "Malware payload (Formbook)", "value": "a063d307f617ab45107768d3fdad71b52920604304328c34200a640a064b65b6", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646137706, "uuid": "a81a10a4-c2e6-4712-8ab7-8e86e17f4495", "comment": "Malware payload (Formbook)", "value": "878291ba01ff79f0e45faa532741c76e080fc39e", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646137706, "uuid": "1799ec6b-c57f-4369-823b-87262321c5d3", "comment": "Malware payload (Formbook)", "value": "93bae7d2643d7379dac9cedf3084cce5c4ecc5d8124d3b193a86b9aeef657c48ad9e7f7e57a2c415c5748360ad4b1854", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646137706, "uuid": "75892fe8-d488-4cc6-923b-01b336552775", "value": "T1D9F433D212BF84B659878D78CB7ED935C4CA3C4127BC02FC8BAC1DAEE95DA62C4055E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646137706, "uuid": "6f469a27-5bea-4405-bb21-80249d82da4e", "value": "12288:XJg6VwjnonbABNTfNgt3Hx4UlAZUlEu/uEYgqcjTjT:qMwjEUret3R4U4Vu/uEYg7TjT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646137706, "uuid": "988c9d0e-1f48-458d-afa9-c989232b73b0", "value": 743097, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646137706, "uuid": "b1926da2-c839-4aa1-b24b-40afd880159b", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646137706, "uuid": "e6f56b23-359a-4f41-9ea0-992efb10120f", "value": "SOA for Jan.2022.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "430396a0-9958-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646136490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646136490, "uuid": "7792c910-ec12-4a5a-af22-a22b655cfaf6", "comment": "Malware payload", "value": "bf14555b3a8378ab1276642160b52ffe", "object_relation": "md5", "Tag": [ { "name": "Daxin", "colour": "#652B35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646136490, "uuid": "99bd043d-2311-4439-81df-961ce63492b0", "comment": "Malware payload", "value": "a0ac5f7d41e9801b531f8ca333c31021c5e064f13699dbd72f3dfd429f19bb26", "object_relation": "sha256", "Tag": [ { "name": "Daxin", "colour": "#652B35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646136490, "uuid": "b33f1a3c-5a46-4a51-a46f-ddb518c61dba", "comment": "Malware payload", "value": "e5f4ec79c3d4cb85732265ff668f852afff5143f", "object_relation": "sha1", "Tag": [ { "name": "Daxin", "colour": "#652B35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646136490, "uuid": "657c6eb4-d59f-48e9-b066-1b810f00e2a3", "comment": "Malware payload", "value": "95c4b30050534f266f44785c04ffbb8a3aa65f7df7ac232787235d1ee5e70d5dc99adbe7ab0356e2c37b16e39bfc7422", "object_relation": "sha3-384", "Tag": [ { "name": "Daxin", "colour": "#652B35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646136490, "uuid": "5944352c-4a9a-4a44-8bf0-9429868985a5", "value": "T1D0243B49769840B5ED67C278CDA34A81E2B2785A07349BCF13A443B99F3F7E0963D721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646136490, "uuid": "139247ed-2989-45e4-8798-c0358bd46692", "value": "7b27efcd74f4597c081a7b6d52d4bdb5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646136490, "uuid": "717b13da-075f-4af4-8e43-f07120fa35ab", "value": "3072:d5kOotJcfxJTJiaJITjRNrw3Hs2dFTt8x4zBcz+fqnqbnsd3WIoK6LaFG:d2Ttox9sTtmHs2dNtziz+qn9FoK6Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646136490, "uuid": "9e45ed19-080b-4e99-84b3-25d780bd0f51", "value": 215296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646136490, "uuid": "5a86f5a9-4501-42ab-b24a-4b2dc5553931", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646136490, "uuid": "a0ffe982-12c8-4c09-b195-e560ec2cf273", "value": "a0ac5f7d41e9801b531f8ca333c31021c5e064f13699dbd72f3dfd429f19bb26", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08fb19f6-9977-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646149707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646149707, "uuid": "1abe22f5-6d0d-47a0-861e-90fe34808048", "comment": "Malware payload (Heodo)", "value": "25b8419ce9aa00391bd9ec0fe6e43431", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646149707, "uuid": "16a292a2-055c-4d1b-96b7-bcd1f5735ff7", "comment": "Malware payload (Heodo)", "value": "a0cfb5933669cb5486704f2e91bff2b2656550cc7a84072ff5ef7217c3e5f0f8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646149707, "uuid": "07647daf-60f0-4ecf-9f34-18201f72163c", "comment": "Malware payload (Heodo)", "value": "3ace2dbf4addb68b2a8d2d219015b5119358b75b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646149707, "uuid": "76214554-c6b7-42b8-8965-2f97b4c7ccc3", "comment": "Malware payload (Heodo)", "value": "96eb538f2e72559c601a53e0b74e45fad6b71e62f165cb3aa4bacf41c97f1a4dce0e0257c261684c7385faac2a38059f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646149707, "uuid": "08735c72-400e-47e2-91da-ffce954bf4cc", "value": "T1E9B4AE11B790C076D2AA36342512E3B51AEDBC709AF5838B7FC07B7E5E315918A3835B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646149707, "uuid": "f03315ac-119b-4815-b6f8-ad00f8975eff", "value": "f08242131de62ca6d7c4b2727b491b3d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646149707, "uuid": "48c63749-2e88-4be7-97c4-695ea45f03e6", "value": "12288:dbFLiEzuSo9guqHuWjr2pyx4W6SpktSuHE:5VWSo9guWR6ZE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646149707, "uuid": "9b3c0192-0bff-40f3-9668-2dff8bd610a9", "value": 500224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646149707, "uuid": "53c0e23f-dbf6-4c5b-8c89-d719cec3e7f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646149707, "uuid": "f0109518-5378-473d-94b5-421ccdd6c9c2", "value": "25b8419ce9aa00391bd9ec0fe6e43431", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cad11994-99ab-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646172366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646172366, "uuid": "d987bbd5-8fb8-46ce-ac68-20126e67d9e9", "comment": "Malware payload", "value": "b0f7776db83180f5edacc432c33e16d8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646172366, "uuid": "99b335ea-eea1-458f-92af-29cbe0a2cf24", "comment": "Malware payload", "value": "a123d928f4d0f49fa2017ff6ba6f4757998e82ceb4f7c21fd06241fce5980389", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646172366, "uuid": "863432c2-008f-4a77-af81-89cf7ad9e396", "comment": "Malware payload", "value": "0a75cf9018d7c1f024f27aba84f234797520ad3f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646172366, "uuid": "1f9dd28d-408a-47fd-9bb6-49327734140c", "comment": "Malware payload", "value": "7dc483b49455d993228e053aeed953f38076bff5d16a0352c467520f44805fe3d35426fbcc220303dd6a70e711a58a72", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646172366, "uuid": "9ca2a2e8-e63f-4853-ab13-033d6fe2999a", "value": "T1C6B4AE11B7D0C072C26A35342926E7B656EEBC719AF583876FD03B7E5E301D18A2835B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646172366, "uuid": "33dd713e-32b3-4385-a2a0-89df159ed140", "value": "d02245ac5c961d83d0907c826d8ba5c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646172366, "uuid": "d7336922-49a1-4b2d-a90c-8fc6f9377141", "value": "12288:JhC1q3aXOwkiPs2iCtyjUOAIlgOkar//wJY8Itgm:Jgq3aFkiPs25aU2Bkm8jm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646172366, "uuid": "edc102c1-432d-4b90-a692-e1d69619ce26", "value": 499712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646172366, "uuid": "36555533-1481-41a8-be0c-c772cd08f70a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646172366, "uuid": "5e1c5527-f613-4fd9-97c1-7ef38d796cea", "value": "b0f7776db83180f5edacc432c33e16d8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ec0483c-992c-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646117638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646117638, "uuid": "48e8549f-b8c1-4e54-8c8d-6c5fb855fb76", "comment": "Malware payload (AgentTesla)", "value": "d2188e7be76eb500e71eba0722645f57", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646117638, "uuid": "f410f08c-ecbe-478b-89c8-efe15ce7d464", "comment": "Malware payload (AgentTesla)", "value": "a29dc8c9bbdce6051f0fec60ae89dec2f893cdb8f7674ef3e3e7ce32861ffa73", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646117638, "uuid": "ea5a952e-3dfb-408d-b556-67f6b86f7cd8", "comment": "Malware payload (AgentTesla)", "value": "f2e60f545d9cc9a6b5da5f3453e70fc7cdd98dd3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646117638, "uuid": "b7dec131-7a1d-425e-ba9d-9856f82cbb92", "comment": "Malware payload (AgentTesla)", "value": "8e4fee0fe7ab435bb28cd82f2b0ce3422157be20d0fb5a6eefc76dd0c4eaf879ef4bf683f4a63934e7c034be6c114d9f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646117638, "uuid": "5c01c431-2379-463c-b801-044fe09efb4f", "value": "T14F05C00439E65038F93A8BF1CAC0EBF1DB6EF261E48970F554000E555A46BBC895AEFD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646117638, "uuid": "8d1b4ef2-410a-47ad-ab11-46759b83f315", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646117638, "uuid": "91dcb9a3-4dde-4f7b-9fe9-5e78d44e494b", "value": "24576:avf41s0rZ1rPJC6MmSR0VxDEcSllaD2B:T1dXXHE7llh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646117638, "uuid": "26b31178-8ea3-44bc-8376-0aa60fb4f17e", "value": 832512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646117638, "uuid": "fb9055bb-9e7c-4912-abf1-85a790dc8449", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646117638, "uuid": "1532bcc3-07ac-4b4a-8e69-b61cc1b51dc5", "value": "GSC_RFQ021410.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f08376d-9923-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646113854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646113854, "uuid": "8201cd92-7efa-4508-844f-99acb230fade", "comment": "Malware payload", "value": "99a0bd893f5dfa24451a0cbee35eefe6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646113854, "uuid": "0e423c31-0d05-490f-8072-c9e20410e442", "comment": "Malware payload", "value": "a41801b5edb8c0de6db3ec5be5ed07ca10b5473adee7df6edca82c2178e61744", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646113854, "uuid": "cfb2d493-8280-441d-b4f2-3aa20dd59222", "comment": "Malware payload", "value": "ad3343e0ebf1d5a47831a65f6d897721f381bf2b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646113854, "uuid": "9b329c2b-e57f-4e6e-af12-92b817a39cca", "comment": "Malware payload", "value": "835e33542097dcc22c66b39dcc6c50a510501fae66cb00f236834f9b9d951ecbf87b3934a0e9e3904c0f311d3a7da693", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646113854, "uuid": "b73a8031-81c7-48c5-b95e-26f3dbfbaece", "value": "T12EF67E43A5CCB576CB9B02372A94DA3811E82190D7484B02FBFD397ABFC6AD1358E355", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646113854, "uuid": "d55345a3-c871-453a-8e80-b19376ba599c", "value": "4753904c40d638a1bc745c65b88291d5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646113854, "uuid": "a0424534-b747-40ed-a43b-234af680f843", "value": "6144:2iV8VDVJVDV8VDVaVDV8VDVLVDV8VDVaVDV8VDVCVDV8VDVaVDV8VDVLVDV8VDVy:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646113854, "uuid": "3cc1c28c-666a-41f5-aac7-78dea8ce2fa8", "value": 16211968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646113854, "uuid": "f7f2474e-f29f-49bc-af9e-29bbd7677388", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646113854, "uuid": "584c8e51-284e-4297-aa47-a6ec3628fa82", "value": "large.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "818257d8-9941-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1646126716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646126716, "uuid": "4ccbee47-6eae-4f5c-8f20-1d04339cba11", "comment": "Malware payload (Loki)", "value": "8083bba388194bb9674cf7011a596dd7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646126716, "uuid": "166dd8d8-d43c-41ba-a94e-1fe5dcc48b10", "comment": "Malware payload (Loki)", "value": "a4182d8f62fb365856798683af6277ad0c3b3a9d9788fe1e2cef07bb918197d6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646126716, "uuid": "1722dd9b-899d-4e57-95fd-3b638161bac7", "comment": "Malware payload (Loki)", "value": "7337b819dfae38bf80dfb174fa3ae9929cda3d79", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646126716, "uuid": "6cd45b3b-d0d8-4911-b6b0-3257afaf0e3e", "comment": "Malware payload (Loki)", "value": "bbe15a7fbd2e869212b909b85ca097a194b8b9dbb6026c7df014d49d9b13ac7afcbd73fa53cc294c0a0324942f820beb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646126716, "uuid": "233da733-15ea-4d22-b066-2c8bfdf0f9ff", "value": "T10934D0127690C472C4873570447BCBFD6A7AF831C6A5894BB7A83B6E2F303D2677521A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646126716, "uuid": "79787966-5b1c-49e2-a62a-d60940f3c2f5", "value": "cc5860ebf1cc8027858fa120fb15d15c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646126716, "uuid": "7496653f-41cb-4ff0-8671-26ab6a40950a", "value": "3072:eVDMyNKxjC0GNImGDiIPHNH2G6bh+lOHS0Jt1gZ5BojukWv:ofosaHNHlR50P1Tj5Wv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646126716, "uuid": "f7b2ee70-450e-4fd8-b723-c7902a28c96b", "value": 250880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646126716, "uuid": "c72a8b21-ffe2-41da-8b81-7c7a1eac8034", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646126716, "uuid": "2bd6c5db-2564-4824-9900-9a74e4b9533d", "value": "8083bba388194bb9674cf7011a596dd7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59724a8e-9934-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646121065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646121065, "uuid": "d6a6d8d2-2bdf-43a2-8be2-0fa9e5070049", "comment": "Malware payload", "value": "02bc2953e55c6a1123b1c28a38ee7ea9", "object_relation": "md5", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646121065, "uuid": "179db8ad-1147-4e66-b80e-c0c01e82597e", "comment": "Malware payload", "value": "a4e51503957292fe946f001fdcaf2b6ac7cd935c7bca80d5f79754c14d93e03d", "object_relation": "sha256", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646121065, "uuid": "41651958-1f54-486e-a4c4-00b456c0938d", "comment": "Malware payload", "value": "9cc36597a4578f8c1aadcd82b186a4d48843f723", "object_relation": "sha1", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646121065, "uuid": "a9da589e-3530-49bd-9eb0-3a845d34a549", "comment": "Malware payload", "value": "435b858b737a0d49813addb784298347bf6f8296d38ae02313d7d6750277f30b9f3f9d1398edca86b8f1cab3ae92a0eb", "object_relation": "sha3-384", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646121065, "uuid": "552b87c8-01c3-4c1d-bb9c-1887be269626", "value": "T1D9B15D86B795157BC0741D38D398D43022E6E822FF8AB31225C353F9EC14BD4C769413", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646121065, "uuid": "b54f936a-da04-42dd-851d-a9b8627c0e53", "value": "48:ZvtfeszQNxQKArfxBW57Hob7wmkFB0Gj1BkM/aWESSvHqeqBxeWu:Z12szOagjRtFB0U1MWEQ1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646121065, "uuid": "ccfdb0c6-f5f1-46ca-b188-f9b24138f182", "value": 5120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646121065, "uuid": "6dd35c95-e20f-4309-8e38-324def0452e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646121065, "uuid": "3c33be9c-4e9f-491b-9d1d-3013980ba85d", "value": "DAR_ NALJART TECHNOLOGY_PREORDER LIST.xll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21f569ef-9933-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646120543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120543, "uuid": "e51b8ae9-fdc5-447b-a8bd-378f348c0ea7", "comment": "Malware payload (Formbook)", "value": "f7cb5ea79a2368058de3200b33d29299", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120543, "uuid": "229865c8-c5e4-45ae-9525-ec3672902539", "comment": "Malware payload (Formbook)", "value": "a5384f1bf449ba64b2a02fab01450b7aad5dca4d8c7250760ae9facd42026c7d", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120543, "uuid": "6bdde399-8096-4c6f-9700-204f776e9ba9", "comment": "Malware payload (Formbook)", "value": "bbdc015a4ffc54540692aac93178cfffc3173e3e", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120543, "uuid": "3bfb018d-9af3-465a-b8f3-9d114c0222c4", "comment": "Malware payload (Formbook)", "value": "c78c12b30dfb19eb9ea5a4bf15aa72663600a39ef26c87c7e0f8d5c3724c574263cdec3600e34663a952fd9d9ac2fdc2", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120543, "uuid": "9c605339-feb8-473a-b17f-c1b64937d87d", "value": "T1AF0412ABB6403B62F8AD567C3897BD3C1150FD6CA41B7E62606332755A38D3806B4F71", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120543, "uuid": "d64592ce-53de-4548-8500-b12fb4d48786", "value": "3072:zaiD1n+67QbryZcW9JkLY7Vz0LCPl4M03oDWdo9aMf/NapV4D:mQ1+zuZxJkLYy2Pl4Plo9aMf/NmeD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646120543, "uuid": "ed58b111-4916-435f-b40c-76c825cc7caa", "value": 190136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646120543, "uuid": "641183c5-1b5d-42cc-b354-bc213a12fbae", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120543, "uuid": "8784a690-f2f9-4c33-8934-49b96a8a919e", "value": "Awb_shipping_BL_receipt_0360000000000000122.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9ec61df-992c-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646117765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646117765, "uuid": "959823b0-fcd1-4e1c-b491-8549145119e3", "comment": "Malware payload (AgentTesla)", "value": "5fb11d8e11791a92b6995da895a2a79c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646117765, "uuid": "cd0cbc8f-c22e-4a60-9e29-edd76fa0ba3a", "comment": "Malware payload (AgentTesla)", "value": "a547b69be049d99ca791aa10851d5f2b369edd54e748ea23e06c6bab3dd006ab", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646117765, "uuid": "0b74ebc6-063c-46c2-bebc-ff03e93b4c03", "comment": "Malware payload (AgentTesla)", "value": "e759a7d1fa685af1a98aa5a9ae8b821aeabef6b6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646117765, "uuid": "36d5f5e0-d05c-40b6-a8cf-0da12692851a", "comment": "Malware payload (AgentTesla)", "value": "99afda571203e3563d651c95ccce1e5797ad20895e20c04a06f12c6887f9fe48422234ba0be91fe1a6ecdc58fbbebc12", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646117765, "uuid": "ca29dc84-2d52-495e-9732-5b05607c4622", "value": "T10225E00266D817CACB1971B6C0212F54C3BDE8E1A29BF7CA8ED670B64E71B507B09753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646117765, "uuid": "91e507ec-f36c-4e62-8c5d-dcf48b46e848", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646117765, "uuid": "2126d5aa-e1f7-4ed4-a3c9-671b61685f44", "value": "24576:SVt6bzGWoXrTFgQOQ21gXPDiAp/FMuUa:SX6byTFy1bI/vUa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646117765, "uuid": "28a4cb7c-c3cb-4cad-afb7-d6c852a0cfd3", "value": 1054720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646117765, "uuid": "b66a1638-1c20-4883-86ea-f1ef5054bfbf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646117765, "uuid": "f2a514f7-f350-44f1-9b51-86ddc1f11b4d", "value": "MNG Kargo Takip.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6848b23b-991f-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646112071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646112071, "uuid": "97538654-4eee-4d3e-9f0a-c46df4bd8cf2", "comment": "Malware payload (Formbook)", "value": "b287e91faea6a7d8602297d95e1a8e39", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646112071, "uuid": "9596470a-d637-4a22-b53a-b12407e3e323", "comment": "Malware payload (Formbook)", "value": "a608c335a71c2d4e38ce67af529bf6e9bdc84555cdce0269eae7d5539fa33549", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646112071, "uuid": "4dccd846-e280-45ae-babb-a817ad2fa990", "comment": "Malware payload (Formbook)", "value": "8c2b0ae13524aa051d561de911168c0ac585b8d5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646112071, "uuid": "fc7846d8-8955-4566-918c-5be1758de400", "comment": "Malware payload (Formbook)", "value": "fbf93f050e0ff2618202c57f331979aef8160b255e6a28753e2f83f0dc33c9cbb94fec9f7fb85addf9686962287d5e1d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646112071, "uuid": "1babd237-3a97-46b3-83d1-3d1367bd905c", "value": "T105F4BF0438E65038F93A9BF1CAC1EBF1DB6EF261E48974F654000E558A45BBC8949EFD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646112071, "uuid": "d420e095-af23-40dc-8079-fd6c98ae6ee3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646112071, "uuid": "bd5f8990-18d2-4396-9bb3-8c4d371119d0", "value": "12288:7EX0R/I60njztfvAZJsj7JcIVy3VdMgphi+oJRE8eaEJ+m5rulveu+KsLEEh3kbT:4jzFksjaIVGVG+ouJDulGRLaYaQ2zxLT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646112071, "uuid": "c0c11025-1a87-4081-a054-07c528925666", "value": 762368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646112071, "uuid": "feba304f-19c7-40e8-98b8-6362df88518a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646112071, "uuid": "9338e82d-9243-4463-8662-2c67745137b9", "value": "RFQ-Bid supporting Documents.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d9eca76-9984-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1646155459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646155459, "uuid": "06e6fc42-af44-4277-9a9c-b177fae172d3", "comment": "Malware payload (SnakeKeylogger)", "value": "72e3ee0f02c8adfc6f66ace4425b88ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646155459, "uuid": "dc41381c-edc5-4dfb-8c57-12ec2df0f910", "comment": "Malware payload (SnakeKeylogger)", "value": "a64c9f86c81f1199da10ce77c2935ef55759afe8f45a64a4f2da07b60857f248", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646155459, "uuid": "ff8f2012-6662-487b-9409-1255e167f6af", "comment": "Malware payload (SnakeKeylogger)", "value": "1287c39763db92e1fe0f5c09c7a1a03473f24bed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646155459, "uuid": "e4929f4e-7f4c-443a-9075-45d75a97e30c", "comment": "Malware payload (SnakeKeylogger)", "value": "b581d2001f34ffdb3e0b24b907cbc8bea20005d343c049f0b9a245750ba320a0b392bbaa093320971127fd147d27922b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646155459, "uuid": "0aeba2fe-4e46-44e9-8c20-4337293ffab4", "value": "T166622A5AA7D88372DD740F3668635B4007B4FE01AD22F25E3ED4722B1FB36E05972622", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646155459, "uuid": "fd692ddb-e761-49ac-b7cb-0df6facb493e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646155459, "uuid": "b96e0b16-2976-441c-8bb3-5e5844cd7181", "value": "192:1INqymAG5bN2GZoe5WpzQq6KFItllA5ziir3TkKH5KAWQwolb:CkymAG5brZoegRIa/Lwol", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646155459, "uuid": "0235ad26-b32b-4810-8e79-55e9021639d4", "value": 15872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646155459, "uuid": "24efc8aa-decd-4a4f-829e-5781b844ef9f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646155459, "uuid": "c4574f9b-e259-4ccb-a43d-b10c318217b5", "value": "Halkbank_Ekstre_20211018_082357_541079.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e11ffcc-999f-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646167003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646167003, "uuid": "4fff8786-b9f1-4e23-86a7-94730ab3c32e", "comment": "Malware payload (Formbook)", "value": "cfddc31fa56b6e1a80f29386769bd19e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646167003, "uuid": "f98463ab-663c-4703-8a55-7f792b090c25", "comment": "Malware payload (Formbook)", "value": "a65fa640ac023cb2207b4707ca53b54ac80fab579b1ab598637850a003b4f2e4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646167003, "uuid": "318eafd2-a2d2-436b-bfdb-df569bbb4dc9", "comment": "Malware payload (Formbook)", "value": "78b41e3c049f5dca11aa3c9679f757461cabea7d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646167003, "uuid": "2c771109-af98-4223-9439-bd80267f0ad4", "comment": "Malware payload (Formbook)", "value": "6d7ceb7cd5937d694246a26cf9d7e3186d3a93a820ceec7718351bee34687d1a00f9b4b1d25a730914b1ae0acd5521d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646167003, "uuid": "518d7ab0-8ac0-42c6-95ad-ccae89e51bca", "value": "T10174221A52C541A7C782047609BB7A1EFFFBA2D801865AE76FA14F1C493C7EEE50C538", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646167003, "uuid": "233883d9-252b-47e4-b31a-6ee7bc7dc09a", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646167003, "uuid": "ac025013-7215-4394-adac-fc993d297a11", "value": "6144:rGinZreRjskqUeS4uNaCT57GEUZ8YINwWkL1incQH5hLUr8ZFrfnBjw:bZCRsseBZCT5CEUIK4XhLUYFrG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646167003, "uuid": "9d435180-a39f-4ae7-818e-f1c0fb5e11b5", "value": 347740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646167003, "uuid": "174b2787-5ad3-41d5-b0a5-b15e1ee894ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646167003, "uuid": "c5f2fe41-8627-4e11-aee5-2e5bf2e7a6ea", "value": "comprovante de pagamento.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f2f76c5-995e-11ec-9275-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1646138980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646138980, "uuid": "21e6e24f-45da-4020-ba52-60107238d80a", "comment": "Malware payload (Quakbot)", "value": "736b3818dc50e4dc23da9e52bd97e1dc", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646138980, "uuid": "463f2864-d7e3-4e5c-85c5-87046618c3c6", "comment": "Malware payload (Quakbot)", "value": "a6ba8a487c1028f36f9bf7f4f85eb72041bfbac31eb6be2a35e58d588736020a", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646138980, "uuid": "bc84ff90-48f2-485c-8410-c0e0310b41b3", "comment": "Malware payload (Quakbot)", "value": "e501c5cab5dc6b426041880a935960aacb64f395", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646138980, "uuid": "0c0e3a77-6b76-41dd-a3cd-8c552aa7b86d", "comment": "Malware payload (Quakbot)", "value": "f55afcaf5573d03afb0d17bf06000ec53b53624ed49b4d9e905db1c1dfbb6f13d6cb489a1011d470aeae552052722d5d", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646138980, "uuid": "fa8885bd-11e2-4754-9677-f95bc57414d4", "value": "T1BD440200B821A171CB35B97D61F2471202C11F15BB21C9C9336EADECAFB6DE72B959C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646138980, "uuid": "ff74d4e2-0053-4736-ad9f-660f16b7a3a1", "value": "6144:GjXuwmXNnZKKH4goy/pIGw7w/b1T/oJrjafmH3n0S:GjXWXNMKuy/aG6w/bp+iI3n0S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646138980, "uuid": "bf734d1c-c3ed-47c4-91f8-36cde88660be", "value": 268457, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646138980, "uuid": "c3f5e3e2-448e-4f93-bb19-6422da5038a0", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646138980, "uuid": "3f70a730-f162-48a0-818b-7d2bc3b32062", "value": "alquuostas.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42064f1f-996c-11ec-9275-42010a9c0029", "comment": "Malware payload (Hydra)", "timestamp": 1646145078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646145078, "uuid": "5d916f39-60c6-478d-91ee-9a1b0e63467a", "comment": "Malware payload (Hydra)", "value": "e5445cda1bf1f82fc1fd4edb1317c41f", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "tor-hydra", "colour": "#10AB92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646145078, "uuid": "90b7e92d-b863-4875-9a02-fb3f0df1548a", "comment": "Malware payload (Hydra)", "value": "a6d27ba039ac9cb0d5a6a3cffca2002feb9ecb8cfed54ce5c0a768064084d43d", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "tor-hydra", "colour": "#10AB92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646145078, "uuid": "8d16b7a4-229a-4b9f-8f2c-e2d5c44b0b96", "comment": "Malware payload (Hydra)", "value": "8b3d7122a94bb1694e1d3e33cbbd056e4350598b", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "tor-hydra", "colour": "#10AB92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646145078, "uuid": "eb7d4788-edfc-4824-be72-d0bb53f6e2d2", "comment": "Malware payload (Hydra)", "value": "81886f6cf915cad2a2c945269f4b474f7baf71c358a496f405c3c8b12b39b126ac6e31f1dff0907d596efd6bd4f42bab", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "tor-hydra", "colour": "#10AB92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646145078, "uuid": "b38a5e38-9871-4810-9c7e-cd19dd3c5bab", "value": "T158663315C9929E0AF6B2BAF02F70D2B5E67DCFDE0A66849B7215762830753C01F02D97", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646145078, "uuid": "1042f874-d05c-4afe-a09e-d545510dc000", "value": "196608:m8+atol4aXiwsyOKu/EywCJ8Uvqjn1AzA3dU6Ecsk:m8+ayeNwsL3Nw7UvqjKQU69sk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646145078, "uuid": "2a174e9f-7508-4aad-a655-bcfc508cabf1", "value": 6523758, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646145078, "uuid": "44c4e223-42dd-4953-b242-3cd7c2723a92", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646145078, "uuid": "65f3593f-ce5d-46a7-954c-6d60ee332de2", "value": "bawag.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9941e5c-998e-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646159935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646159935, "uuid": "35b7bb98-4252-42d1-b507-89479aed7694", "comment": "Malware payload (Heodo)", "value": "7befa3e5a7609184a0d7546b58af5928", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646159935, "uuid": "de58254d-5f4d-4182-8090-763c2dddecbc", "comment": "Malware payload (Heodo)", "value": "a7059a1c49c68c3663fbf135af44eeff76c6949873bc704d43603a3cad6b30cb", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646159935, "uuid": "09f815b7-cec6-41dc-bd4d-544fcccc3fc1", "comment": "Malware payload (Heodo)", "value": "175bcb4e82998c7d3274efc1840a29ae62621125", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646159935, "uuid": "bbfca47b-a0a5-45f1-85bd-90c820f4f0c2", "comment": "Malware payload (Heodo)", "value": "ccc539fc8155f2ff13ae35b2a73ce930d187b5ae1266f6b41e76dba91fc9bf9fef36d0b0c1cfb50b9688ae999c2349c6", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646159935, "uuid": "68e516b2-10a5-45e8-9961-7c05b3aa61b8", "value": "T13923D025C1607828C73E8C759200EAD2720A7D04D9D5EF893585BB4C3B96BEB57AF9CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646159935, "uuid": "67a7ce4f-6089-4ced-a913-2e62812cd301", "value": "768:iio9DOevZCwrvtD608zdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Uh0VPWft:iio9D7UtT5fTR4Lh1NisFYBc3cr+UqVC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646159935, "uuid": "94da00fc-cb80-4beb-a6f1-1eb7170ff396", "value": 47699, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646159935, "uuid": "4f235b2c-2959-4793-8dcc-a3244f5281fc", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646159935, "uuid": "333d3058-410b-43ac-b074-1133d7db4610", "value": "MEDIA 10.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "099709a6-9945-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646128233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646128233, "uuid": "fbe6eef5-baeb-4d66-9135-8b6e4c1b9a05", "comment": "Malware payload (AgentTesla)", "value": "a47f3f1bd8839b82141549600b654f97", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646128233, "uuid": "834bb687-5f74-4684-ac29-cde8d6bab89c", "comment": "Malware payload (AgentTesla)", "value": "a70b59af9ea18cba7742f354542fe3c0f141ce7613a9684a95434a586584d799", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646128233, "uuid": "4ac977d7-53de-4c14-b10f-004d31c3aa19", "comment": "Malware payload (AgentTesla)", "value": "a0ec864d42de4fa2552e4ffa17bbcd27bd9ab666", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646128233, "uuid": "65c03247-7351-450d-a13f-ec9477e75efd", "comment": "Malware payload (AgentTesla)", "value": "7721106c665e5e8e5f385b77401cbba7c60bdc7ab5c7906ac22d1553cdca2c8c608733eda66f58446d24e4cad2c3bdb1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646128233, "uuid": "02983ab9-da13-470e-abaf-6095003d5ffa", "value": "T1747423812BF1D6BF15F60F8723D028AB41F9537994061FD618786ABDA760573C34EB82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646128233, "uuid": "ee922160-e635-4381-a15a-49d2e2ab100a", "value": "6144:mm/tXQxkUDJ4OuWfHT0BMtMFdELJ+mEXWf4cb1biHT+IfRBnDraDAqAK:mm1WkDWfTJtN+9Gf4cOCwXAZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646128233, "uuid": "f705b722-8213-43c3-86ef-ba934afb6718", "value": 352930, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646128233, "uuid": "e2e26c6d-65ce-40e2-bdb1-bb4bd906f5d8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646128233, "uuid": "f0ae7440-7e38-421f-87ab-1c6d488e52e4", "value": "Purchase order.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ca27b12-9991-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646161121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646161121, "uuid": "3a0e8f0d-1835-4b19-b01a-77b3c7aa3c68", "comment": "Malware payload (Formbook)", "value": "49a37450f9714d912237c368c69dd406", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646161121, "uuid": "57b92764-60e3-440d-859e-9e06297008bc", "comment": "Malware payload (Formbook)", "value": "a71e32c316d38a8ed867e32672cc48624e1e716f8a339e29dc57108216b0bc8a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646161121, "uuid": "3215a3a7-e4f3-4a9e-8a52-d88c8a1eb919", "comment": "Malware payload (Formbook)", "value": "c6f9d09dd93f605b373f3a78147780cc21c6a0c4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646161121, "uuid": "26e94f55-ad11-486a-b66e-ccd53daa4bb8", "comment": "Malware payload (Formbook)", "value": "f05733a47555f197e0019fa119121efd8fab3c540b66d05d69b84c6d9486f0593a4e83e151d0a3dc65cac0497e2c1f55", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646161121, "uuid": "23199c93-19ca-406f-9efe-da5b359cae40", "value": "T1E605231047AC8756D2ED87FEB0EA01155FB5E42B210AFB8CCEC4A1FC09A23D185676E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646161121, "uuid": "ac90d61a-aae1-46e2-ba29-9df36b545e7e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646161121, "uuid": "3854c544-18c2-4df4-a181-93e67543fcd2", "value": "12288:24NPj5PDIUlv2rDB+jhd0gux0frukytPVX7LOdXIYQDNqIAuaRt6KBFVJIW:9TLV2rDBt70CkytPVUdIMbjVJj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646161121, "uuid": "6cc0935f-3a8f-4799-a0e6-f83464812b35", "value": 861696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646161121, "uuid": "a0fddce6-f61d-4dbd-9ac7-861dabe1a945", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646161121, "uuid": "76bb2037-5c2f-4847-8450-3240a1cbd866", "value": "49a37450f9714d912237c368c69dd406", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24656eb5-9987-11ec-9275-42010a9c0029", "comment": "Malware payload (BazaLoader)", "timestamp": 1646156625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646156625, "uuid": "305bdbde-f8ba-44f1-baa0-7c13075d314e", "comment": "Malware payload (BazaLoader)", "value": "393003c2037fb3fa70c4b27a54822b6e", "object_relation": "md5", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646156625, "uuid": "05b88777-587c-4bf2-83e4-b04ef764749d", "comment": "Malware payload (BazaLoader)", "value": "a7ba1534413b5991efe9bffdea193e4651ae3b3526645677b711fee7719404cd", "object_relation": "sha256", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646156625, "uuid": "8964def1-c866-4ec4-a7ac-8b0689caabe3", "comment": "Malware payload (BazaLoader)", "value": "6e08e04ec581f7f7ea130daa78213d1c320708ea", "object_relation": "sha1", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646156625, "uuid": "eff1b232-a777-43d6-bcf6-72f0337c8177", "comment": "Malware payload (BazaLoader)", "value": "495b71dbe3eb4bdd6ef8bad91f22141a73fdd47df9b7d9ab377d402c519dd1deb0a4a515bdc1ce19e0286f6c2e78239e", "object_relation": "sha3-384", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646156625, "uuid": "f20f7fad-f270-4531-9ce1-fd30107a4e0c", "value": "T1A1F4D06A66A837B4F0135474CD674A03CAB17C7127B191EB9793324B8D3ABE4173BB12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646156625, "uuid": "406781c1-ca24-4d39-b7c6-bebfa8e071ef", "value": "64e5d7cce23479085f2b5c15b028487f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646156625, "uuid": "99266d17-b36a-47a9-98d4-5fa926aed8a4", "value": "12288:jb2Z46I1dVNykv7csRVVPRWYco1fQTBYPjffcvAFF5tyS7Hf:jb2o1dXykDrRbPRWPQfRPL0vAFN7Hf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646156625, "uuid": "4e3f3417-5ede-416e-a35d-933747d1bc92", "value": 729212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646156625, "uuid": "be9a75e8-a67a-42e3-bbf9-5ff6feaf09ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646156625, "uuid": "0998c187-5d68-4274-b22a-72448df4dd7a", "value": "393003c2037fb3fa70c4b27a54822b6e.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4001cb75-9932-11ec-9275-42010a9c0029", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1646120164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120164, "uuid": "58e8b15d-976a-4c0e-87f5-5d0f49530954", "comment": "Malware payload (ArkeiStealer)", "value": "2335b8319552c730f82387c7863ca05a", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120164, "uuid": "a1df203d-569c-46f7-acea-5e5ada0c1a31", "comment": "Malware payload (ArkeiStealer)", "value": "a857b02662fd0cc423a8dc4213dca0167ff87f303190bf329213a1d9ee246069", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120164, "uuid": "4e35b4d5-b07d-45bf-9b16-2bacd6bcfc80", "comment": "Malware payload (ArkeiStealer)", "value": "ed19f55576184707091b1d54340d2a33f360a193", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120164, "uuid": "914271ae-be08-470a-8a27-c9cfebf66060", "comment": "Malware payload (ArkeiStealer)", "value": "34fbe0140aeb6ae09956e9889405daeacc831bf44ec8fa95d036f99f8b06a382c3261a31acfd15f5d4b2536273c6455d", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120164, "uuid": "caa892ff-f518-4d91-9954-5882279423d6", "value": "T1D3D412117D98E07DC49E16745864C2A45EBAB82135B29C77BB683B9ACF303E16F3520E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120164, "uuid": "892e08c1-b8ac-4910-8b35-966b93802f04", "value": "88ed5feb1133c38cdb474dc3586a1931", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120164, "uuid": "ba1c9175-a3cd-4552-808e-2430dacdd7e1", "value": "12288:LMFAEudYYlaxWcyR1KBTf42I3j0oOPIMiAO+I1rqd9F52bJaDU:wAQYqXeKR4c/iAO+IYd9D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646120164, "uuid": "f72f4452-8084-4525-806a-8037d8ef128d", "value": 626688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646120164, "uuid": "b0902484-c775-4f0c-ab93-2e4a46a3a4d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120164, "uuid": "3d640d78-c456-4abd-92f3-d749fdc2bb4f", "value": "2335b8319552c730f82387c7863ca05a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e2cc5c2-9933-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1646120617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120617, "uuid": "f28a2659-9db7-4f73-8e74-a806d021a312", "comment": "Malware payload (Loki)", "value": "08c536068565ada401094065bae7ec6c", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120617, "uuid": "89b6f4d7-2b8c-4c95-b170-980dd7a31b29", "comment": "Malware payload (Loki)", "value": "a86d44829a8f135976e7991ecb7a29748c6c71202b62f1092ed2a5108a32036c", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120617, "uuid": "a00d26f5-ee96-4a3d-bdff-0ba9e6d53279", "comment": "Malware payload (Loki)", "value": "9e3cf2bc67c3f4664ffc1ec3a6af11f1e9af5305", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120617, "uuid": "b3f087dc-4f69-40b0-8d9e-5be3306a061c", "comment": "Malware payload (Loki)", "value": "da69f52de35639e1791050169613e4b7b0405c424a7fa1f94ce81487b27385f2f5c9ffcca3b825c89cf8752d0dad4b96", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120617, "uuid": "a0c86f9a-08ad-403b-a3e6-127e3f3ac904", "value": "T1DE14129EE924B8BCE36A88B5C806D79C1151FC17EF4731796DB637CE2936D8D8813221", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120617, "uuid": "7298b118-b670-4dfe-94ba-97f1352b232f", "value": "3072:fZI7ByI1yynOKpPhqV0wZ7Ttn9mK7i1xTsSbG/e1OgYA5OAjuTLg2ddkeopXMJUC:BIdx1ROKppA0wZ770G/4dzgE2ddapcJN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646120617, "uuid": "33e37bcf-3bac-4082-885f-1622d8c7c413", "value": 190600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646120617, "uuid": "730d6a2a-0681-4292-852e-c42086e35a3d", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120617, "uuid": "1555f5a2-85c3-4966-8b82-fa7b100d078b", "value": "Revised PO 10178685.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac4c3ddf-9975-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646149122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646149122, "uuid": "01566ee8-a1e7-4b9c-a0e4-e62b332b842e", "comment": "Malware payload (Heodo)", "value": "c64f396f3c5ed3928ca8b4ae8feec0ed", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646149122, "uuid": "754aa206-63ac-4733-96ab-c3eb6dbafdf9", "comment": "Malware payload (Heodo)", "value": "a87b7fa6770c08df19d3abef923a77992cebdd2a354290e7b512fe962fac4d2c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646149122, "uuid": "5a60cb16-0a46-420b-919c-ba34b0e37c9e", "comment": "Malware payload (Heodo)", "value": "089499a325c823fd8895232a87ba8cb3ca8d7825", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646149122, "uuid": "95495e84-449f-4499-b35c-0c8e866b53e0", "comment": "Malware payload (Heodo)", "value": "4879fb2d1c82e83849be0d19d6f290894b878e0f50fc7ae6aae8e511d3dbc13c420da7d49a4738b0fe151fa888634188", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646149122, "uuid": "2d079cf4-f709-45ca-b5f5-a6b174fdae52", "value": "T1FFB4AE11B790C076D2AA36342512E3B51AEDBC709AF5838B7FC07B7E5E315918A3835B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646149122, "uuid": "b81ea5a5-5408-4544-9dbd-dc98a783071e", "value": "f08242131de62ca6d7c4b2727b491b3d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646149122, "uuid": "8c29e3c0-ee69-4ea2-a80d-43a4af1f0244", "value": "12288:dbFLiEzuSo9guqHuWjr2pys4W6SpktSuHE:5VWSo9guWw6ZE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646149122, "uuid": "7ba52884-9104-4f47-8852-34ebbde1183c", "value": 500224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646149122, "uuid": "9825268e-6407-420f-8745-79001b84022d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646149122, "uuid": "69e2dacf-b8f2-417b-933d-32fa47457bbf", "value": "c64f396f3c5ed3928ca8b4ae8feec0ed", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6aee76c3-9941-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646126678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646126678, "uuid": "acb665a4-b357-4e02-8aee-9c6a22c03121", "comment": "Malware payload (Formbook)", "value": "8771a231ceb9676bcfe954442c26581e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646126678, "uuid": "839d16e3-f6aa-4025-bd7d-8b72e7f67300", "comment": "Malware payload (Formbook)", "value": "a8d57222d66a26a6ef7fe2d8eeb11a8af7ea9693afcbb31eece3519379c07784", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646126678, "uuid": "9e5c0440-560f-45f6-a252-769baf48383f", "comment": "Malware payload (Formbook)", "value": "e40ed09832894cb483afa384a4c1ea9f1f45b2d1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646126678, "uuid": "54b5e1d1-d015-432a-a183-3dd461674dbf", "comment": "Malware payload (Formbook)", "value": "09933cafd68a3c76acd492d1d66030e8baec253b7cc294589403546f01a4fc98509aacf0cbbc0c9b2ecc9f126d3e4ff6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646126678, "uuid": "48683898-5232-4142-a2b7-94af85d738e7", "value": "T1B70522E453AC8DB1D2FC82F994E6088087F0FA629023D37BC9D854E52A693C154BF9D7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646126678, "uuid": "6647338c-b9f1-4e8f-b10d-6a84fbef1873", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646126678, "uuid": "a581de04-f2f2-4605-a59c-d9095873991e", "value": "24576:2YnU42L4abzldKuFc7whdgRfjJv4FCHxZG:7U3LlnjKuG7whWK4H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646126678, "uuid": "38088e3c-809b-4b3e-8ccc-b261d2f6a201", "value": 810496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646126678, "uuid": "98e25c86-271d-4139-8cab-dbeecc6daa0c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646126678, "uuid": "a6c9df59-6d85-4353-a26f-e152f71f8a32", "value": "8771a231ceb9676bcfe954442c26581e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de667ad5-9942-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646127301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646127301, "uuid": "0cb78f5b-4c21-4fb9-a92e-0fb6724c6dd3", "comment": "Malware payload (Heodo)", "value": "567b257e2cec523ad2453c6460b39ba5", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646127301, "uuid": "ffc51aa7-fae7-433a-855b-956d807b8017", "comment": "Malware payload (Heodo)", "value": "a8dd33aefe2f736f605ddad7638c3f1f18faa2ad17682018bf0e46c85c2e3e38", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646127301, "uuid": "b3bd6d36-5864-49bf-9e1c-113f67e4aab1", "comment": "Malware payload (Heodo)", "value": "8baccde0d6eb11ac1f83bbcb82a14a755844baa9", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646127301, "uuid": "d203274f-0f26-4a7f-b177-5645167c69bb", "comment": "Malware payload (Heodo)", "value": "affbbf2099ec748cfd68c729ae18979008f5fa79114deacbf6692c2bb2a57a361582e09c8a23e09a792b2de30a567bc0", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646127301, "uuid": "ccbc70c3-c2a5-4797-9ab3-f804a98c5095", "value": "T1F913E029C4961A9DD737293DD6148EF4124C0E4A96A0FD8F1D44A3AC276A1FB0B4FCB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646127301, "uuid": "9b98332d-dacb-4b20-a904-804555c5f22e", "value": "768:zomihd8DOevZCwt79yKfcrND59V+L9Rw4eWrXcTqZ0VfEw/5:zom8eDNylND59V4jwmXc2CVfEA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646127301, "uuid": "4e091e6a-5a28-4ba1-8368-4961f25c54fc", "value": 41813, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646127301, "uuid": "2e60a798-9afd-4492-9980-77740598d1b1", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646127301, "uuid": "d5f5d370-70ad-45a5-9db3-da820c68d73f", "value": "MES_0103.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28b5f43e-999d-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646166081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646166081, "uuid": "456c4aa3-00cb-48f2-9688-96b338e77e15", "comment": "Malware payload", "value": "4d968bbdcf80b5fa85f3a20c0328036e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646166081, "uuid": "4f56c9d1-8845-4228-9676-67fa6c15d341", "comment": "Malware payload", "value": "a8ee389bcc54eaf584f4971b6c187abdacf4fd58a6b42791354e3fd4b29a9e33", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646166081, "uuid": "9b61722d-ca55-4da3-8950-e211ad56b848", "comment": "Malware payload", "value": "3bc3dd55db61dec1dedb8620ba495ce6f41452a1", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646166081, "uuid": "c4043628-f919-491c-8985-f6028df7741d", "comment": "Malware payload", "value": "4d76ea7c69122b2ed6ad1b7abe84a040a0357caf15daaa158964db695082d95ef6619e4ac320ece549abdb1a49301732", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646166081, "uuid": "de09e9fb-721e-4a6a-9b19-40a87a0fd154", "value": "T18CB4AE12B790C076D1AA36342526A7B51AEDBC709EF5C3876FD03B7E5E301918A3C35A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646166081, "uuid": "aa5f2b4a-823b-4940-8c2a-7875b04eb7a2", "value": "f08242131de62ca6d7c4b2727b491b3d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646166081, "uuid": "99c39b33-3fdc-4305-b3e7-d1e2ecb2f5b0", "value": "12288:jE3TMKM/JjdkdO4+BNhOwyt4h43JopSz/o:jE3TM/JjdkSM3Ko", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646166081, "uuid": "49c93a2c-f9df-42ff-ba18-63301b2b4d30", "value": 505856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646166081, "uuid": "7a524f37-ae33-44ce-b98c-7afb82d74ec3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646166081, "uuid": "d3114fa6-86c6-4506-8458-f23bb5f2a973", "value": "aew.ocx.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0de54bdf-9945-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646128240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646128240, "uuid": "911cbc86-88d1-493d-9202-60643379e20f", "comment": "Malware payload (AgentTesla)", "value": "bc72d941aa71fbb56a2fdaa3c00f6d22", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646128240, "uuid": "8b2454a4-6543-44ed-8167-c0db808baf4a", "comment": "Malware payload (AgentTesla)", "value": "a92d9c012c60d388525cd9a5ccb09462c151afbb36a956b4f670f55d4473ae93", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646128240, "uuid": "5a0f1739-48ac-4ecb-bde9-e1998e6e6b8c", "comment": "Malware payload (AgentTesla)", "value": "518cd89e578e9d06c3be6358e3a14b01ace53428", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646128240, "uuid": "932a88a6-d13e-487a-bb7e-548e2218dc94", "comment": "Malware payload (AgentTesla)", "value": "ade643243dceeec259279545599bcada344e298667880d63f3425f6b38b975baad11536f00af5117914150bc12999887", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646128240, "uuid": "49c9bdbd-3b6e-4f65-a3db-cf7e09933ae8", "value": "T1B674234357C1DCFAD1E205705AA8AF7BCBBACEA506A11B975B740E3E37B329305081E5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646128240, "uuid": "48800f5a-b475-4006-8f4d-07aca6dbf8cc", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646128240, "uuid": "3570bcd7-32bf-4699-9201-3ffd4f051fc4", "value": "6144:rGijm/tX5+wfIe8c+WtpWEawwvjxtNNZlpoJ7yC11uvnXTlX4cb1ZiHT+IfhlndX:Pm1Q9nc+qjJejDZlpK7ovnX54c4Ckok", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646128240, "uuid": "b2cc6fff-148d-4f19-a275-1115bc98846e", "value": 368293, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646128240, "uuid": "a787d1db-3cb6-4f15-a8b1-dc3bc034c939", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646128240, "uuid": "01a5292b-070d-487a-b95d-139dd8113257", "value": "Purchase order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c075e871-9921-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646113078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646113078, "uuid": "8b892ef0-a863-4024-9f3e-e5a7e7c53a79", "comment": "Malware payload (Heodo)", "value": "99042a308ff13554a9921d2730a90282", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646113078, "uuid": "dbb26f5f-5c5f-4439-b053-f88ee4c1ccf5", "comment": "Malware payload (Heodo)", "value": "a9a04b7909e57d72615cd687b5f79ed07e577a83196eebb4c20b5252b3eb0283", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646113078, "uuid": "b35dea52-ad0a-4724-a197-fb6d42f90d58", "comment": "Malware payload (Heodo)", "value": "0108eb5ceeea2ae6c57ae08f5b09341162fd444a", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646113078, "uuid": "819fff11-7f88-45e0-8213-b3fbe3662516", "comment": "Malware payload (Heodo)", "value": "c1522a72c7f5454632e733eb6bae70956bc3f17cd964577d42ca9f12ed565b30b54675d25c962811e318498ebfca70d1", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646113078, "uuid": "d3eb4d91-3d02-4a8c-9554-8e4e34660281", "value": "T1EF13D019C4665ADDC327693DD6149AF4120C0E0A89A1FA9F1C54B39C2B6A1F70B5FCF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646113078, "uuid": "7af9641d-9684-41dc-89c2-2d00f8429534", "value": "768:e/omdH+DOevZCwttqyKfcrND59V+L9Rw4eWrXcTqZ0VP2HLp:iomdH+DoylND59V4jwmXc2CVCF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646113078, "uuid": "f1c5378d-7ad8-4f90-a953-e615113ce5fe", "value": 41827, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646113078, "uuid": "b57ced82-207c-4659-9733-0dbb30c620cd", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646113078, "uuid": "2acb3b2a-d34b-4628-80bf-0d253ab7fd15", "value": "2022-03-01_0918.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6068034-9975-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646149138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646149138, "uuid": "bd3dc0f1-e5be-4060-b30b-11897aba3f4e", "comment": "Malware payload (Heodo)", "value": "1310781637c9031c5040095f5f20da0a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646149138, "uuid": "d7ce789e-c054-43f0-8352-d84bb4d028e6", "comment": "Malware payload (Heodo)", "value": "a9e680a2309f5487d5331f5a1c5c5520261df77292147588979c0b5bd11f8ee6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646149138, "uuid": "856c197d-f229-4035-a8a5-39dad89e9bd4", "comment": "Malware payload (Heodo)", "value": "fa603b2d3fa6fb2465f92785b008a63ebe624ded", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646149138, "uuid": "30ae4d64-2087-40c8-a7a9-ac4cce5154a0", "comment": "Malware payload (Heodo)", "value": "bb90ec70202f7fdf2dafbe8d118f9214b1a9a2789e02816268280be8189d10f8a999d7c6e67de44365ff0d84b1681442", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646149138, "uuid": "b929c168-e8da-4b15-a504-4d3bb51fa02b", "value": "T1D1B4AE12B790C076D1AA36342526A7B51AEDBC709EF5C3876FD03B7E5E301918A3C35A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646149138, "uuid": "d62d879f-37b8-45c6-b176-119977ace453", "value": "f08242131de62ca6d7c4b2727b491b3d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646149138, "uuid": "6246075e-dd4f-4316-b4dd-8f645de91acd", "value": "12288:jE3TMKM/JjdkdO4+BNhOwyS4h43JopSz/o:jE3TM/JjdkSh3Ko", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646149138, "uuid": "6587ebfb-4a8a-4397-a397-a6f62afab279", "value": 505856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646149138, "uuid": "bce09541-c746-4723-bc5c-def4cdf25ad8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646149138, "uuid": "7f00b6fb-1a6b-44b7-aac8-58955404382e", "value": "1310781637c9031c5040095f5f20da0a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34375ec3-9951-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646133458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646133458, "uuid": "dbca8ebf-d431-431b-8e18-b1b3bfd88a4b", "comment": "Malware payload (AgentTesla)", "value": "061fb1f3ce1f78fc29f38674bd8395a0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646133458, "uuid": "65f8a75e-2455-404d-95b9-e045c1776724", "comment": "Malware payload (AgentTesla)", "value": "aa734d8c53932ab2856bcc567733d7a7b396d217fe6addaf6b2be872b09cd21a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646133458, "uuid": "11e4914c-78cd-47b3-8aee-43413ff2a3c1", "comment": "Malware payload (AgentTesla)", "value": "45bdbc1bab88e19d3da4f00578a7d4e28e4fca97", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646133458, "uuid": "5cefb2ac-d617-44a8-a1f1-459af5fb3076", "comment": "Malware payload (AgentTesla)", "value": "290045789289be45e2cf4da562fcc8358105fe034f102a01160800f64c7736468b330239637fa4096ac2d7a26d8f02b3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646133458, "uuid": "3cbdce56-a892-428e-ab95-b890195aa812", "value": "T163242B5A6715D561C75F417FC01A821831F1E703A72AD38F5AA2D8F91B821CFF92B8E8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646133458, "uuid": "586357e3-9081-43ce-88a7-f5d39965f2c0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646133458, "uuid": "e96d699c-37fe-43cc-b3fa-de415990f280", "value": "3072:KcfY5UzfD7yMQY6uKWqu6ujSSteUAIjvoDiBdr0+q34LhH1+7wkzvbhkcEqoRsxx:gfY6uKWqu6uvwUNYJ3khwbjh/VGwU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646133458, "uuid": "2f4855be-a154-4b0c-89bf-45f154ba56df", "value": 222208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646133458, "uuid": "731450e4-7fb5-4429-a4bd-f811e950d396", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646133458, "uuid": "be68457b-3365-4912-b254-72bfe194c5a0", "value": "download3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e4f5b94-99b3-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646175485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646175485, "uuid": "a3c63bd4-2bba-42d4-a8e9-f2501b398d3b", "comment": "Malware payload", "value": "4d76cd6aad3c4eccdb6dd4b826bf7482", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646175485, "uuid": "28b84cf3-af86-44a1-aa89-401607e5a9d3", "comment": "Malware payload", "value": "aace7c0a0d5296af8f2a3fad70d72494a4e8d8a3cbacb9a943c9eb4a5d19033f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646175485, "uuid": "bde76fe8-b794-40ab-a46c-ec13255477d2", "comment": "Malware payload", "value": "606e2ce17ac819c1b231aa8bd25c3009bb920b94", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646175485, "uuid": "a4a2e027-fd33-4e51-8f11-8ace4744f325", "comment": "Malware payload", "value": "953183fd3fbebc356b5fbfe0d81e14d89f7a3487627bbcf5a59e4d9352350ba6ba44a5b3fe839671d90274fe663731e6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646175485, "uuid": "7d29277b-c508-4af5-9f9d-6eba7ee97c36", "value": "T11BB4AE11B7D0C072C26A35342926E7B656EEBC719AF583876FD03B7E5E301D18A2835B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646175485, "uuid": "af1d6ed9-b8c6-4f20-8a5b-cb084c963345", "value": "d02245ac5c961d83d0907c826d8ba5c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646175485, "uuid": "26c362d1-c6b2-495b-99d4-cef59383a47d", "value": "12288:JhC1q3aXOwkiPs2iCtyj6OAIlgOkar//wJY8Itgm:Jgq3aFkiPs25a62Bkm8jm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646175485, "uuid": "6bc28117-0d6c-4fc8-8f0a-2af01ad971de", "value": 499712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646175485, "uuid": "afb03150-93ba-4074-af03-6a13f1abac7a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646175485, "uuid": "31c31473-d6fc-4f87-be9a-ecf8e819acde", "value": "4d76cd6aad3c4eccdb6dd4b826bf7482", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab6aa10a-999f-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646167159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646167159, "uuid": "7c2c6466-0a66-48ae-828e-e16f558f6d42", "comment": "Malware payload", "value": "57397729e06abcf2d36247935005de5d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646167159, "uuid": "92015211-74c8-4b97-86f7-04542d35df22", "comment": "Malware payload", "value": "abf3b330214c8ef9e39133aadcd59e751d299a149f5962674b8281f0b8c80a03", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646167159, "uuid": "f4db801c-828e-4466-9a41-a90a6ea9353c", "comment": "Malware payload", "value": "aca4f0f7bd2fd9bf76dbc1d179a7cc3d93fa9405", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646167159, "uuid": "65c8a293-dfab-4eb8-a1ed-282ff7e28907", "comment": "Malware payload", "value": "32792d995632e58fd2ffcad5ddace72e09ffe25d01b7342fbedfc170dd23f1c1ebc3284ce4807133930369b4269e346c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646167159, "uuid": "fd893ec0-eb44-4e94-9bca-e1eb76d92080", "value": "T104246D1A15CA8A67C3358FF58177757601BDDD82FEDB10B6A91AB42FC8BDC6E8210A10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646167159, "uuid": "bf298109-ac0a-43db-be1b-273fe63dce37", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646167159, "uuid": "ed24f1f8-08ea-46a9-9aac-f21a12019dee", "value": "3072:HXrFcu1e5j1vCCMYSMkVxLGL2wT72rPg1:H7zwaCMYSMOA6wT78", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646167159, "uuid": "1c08212d-4d8b-436b-8da4-7e8b5b8611d7", "value": 216064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646167159, "uuid": "bcf0930f-31f9-43bb-8062-4b5ca39b18f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646167159, "uuid": "408be40e-1f89-41a8-8a6e-0e8aa437334a", "value": "\u7f8e\u91d1\u532f\u738728.84 (USD 40,257+5% \u7a05.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ed24ba3-9941-11ec-9275-42010a9c0029", "comment": "Malware payload (njrat)", "timestamp": 1646126712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646126712, "uuid": "3058058e-b8a2-4154-9d5d-5d657bab15b4", "comment": "Malware payload (njrat)", "value": "16ae594c3f727ba5b54be7d57e697e25", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646126712, "uuid": "2fb8c351-a757-46a3-a9b4-c34eb90806d6", "comment": "Malware payload (njrat)", "value": "ac07d51b6ae3a8741f6fc3e4701a2a752ec51b058123de7982aa9aa757a7a56e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646126712, "uuid": "39619465-d4dd-4b0d-916b-dcf0f35b7e1c", "comment": "Malware payload (njrat)", "value": "a092705ca438e32b416ca0c01f168e7358200602", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646126712, "uuid": "cfe23fdb-a08d-4886-a72e-411a0cba5683", "comment": "Malware payload (njrat)", "value": "2738c0147e558d27f1e8f446129f51bc8a0082f928aafc42e047cb9db33a82cd95920840af4afe0b7fbf0a57f57a0b3d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646126712, "uuid": "35058e8b-cee1-4972-941a-7dd05319726e", "value": "T1B305024023AE87A5CBFA1B78B42140228B6DD785612ADB3E7E40EDED6C177444D12B7F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646126712, "uuid": "e32bc866-ae5e-4df6-8ddd-90f2a5d3116e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646126712, "uuid": "eae894d8-1c44-4e72-add7-8224380ce7d5", "value": "12288:2gY0QPDnu/m4xxIkjFqqYcpBK7oG+LDIw6UpoZB2HDkgBUfI70j+9m:2zLLnu/mYfqqtp7GI7ps2HDkgGfIism", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646126712, "uuid": "6b25a594-6978-4bea-a5a2-814238dca551", "value": 802816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646126712, "uuid": "aa628c1c-552b-4b81-8add-951fdd5919c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646126712, "uuid": "eac3d661-f58a-4f0a-bf0c-fc2a0ee5542f", "value": "16ae594c3f727ba5b54be7d57e697e25", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab25b22e-99a3-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646168877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646168877, "uuid": "e9331608-5a07-4414-981f-5a6084c9ffab", "comment": "Malware payload", "value": "6340e03ce502de0af0f79d8ae507b0cf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646168877, "uuid": "a70faaa5-ba29-44bc-bba4-95a7964ffcb4", "comment": "Malware payload", "value": "ac1c5acc715c88a2ba28223ed3dd95e7e910341a61ca52f97ec216bc9395817e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646168877, "uuid": "2bd05c38-5dc7-464b-9347-688aaa32f4aa", "comment": "Malware payload", "value": "afdd4e36d35e6c21c39c617bfe87e40e8b7c31f4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646168877, "uuid": "31bad265-52a7-4681-b215-ba46e8d63815", "comment": "Malware payload", "value": "a98401220e3079fec19ecbbe79efba79c93b951baf772a4a244300241e7049f3ae8c4c2b61dbb222023fadb9670e0750", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646168877, "uuid": "df37bb79-1d7e-42ad-9c2d-ee4a321269e7", "value": "T187B4AE11B790C076D2AA36342512E3B51AEDBC709AF5838B7FC07B7E5E315918A3835B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646168877, "uuid": "be2aa1b5-1cbd-4048-93f2-3200c01f7112", "value": "f08242131de62ca6d7c4b2727b491b3d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646168877, "uuid": "32682bca-cad8-4959-a0e9-5e03a547a5c7", "value": "12288:dbFLiEzuSo9guqHuWjr2pyv4W6SpktSuHE:5VWSo9guWn6ZE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646168877, "uuid": "b86bfbf5-b5f8-4785-8e9a-e963bc01f6c7", "value": 500224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646168877, "uuid": "bcf94f06-6834-48ed-852a-95505dff7268", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646168877, "uuid": "2c6a5472-b973-401c-af5d-2f7f50027dcc", "value": "6340e03ce502de0af0f79d8ae507b0cf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea2f2998-994f-11ec-9275-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1646132905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646132905, "uuid": "bce5ad86-99aa-4268-9441-dafb3cb20512", "comment": "Malware payload (Quakbot)", "value": "66bcb18b65ac03adeef48a977c673e03", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "THE FAITH SP Z O O", "colour": "#87FB2C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646132905, "uuid": "5b9db2ec-82a7-47b5-8ce4-4012db09d5ba", "comment": "Malware payload (Quakbot)", "value": "ac365e741907c53bf99fd0f917e4a553a45f39f083eaf9fd0f045373f9473772", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "THE FAITH SP Z O O", "colour": "#87FB2C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646132905, "uuid": "3645c4a6-18ad-4f1e-b66a-39ba963c1bd7", "comment": "Malware payload (Quakbot)", "value": "6406b4387df076ac79c0821837685d8c7b94a3cf", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "THE FAITH SP Z O O", "colour": "#87FB2C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646132905, "uuid": "0fe80ae7-d06c-43a7-bec7-1a8d815576b8", "comment": "Malware payload (Quakbot)", "value": "687b9e823ba169a33dc03ed812ed95754a9fa9a68c9defdb31bf296054ef1de6d5c6110289f03ee850729d44deca2a32", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "THE FAITH SP Z O O", "colour": "#87FB2C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646132905, "uuid": "a92d4b67-3cff-4048-9b33-992a9883948b", "value": "T10C25F94286642A0DFD3DCEFB6F3AA3ED40664F70192AB256E350288951B81F1723DF57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646132905, "uuid": "d7d9ccf8-5f96-41f4-ba16-3a41896c5930", "value": "a2c4c1cc45cf157e67048505a3f85c3c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646132905, "uuid": "c286a05f-3457-43d2-b838-5b1442e9654c", "value": "12288:Zg4d/lpygJCNLgUgYUypwKzpVCD2aep4Xl8I1JV5OwBi6fC8a/ZnFH08hXhQrVNP:ZdddhCN3tVwV1Twh/n/qVh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646132905, "uuid": "52d57669-2568-4093-973f-e66fbc11e227", "value": 977883, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646132905, "uuid": "525d8c47-8457-4880-9b04-9effb4636986", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646132905, "uuid": "37301333-04eb-4b23-a38c-995b90b8e62d", "value": "ac365e741907c53bf99fd0f917e4a553a45f39f083eaf9fd0f045373f9473772", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60c9cb78-9935-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646121507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646121507, "uuid": "7fd654dc-eb8b-475e-8ffd-560962a6b8ce", "comment": "Malware payload", "value": "f395e514e4a25d89d0e81ab492b1cd78", "object_relation": "md5", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646121507, "uuid": "fb3e30ce-0329-4d42-99ef-2d133cf1d0b9", "comment": "Malware payload", "value": "ac395f6835a040fb54512d0404e240072487f15352d3a9fa8c7023594a68ff7b", "object_relation": "sha256", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646121507, "uuid": "b54c8e2a-2636-4bde-9939-7dddda93e4a9", "comment": "Malware payload", "value": "3fe1f53238a8c26567142120e430ebe48680d34b", "object_relation": "sha1", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646121507, "uuid": "d7def761-76a9-4903-b367-e85af1f5d9bb", "comment": "Malware payload", "value": "b6d733a460c69c95da962126be62a64dafad8cee5225730ce9b26c0424da905eea9ae99974db7fa9fca3091d705389a7", "object_relation": "sha3-384", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646121507, "uuid": "c3183a46-3052-4abf-8ebf-5f706932d135", "value": "T1CC13AF18C1126109C2B3953EDC3884F61C6ADC176234998FE6D6B94B0B65EFB374EBC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646121507, "uuid": "1add4ba3-594e-4ef5-8095-e5f0416db58c", "value": "768:d+SRD4S0JS00SneSnjS0yS03S0IMS0bS02ScxbV+cUs70Nn2srTpxKC6yDsfudHW:d+QMVU7N22Tbwy40zVMMAUTSAo1/K8Nh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646121507, "uuid": "133927f8-ff9b-47eb-b9d6-806b0cce34b4", "value": 43615, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646121507, "uuid": "1fd728fc-7d16-4447-894b-c50336b9a29d", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646121507, "uuid": "aeef296e-ce02-4c50-a7bf-e6bfb06eacec", "value": "New Order.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb5c5704-9985-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646156046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646156046, "uuid": "d87732de-7753-431c-a35a-c5b1e220cb28", "comment": "Malware payload (Formbook)", "value": "e30be50ae0f99856fd299ad10fe2c9bb", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646156046, "uuid": "97e0b2e3-4675-447d-bcbf-add5b279575c", "comment": "Malware payload (Formbook)", "value": "ac66d558b64a788eccc243b1e883c8bb351f734bccb40c6d19909218b77f9902", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646156046, "uuid": "977cb9da-2e77-4cfe-a433-33ce4e841188", "comment": "Malware payload (Formbook)", "value": "3cc715b5038e2a0becbaa964accebd35f08b388b", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646156046, "uuid": "82c91cb1-fae7-4022-8ea4-294c4fc711b1", "comment": "Malware payload (Formbook)", "value": "e192d71bc2212bbdfa4527d389f79d7a9106326d0ba37dd9920b33706956db74bbbcaf28117e6d5baddfd5d8f3708862", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646156046, "uuid": "100a82aa-765d-4837-904f-c3455a896bea", "value": "T16914027AAA34E689E635C7355BA0A1CC6C5EEE4C4ECF4200F9C1354FA1B806F9B56253", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646156046, "uuid": "11f9f4c0-7718-40ec-b483-176e5a138193", "value": "3072:3oId5NnzxtIjO13QAceX1SCGYiHyKJNxJmvXRjtoBTwxPtryzkt3wYtKxpNwlm:Y0r8jyQAceX1jGYiZJLJGXRjOBTwqc3M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646156046, "uuid": "f9619ed4-c08c-4604-9022-3599661f81ab", "value": 191224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646156046, "uuid": "bdb0e49a-b891-4967-9fde-f202dfcab9de", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646156046, "uuid": "af1aaf4e-5171-4d62-8a3a-d953698e0b55", "value": "NEW INQUIRY.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8bba7d8-995b-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646137976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646137976, "uuid": "e87c5113-59ee-47a0-b158-a65bdaaaf6fa", "comment": "Malware payload (AgentTesla)", "value": "efc048ed866f6bdc141fbe0bfff669a5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646137976, "uuid": "4f1fe8da-91d7-479e-9a41-f337688a3dfa", "comment": "Malware payload (AgentTesla)", "value": "ac7a4f2b3fed29b132bf92fc424fab1a3feffd1365774d313e0ad10546aeb200", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646137976, "uuid": "a86ed385-bd50-4aef-87d4-914d5d63c430", "comment": "Malware payload (AgentTesla)", "value": "5f96d5a9124797ba21e67cda587a22cda6d01576", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646137976, "uuid": "6c7d1ef2-d240-4b96-bfe8-7b8a11f50d38", "comment": "Malware payload (AgentTesla)", "value": "da3a3ef689442ea80bd9c48a7ce91f80a51c2bbe0de61e4e0084b31a8c5e495967603f0043444a8fd51809c77b70c166", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646137976, "uuid": "654be2a2-fdc7-498b-b431-2b5db37874d6", "value": "T19D05CF1438E64039F83A9BF1DEC0EBE1DB6EF221E48970F554000E599645BBC895AEFD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646137976, "uuid": "fceb38bc-c9a6-4ef7-8467-496f71b8f1f5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646137976, "uuid": "c35e6a82-5443-4abd-80a3-f7682efbf164", "value": "12288:2EhiR/IaIuwmGaDlyXdUZ9uv774Ioz3fCXBBdXVzNAeT6lItnjwR6vtliL:IIpdrv7BoMX4eT6wjo61gL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646137976, "uuid": "d00cc449-14b4-4082-9fdd-cb581d86166d", "value": 808448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646137976, "uuid": "35b439fa-fc40-4987-8004-cce1c96972fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646137976, "uuid": "b419e271-b0bb-4ecc-8a09-ddbaf5dc15d3", "value": "Purchase order no PO220715.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2a8cc1c-9974-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1646148783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646148783, "uuid": "8496a303-ee63-4563-9029-ce52ae4a5fe2", "comment": "Malware payload (Loki)", "value": "c2ba8dd8160e76603e44fb1e063b3ee3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646148783, "uuid": "f5587ea2-c7e0-4530-af3b-3862ccf7ab82", "comment": "Malware payload (Loki)", "value": "acbf1e8ab90fd3e57092c85b4115a518494d13ce416e8ae8beb2baeb113862ba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646148783, "uuid": "d6cb39f9-5199-4654-8b9a-34593f4fb567", "comment": "Malware payload (Loki)", "value": "8fb87293eedd6721d9e47794305a6272671df69d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646148783, "uuid": "4831ee74-fbc5-46d7-8b5b-d668c1dfdad7", "comment": "Malware payload (Loki)", "value": "03e9cd7342106e5965d2ca4cdf10199b224821f0416287f82f70b235e71417d0b5264cc9c8caf4ebd807e6295a76aed9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646148783, "uuid": "e760a8ca-4759-46af-a631-2863df31f924", "value": "T1B6A43735A1F26AC9F896CEB29E21E619FFE70C859941421ED27439F25233BC4C6051FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646148783, "uuid": "9b9c2cc0-135e-44bb-b9f9-3659901f67ad", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646148783, "uuid": "4010ffa4-ad49-40f6-8808-4099b6ff88df", "value": "6144:QGiVa+I4dZbaA4mI/GJ57dmkzKhmSQ95WEQlI5yzp3Pfw:azd1LDhJ57dmkzKhe957C2ytw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646148783, "uuid": "655f62a7-139b-428f-89f1-04b2b01bf854", "value": 483682, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646148783, "uuid": "2fbfe8e1-4a61-4200-ad3f-a6ba711e4937", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646148783, "uuid": "a48b95fa-58da-4539-9992-326d53462c8f", "value": "Proforma Invoice_pdf_____________________.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8bfe187-9931-11ec-9275-42010a9c0029", "comment": "Malware payload (Socelars)", "timestamp": 1646119964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646119964, "uuid": "0dba136a-94a2-4f4d-998e-6bfeaab42639", "comment": "Malware payload (Socelars)", "value": "8c359c915ddb36c589d7bce313f8c043", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646119964, "uuid": "78e2e4a3-9f94-4518-a1ad-fca392340dea", "comment": "Malware payload (Socelars)", "value": "ad20d761b61555a9ba92548d0adf191c76567f23b035c8d3e52f5fa0ea09c9fe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646119964, "uuid": "6e4afe52-04dc-4528-8fb7-daf9807492df", "comment": "Malware payload (Socelars)", "value": "032a561d25220efbcf7134a79db6333ada52867c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646119964, "uuid": "47184971-801e-409b-8da8-dcf59847f6f6", "comment": "Malware payload (Socelars)", "value": "699925197ded9a1449131d70c154f3f8b9cdbca0d5d25b8a91c7b8608d89374d1710a1cd6892f402716f8149dd61b0df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646119964, "uuid": "b7e360a2-baa9-4d7a-b018-98ed56025a06", "value": "T101658E11F642A036E8E3007382FF56FE9D2C6E21031494D7E3C47D6A6A715E27A3766B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646119964, "uuid": "ecdce939-da3d-40f5-a769-b8211edb06ad", "value": "d69e4c13e25f0ad622344ac56118c0df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646119964, "uuid": "38345dbb-a1a5-4073-8601-f40916d7fe54", "value": "24576:D9opFqoCv+VsqF7nZYll2QDUrygcC0JY3ZAwS8c95/d6sHjRg+fu:ypH1sSDu6Auq5/dhHjO4u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646119964, "uuid": "31c1a708-b4c8-4970-9c9f-4ef18f560f22", "value": 1520128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646119964, "uuid": "5da07856-abd7-451b-9c83-4f9bbe35de87", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646119964, "uuid": "766537e0-24e4-4f22-9050-879d67157473", "value": "8c359c915ddb36c589d7bce313f8c043.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d2dc879-9984-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1646155485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646155485, "uuid": "a674c716-7f5f-48d5-94d0-c96e53a671e5", "comment": "Malware payload (SnakeKeylogger)", "value": "2d85d518e5a12e5a34b8695b0dd6ce42", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646155485, "uuid": "b609304f-b281-4ba5-b292-e998fdd7aae1", "comment": "Malware payload (SnakeKeylogger)", "value": "ad69f23815982388a98d1f8a41ccdd5b5a09a73e366f705fa8578f2aef8fd249", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646155485, "uuid": "15ba98aa-17cd-465b-8a19-57cf67287e96", "comment": "Malware payload (SnakeKeylogger)", "value": "62c7f9885c8b50bbccbeda56465ed60f0f0c8bc1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646155485, "uuid": "9497eca0-6ddb-495a-beb8-3509167e040d", "comment": "Malware payload (SnakeKeylogger)", "value": "f654e759c3e6c099b69f489b8639641604498e6d1c9b8d2e381a711661362adf65fe134bf9e27c684d924d96c98a3f56", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646155485, "uuid": "1c2a959d-8ccb-43e2-9fdc-95fcd1512f67", "value": "T152F4045C6502F1C4D898C779E82540F4167BED9FFA84DB2B6F423EC93833A1A8607B59", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646155485, "uuid": "e9d5d59c-5cf0-40c9-b665-041e37607ce1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646155485, "uuid": "f99b0c4b-09f4-4419-b24e-bcb63ea46d56", "value": "12288:Zr4Nr41r4A7190iFxgRnq2gKw8wUVMP8wU3vFi:Zr4Nr41r4A70+xMq2FqUVMuv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646155485, "uuid": "67338753-82b2-408b-ab79-c88d927550e4", "value": 790528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646155485, "uuid": "85a84345-aa10-4f27-b8c0-11a13db1c313", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646155485, "uuid": "790e1b7d-8957-4f2e-a319-70392f6ebb1c", "value": "SFA_invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8a1c08f-9943-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646127641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646127641, "uuid": "16bac2ae-76b9-4007-b341-86b9f8823706", "comment": "Malware payload (AgentTesla)", "value": "c133e68e5f8152f824a3a43f1dca9137", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646127641, "uuid": "e87eb054-9cd8-405a-9153-d19bd4defc4c", "comment": "Malware payload (AgentTesla)", "value": "adb51a8a9daf5a7b8f4e5a5d0895d9d5f42a390b68c75ed85719d868c1c9ee67", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646127641, "uuid": "aae5777c-c4d0-4f32-af8a-1fc0ff9aef87", "comment": "Malware payload (AgentTesla)", "value": "14d1652e07b8a86feb67bb342cc5dfa007c93a82", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646127641, "uuid": "06bf5b91-b30d-4bee-b37c-d10cb94c4075", "comment": "Malware payload (AgentTesla)", "value": "cd72e3451ad86a093741a31439561ee1da3d6241982902b964e725b348f6a4455c4338fd2595887f76844c9a07bd7010", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646127641, "uuid": "ce9f9a61-ac63-4359-8f7e-048a9948b709", "value": "T1CDA423927A3CF48859A2CB0E6753E07927DDF9608B6239F022F5B1D3F900DD6D6B6844", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646127641, "uuid": "8df374d9-96c7-490c-84aa-d9233e6bba00", "value": "6144:OZW8WQYMfgrjRmNCFpY9+6Q6mCHs2VQONt/UGZ9610JlW55wxn37Xe0LRpHO+ji2:e6OcRmNgK9+aHv0eJ05563be0LRUu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646127641, "uuid": "f206bcef-3569-467d-bae2-d85f8b1247a4", "value": 480371, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646127641, "uuid": "2bccb3ae-6fe4-432b-be3f-b66bd2afa993", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646127641, "uuid": "cf8b083a-c462-4113-91cc-00acdf5f1302", "value": "PO # 4500594320.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d0df60d-9939-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646123085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646123085, "uuid": "3db5b5d6-38dd-4997-8542-2df84b44984f", "comment": "Malware payload (Formbook)", "value": "96a8eb5d9ddda42789ddc0722565145a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646123085, "uuid": "540628f4-ff79-469c-ad75-cc6a9480464c", "comment": "Malware payload (Formbook)", "value": "aea459fb282282fc886f02283b2cfe1da12a6208e14859ffeb7f84a45a452bba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646123085, "uuid": "81a3d5ee-e70e-4e09-ba65-7fbf6cf4063a", "comment": "Malware payload (Formbook)", "value": "5b743c58007243f15ac5172301fb8682e52c2b83", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646123085, "uuid": "80fed8af-bb4d-4506-8c4c-cc468e13c03d", "comment": "Malware payload (Formbook)", "value": "91f0abed083d522af97f10d019190f4c40a0c45ffe244146c0cd2e643df0d2b02b571b94d2aacd4edfcc7016e222d53d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646123085, "uuid": "7c0e1e9c-9208-40c1-a607-02b6ea5c1392", "value": "T180F4AF0839EA5038F83A8BF1DBC4EBF1DB6DF221E48860F568000E555655BBC8956EFD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646123085, "uuid": "2d8b5ada-966a-411a-a463-bc71161819d8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646123085, "uuid": "70fbd8a8-9692-4036-9604-c22383400a80", "value": "12288:6E/rR/Im7LZ3lVPZBIueSSozbbSUkHc1CWw3HdIlDZ8JcWPswj:ZXVPZBmSFZ3CWMdIlDZscMj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646123085, "uuid": "6d9bf16a-b118-4db4-83fe-07b8e08b9f56", "value": 749056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646123085, "uuid": "bb5c6e84-f762-4e2e-a979-898238d68964", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646123085, "uuid": "ea4bad38-3aa6-4b80-bee0-120b21eb3d09", "value": "96a8eb5d9ddda42789ddc0722565145a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca919614-9998-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1646164205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646164205, "uuid": "2f3fca74-122e-44ce-ace1-37d3cca565b3", "comment": "Malware payload (Mirai)", "value": "e355e1f994497942d68bef6e47c056d3", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646164205, "uuid": "492d16a5-bc38-4c70-87a9-b5329b42f9b9", "comment": "Malware payload (Mirai)", "value": "af0a5c552e6646e01946b71b9a84d253db0ac0b64163224cc0263a711147a775", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646164205, "uuid": "d78eb5c2-b57e-4a7c-8260-e4101a3cb8a3", "comment": "Malware payload (Mirai)", "value": "a6da1dd4dd17c4f7df63bdf1d2d903b1648d50a3", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646164205, "uuid": "a8d9a9e4-e218-42f4-82a2-a2ecd46ab556", "comment": "Malware payload (Mirai)", "value": "1645e3f19d2f1ee7d98f034fc9dc23fbb885039060af283a28c4629d184a27034f62bac373f19507e3756590e88a3ef5", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646164205, "uuid": "e1634c17-e165-46da-90d5-0fec4cff9426", "value": "T19ED2E0B5EE6CAED68089F7345D4ACC1E70CDB5732F3E94484E810956712AD02B6B8EC6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646164205, "uuid": "99edce87-1446-44d6-8628-60792e8dea70", "value": "768:WN8f6tfoQmQAXV3E1QDvjnVAiSZd8H0GuOZk31ANqC:2MJXFl3IQjU6upq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646164205, "uuid": "6c2146bc-3011-4d6c-8984-0ca79d6ebbba", "value": 29904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646164205, "uuid": "726cb342-36f8-48db-90cc-c4e608ceb848", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646164205, "uuid": "99ec61d8-ac30-4710-b146-5d201c5479d4", "value": "xd.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca021b5d-9998-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1646164204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646164204, "uuid": "916de348-a898-41b9-abbe-ef3ce2fa2b24", "comment": "Malware payload (Mirai)", "value": "1ac47f0b9c5ffbb1e3f43da6c912f77a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646164204, "uuid": "eb601b63-b189-442b-a577-365f8ccc6f74", "comment": "Malware payload (Mirai)", "value": "af4fdf749bc36d58f6a55a7e1232bd2756a8813c998b28b4223efb8dd1d32e1d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646164204, "uuid": "229f70bb-f088-4981-981c-87d622a98e2c", "comment": "Malware payload (Mirai)", "value": "1c0ca62cbc898cbc30ba8a157892756ff3d66cc1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646164204, "uuid": "0bdf6d27-9a44-4608-8a07-385d16410656", "comment": "Malware payload (Mirai)", "value": "42ef8bbc02f9046581e92cd7348cbceb989426172f8a109ebe5ccea40be6100806d168e88ab1528d3408457af81af9ec", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646164204, "uuid": "fe8f2bc4-7a33-4454-8416-44510cb33640", "value": "T1BB33F2B588062591C1301473B53A654BBB4907FF54AE7C2F6530C37CE5F586BABE48E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646164204, "uuid": "b1d5e2e4-4615-4681-9168-a6d574cde841", "value": "768:SnMte5B4PACtw/Yce2pZDD2vv75ZL4pBhwGmjFuJuBB/9q3UELbOs8qMLPVhMwRh:SnM84I6KpD+rL4+sJuHuLIVmWjb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646164204, "uuid": "95326151-7da1-4460-b604-16a6a97415e0", "value": 53620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646164204, "uuid": "26280e21-85a6-4bc7-bd03-63eac154e083", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646164204, "uuid": "a42f0b55-1e0d-4f45-a72d-4dd618f79836", "value": "xd.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4bc1229-9999-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646164651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646164651, "uuid": "78c46acf-9e11-4320-b636-0d780b62ab18", "comment": "Malware payload", "value": "0b8825384924c72bb0a400b202e68e39", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama161", "colour": "#9F5DB8", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646164651, "uuid": "59bd03bc-0ab2-45d0-91e3-04108b0f3219", "comment": "Malware payload", "value": "af85042439aacc86ed730547e549104c071371b5a21aeb1532d6df3a95ae7881", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama161", "colour": "#9F5DB8", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646164651, "uuid": "b6422138-e144-47d8-b85b-7bb788a3baa2", "comment": "Malware payload", "value": "7cf90a3c4502035b72b7d5cd3ec7010ea06d39b1", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama161", "colour": "#9F5DB8", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646164651, "uuid": "bd438441-2228-4ec0-9efe-5a6515084da6", "comment": "Malware payload", "value": "9f105527139a7b397f2a2a91fc328d78d5c9044037fd6e5d9b8aea625ff676997b4150c857d92a739bb7118eeac01d0c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama161", "colour": "#9F5DB8", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646164651, "uuid": "b5e99cb1-3d98-498e-811f-4c0755666ee1", "value": "T18D25BE61A2D155BFC1733B7DAC3B2194DC24BE912D10DC8CB7CD1A9E0F296A227215BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646164651, "uuid": "93a7f18c-3422-4ba0-8599-a49e4fbab192", "value": "f3a2b34cbcfe1640f11d8b0978b1dab8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646164651, "uuid": "24485d2e-4b4a-4c3b-95d1-fd1e7252e3fa", "value": "24576:HBl4LBmTVxqyZfUgxB31FFbDt3xywiDSR6bs2:HTaGrxB3LZB3Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646164651, "uuid": "07578894-1178-487c-a487-ee9070f90add", "value": 1048576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646164651, "uuid": "226a66ae-70a3-47ef-a884-cefde83e2c3f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646164651, "uuid": "5e71f644-4c1a-4ba6-aba5-527750cebd02", "value": "44621.8127884259.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd6ced92-993f-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646125985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646125985, "uuid": "87737d68-cd23-40ef-96e3-47773a30f5fc", "comment": "Malware payload", "value": "8819c0ef159cf0085dc5d96602e66f4d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646125985, "uuid": "1091e4b2-0f49-44c0-99ec-36236fa2796e", "comment": "Malware payload", "value": "afdf867229d6857c12101952776351b610c1da0534b03a6fa4e3e19bcc2614b8", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646125985, "uuid": "ca925605-8e6e-4366-bfdd-af2bf42ccd6e", "comment": "Malware payload", "value": "4ca2a6dd3782594bba7a6e49593fb5196231359f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646125985, "uuid": "c489e799-bfc5-404c-83ad-ac0d84ed4a15", "comment": "Malware payload", "value": "a3edb16367cc923b65ca460dec937bd6e01d08010d930fed61967a22869d95f35c2f17bec6c13ec43864d1049c1dfb7c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646125985, "uuid": "31ff7b5d-33ba-44df-bfed-ff61482c3917", "value": "T1E793F110FF92EB12C499473DACA7CBAF99217EE85D21050BF1A8771D18BB990A854F30", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646125985, "uuid": "65f1f670-8c25-4dc9-9fd0-4e3d49537602", "value": "384:QgyjpRGIg7stz1Y/N8KeePFee2t34m0OiqbbeMlEtRgT++droqvsCXEnAJ2bA1iV:Qhpu0t3gvMKgQClE4flvTu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646125985, "uuid": "0a698a20-9bf8-4676-bacd-b4a5495faa25", "value": 89088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646125985, "uuid": "9c864a9a-0bac-4f92-bd99-3e4f69ac80e0", "value": "application/vnd.ms-office", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646125985, "uuid": "9e41a9d5-3c21-4276-80f4-235fecabfada", "value": "Proforma Invoice.pub", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2926876-994f-11ec-9275-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1646132919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646132919, "uuid": "09cc33d7-3c04-4f93-af3a-f8e628c44367", "comment": "Malware payload (Quakbot)", "value": "cf47389572e9649a5a570d1b3b59a95e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "THE FAITH SP Z O O", "colour": "#87FB2C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646132919, "uuid": "832a4e58-a905-49b6-ab84-31bd1363e5c0", "comment": "Malware payload (Quakbot)", "value": "b067a46bce63a670d8c91b21da928a5cf8690f067dd076fa606ac080a7455096", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "THE FAITH SP Z O O", "colour": "#87FB2C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646132919, "uuid": "993f8a39-5ff9-4bb5-a3ba-604b7c0d30ac", "comment": "Malware payload (Quakbot)", "value": "86cee79ffc02d490b4518eb6bfb7c37063d84607", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "THE FAITH SP Z O O", "colour": "#87FB2C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646132919, "uuid": "ed17d191-d0f5-410b-a19f-061dfde505b1", "comment": "Malware payload (Quakbot)", "value": "55ab12f7a69a2de7202862a8cf710d744187796beb31719d8d6deba8c443275b417d43f06a717918af54f33fcfd3b2d7", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "THE FAITH SP Z O O", "colour": "#87FB2C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646132919, "uuid": "002555a0-8762-4ac9-848e-700378481a39", "value": "T15215F94286642A0DFD3DCEFB6F3AA3ED40664F70192AB256E350288951B81F1723DF57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646132919, "uuid": "160b3b3d-5aa1-4862-aa65-190ea4709f30", "value": "a2c4c1cc45cf157e67048505a3f85c3c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646132919, "uuid": "5fcf4374-e639-425c-83c1-7e8df64fb691", "value": "12288:Zg4d/lpygJCNLgUgYUypwKzpVCD2aep4Xl8I1JV5OwBi6fC8a/ZnFH08hXhQrVNF:ZdddhCN3tVwV1Twh/n/qVht", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646132919, "uuid": "af8d5638-a81b-4f8c-bcf5-110e845c8d78", "value": 952728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646132919, "uuid": "6b818fb6-a96f-4d1b-8401-ae3e6f97ee81", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646132919, "uuid": "93b26fda-6033-47fb-8f87-2a101912313d", "value": "b067a46bce63a670d8c91b21da928a5cf8690f067dd076fa606ac080a7455096", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb9ff486-99a7-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646170649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646170649, "uuid": "f10075c7-90a9-44e4-a199-10237a3ab709", "comment": "Malware payload", "value": "af2355dd313a8837faaeab7f09fb8cc8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646170649, "uuid": "1a1c179d-300f-41e5-a3ab-d83bb7b2f5bc", "comment": "Malware payload", "value": "b0badfd88cc51f7fec4319cfcea11642f1caf63bdae5ad2f902b6fe60da1840e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646170649, "uuid": "87984591-a7ba-4337-be9a-a63e84655c4a", "comment": "Malware payload", "value": "65353e1ce80c4dbc8310591c7b16471fd6200a2d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646170649, "uuid": "febf51f0-6f12-4825-a6dd-66be0fe96bbc", "comment": "Malware payload", "value": "e5cdc2fb490111cfd1351ab4c5b6363dc1450bb16cf0fe869e328a137bd043611239d54b464873c28a4ccd2aa121aa6f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646170649, "uuid": "75c25f7c-d40c-4aa9-b249-276c53deefbf", "value": "T115B4AE12B790C076D1AA36342526A7B51AEDBC709EF5C3876FD03B7E5E301918A3C35A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646170649, "uuid": "24d3c0a2-ea08-4c8e-bfb1-b4a3c63e7e37", "value": "f08242131de62ca6d7c4b2727b491b3d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646170649, "uuid": "5e0e80e9-276b-429b-a77e-fbe4fb09c259", "value": "12288:jE3TMKM/JjdkdO4+BNhOwyc4h43JopSz/o:jE3TM/JjdkS33Ko", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646170649, "uuid": "15737be9-9f6f-4682-9ec1-ae5a3355c55e", "value": 505856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646170649, "uuid": "83a319a0-d629-407a-a192-b3bcef2ea799", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646170649, "uuid": "09dbe207-e8a1-4a97-9f30-104c3763bc70", "value": "af2355dd313a8837faaeab7f09fb8cc8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6e863e1-9938-11ec-9275-42010a9c0029", "comment": "Malware payload (Smoke Loader)", "timestamp": 1646123021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646123021, "uuid": "c531d733-3022-45e4-827a-93414540a504", "comment": "Malware payload (Smoke Loader)", "value": "b11da0a51dbaafc9f83702f88db6a80d", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646123021, "uuid": "ec4f37f0-d29c-46ba-836e-f91fef56937d", "comment": "Malware payload (Smoke Loader)", "value": "b0d747fcff4576bf28d31bc2e7d681c5c08310ef212c96e63b7e60db6d015ec7", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646123021, "uuid": "511d2bef-20ca-4907-a673-ec55ffe45641", "comment": "Malware payload (Smoke Loader)", "value": "ec4c23aeb4ec2de6ba9cd227f8763e9aa9090256", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646123021, "uuid": "cbde5a6d-f46e-435b-a761-39a143dad32a", "comment": "Malware payload (Smoke Loader)", "value": "c1bc0a1f4d9acf61cbcd8ab1fe8bd3e99ba48a196956768f875b7fa4220a63158b43569841f4b6cd69f55c812f5296a0", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646123021, "uuid": "64b75c73-2a41-4da9-afe7-de571c9ccc93", "value": "T19364AD00AB90C035F1B712F8897A97ADB63E7EA15B3460CB63D556EE0A346E4EC31357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646123021, "uuid": "e1bdcccf-e777-4f7f-b63e-f038c05aaf88", "value": "070604688899afa7e1438edbf6a9e9e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646123021, "uuid": "aede5c9c-3f00-488f-9b3f-5faab78c7ee6", "value": "3072:2768GKbBylRIxRhvJhesCoY2yaKQwFd8NrgGSdPylL5vhwhblXCP57DhD5:FNRIxzRhWaKQwv8N5SdK7h6SRDd5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646123021, "uuid": "ec09ab45-34df-460c-8df7-479575590105", "value": 332800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646123021, "uuid": "8eab2188-c78b-488e-8260-103ed6e8955f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646123021, "uuid": "b80cab6a-ac4a-4bec-922a-4fc1231ef439", "value": "b11da0a51dbaafc9f83702f88db6a80d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62d660b3-9958-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646136543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646136543, "uuid": "7b4dbd88-6b2c-4d55-a800-a3ae5a28aace", "comment": "Malware payload", "value": "47e6ac52431ca47da17248d80bf71389", "object_relation": "md5", "Tag": [ { "name": "Daxin", "colour": "#652B35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646136543, "uuid": "36621fc5-7757-4458-a8db-1633acfc5b43", "comment": "Malware payload", "value": "b0eb4d999e4e0e7c2e33ff081e847c87b49940eb24a9e0794c6aa9516832c427", "object_relation": "sha256", "Tag": [ { "name": "Daxin", "colour": "#652B35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646136543, "uuid": "f1feb251-cec7-4f08-ac51-196ff51bed61", "comment": "Malware payload", "value": "d417c0be261b0c6f44afdec3d5432100e420c3ed", "object_relation": "sha1", "Tag": [ { "name": "Daxin", "colour": "#652B35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646136543, "uuid": "f310ac8e-9549-4d4b-a5c2-07648cb5b11f", "comment": "Malware payload", "value": "43013a5b927bd52c458da7f2b9af4437a9d0a65cde530315d506e4f36b220989b34fdd4eb2b2d4c67e0dede7fd7e02ec", "object_relation": "sha3-384", "Tag": [ { "name": "Daxin", "colour": "#652B35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646136543, "uuid": "2aba91d1-83da-40a1-b9c1-b405a03873d7", "value": "T1372422415BEC1F7CCBC0E9F8C628573DAF3A74E61652C783B3598814A9073A1275622F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646136543, "uuid": "c834b557-87cd-45e2-bd12-c1fe4d93a6b4", "value": "70e1caa5a322b56fd7951f1b2caacb0d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646136543, "uuid": "db3ad922-599b-46f4-9be2-b771b895bf45", "value": "6144:hI9aHyWbCIk7VxY8Q7fa2x/F08eugEQUI:hyWbW7VxxQDlx/S8DQX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646136543, "uuid": "137db256-566c-4417-883a-35cc489c500e", "value": 227920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646136543, "uuid": "b381e715-434a-4a97-bf6f-40bfc96f394b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646136543, "uuid": "c2f429bf-6aea-4798-a87e-3e7d4bcae021", "value": "b0eb4d999e4e0e7c2e33ff081e847c87b49940eb24a9e0794c6aa9516832c427", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d9f0e67-995a-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646137340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646137340, "uuid": "226e8b21-5803-491b-bcc3-62963e075ff9", "comment": "Malware payload (Formbook)", "value": "25a4a2eed28102497ad0e0b3f22ed54c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646137340, "uuid": "67e06355-4507-44fd-82f3-8939ce232fb6", "comment": "Malware payload (Formbook)", "value": "b15532a660090cc54e4f9f2be695da798d85a00a0aac366f1edfb665687048b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646137340, "uuid": "bd4bcefc-1966-4637-a4b0-313c5436ac18", "comment": "Malware payload (Formbook)", "value": "4523a4d509ea47d45bd14e7ca1d495463f8f8eb3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646137340, "uuid": "391e9b37-fe4e-4a2f-a2ff-203560b99119", "comment": "Malware payload (Formbook)", "value": "c9ad9d95fe69f4d8b3f7ccee490d0ace3ec33844e0ba2401272f469fe2f382d40b5e49d50daedb29ab14a88f1ad3e85e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646137340, "uuid": "aff82666-64f0-4fc0-a1ef-2ed04fb827ea", "value": "T1C315AF4834E6207DE4368BB1CAD4EFE0DB69F262D54960B250020E599A0DBFDCE45EFD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646137340, "uuid": "63288d2a-633f-46b5-adb5-c2f2238a0933", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646137340, "uuid": "01e304f6-6062-432a-bd5e-ffedc79e1e95", "value": "12288:3aZ5RIw7QT5VmaqrR5PJaOPqb0x6GhC6Y9g5cKJZBI9FgD/RxLYcPhVi/9qzKR/W:3A7GkP5PJaOoSCze3ZGknPh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646137340, "uuid": "4667b364-3142-46d6-82dd-263c38b0ee85", "value": 909824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646137340, "uuid": "63342c27-206e-4577-8b9e-f1eadee3e4f9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646137340, "uuid": "4aa6bbc4-f9e9-43ea-a261-b42d34f2c943", "value": "Purchase_Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bab205ef-9923-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646113927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646113927, "uuid": "b8d48da1-c4a5-4681-b4e3-2e22f4321d01", "comment": "Malware payload", "value": "aa362b99d6737d6c800f510ad6fdb814", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "otfrem", "colour": "#8FDB3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646113927, "uuid": "3effe69b-608f-4af0-8e42-932f2903ac8a", "comment": "Malware payload", "value": "b1c8c49ed3b69a2c5f00f628c30c324bb6a72431054b59aa18c4247111d388af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "otfrem", "colour": "#8FDB3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646113927, "uuid": "68254bad-0925-4f43-9c23-2ef23b5be143", "comment": "Malware payload", "value": "de7d7e8c5f6d448859ba0406eee3dcd720820918", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "otfrem", "colour": "#8FDB3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646113927, "uuid": "a6ee9e65-0602-49de-9e45-64d459a5b4a4", "comment": "Malware payload", "value": "d0082849eb6e00e8e7f20c2d50d26c2b90fa59369f2153d626ab67616ee72ee7c65774e64e26b500b49397385daa271c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "otfrem", "colour": "#8FDB3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646113927, "uuid": "e154e6e2-7fc7-4f02-a864-f4dec336de05", "value": "T1BB434BF2F1B53910E50D8D36EE73E8ADA41B24AEEFDF0618405C95A036D2058CF9C6B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646113927, "uuid": "61a86065-8ff2-4585-accb-b0901ca641b2", "value": "1536:S5jE+132lhisKZdltWeks9Ru6nsQscyfO0:wjL4wsKNtiD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646113927, "uuid": "eec8d93c-ee8d-46a4-8fff-e2fad4535b81", "value": 56168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646113927, "uuid": "57c8847f-6bf3-48e2-841f-743e52c2581e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646113927, "uuid": "4f3b6459-0558-4be6-87d7-01379ba09553", "value": "sam1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b912af7-9985-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646155831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646155831, "uuid": "64f55003-29fb-40b2-91b5-451c633a13a5", "comment": "Malware payload", "value": "64608519d52c6070f49c7d5c64dd6c4f", "object_relation": "md5", "Tag": [ { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646155831, "uuid": "552db5f1-74e2-4e12-bcc0-52cf88c93606", "comment": "Malware payload", "value": "b1f7bcbc828811ba2e1937ada7bad6c63a480c3714b172ef895366eb48c4dbad", "object_relation": "sha256", "Tag": [ { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646155831, "uuid": "72ce2678-3560-49e2-a8c6-96918168010d", "comment": "Malware payload", "value": "470eca5576eeb7560b6b978dcee4f8c2b7883afa", "object_relation": "sha1", "Tag": [ { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646155831, "uuid": "b1ef8c43-22e1-4906-9765-bbe74329ac38", "comment": "Malware payload", "value": "b37fe2e3013357ef4e9eb3c36b8223dfbba36e1b413c2f6c92b631054da247acfc8b1aa902d32648329410eb9d5855df", "object_relation": "sha3-384", "Tag": [ { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646155831, "uuid": "9b65c825-b4a2-46a0-b7ef-ebcd5817f00a", "value": "T16484A241BC61CE6FCF889672586693F9E275AC829E889503711CB32E2FBF390D45D781", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646155831, "uuid": "c6c74745-3bff-4071-be49-bfa399ac3a90", "value": "6144:xxEtjPOtioVjDGUU1qfDlavx+rdgDmqFOOQOlnOXbrGdwZdq7SOLof8iX7FQLspV:oQ3Oo5+804b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646155831, "uuid": "ed588196-1078-4426-bbdb-b98e6334ed68", "value": 396800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646155831, "uuid": "8346b3b3-3436-4b9a-9772-72c71cd7b555", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646155831, "uuid": "a0f8d6e5-85b7-43e2-9891-0cac32b72799", "value": "RenewalFromSICS_9_SU.xla", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3eed980-9933-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1646120841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120841, "uuid": "263131ee-7b53-4579-839c-5f09322499fa", "comment": "Malware payload (Loki)", "value": "313487ea2961de7d5b451ff47cb70373", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120841, "uuid": "776f79f5-d8eb-4fcd-ba1f-71c9f0f17940", "comment": "Malware payload (Loki)", "value": "b2655c23ec984ff04ac2229b96ef9faaa1d89f79fd028fdca5ea8fd3be76922c", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120841, "uuid": "d464ecfd-34c4-4f57-a4b8-0a2698d5bac2", "comment": "Malware payload (Loki)", "value": "52bb294a2b82ca3d932ab399edc9246c28d5988d", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120841, "uuid": "ebe14372-55e6-4b19-bde6-7e7a293121c2", "comment": "Malware payload (Loki)", "value": "44b3c40d59efe8d8c47b40f7e51202b83df8e2531eff55abbbc9d5eae53d725ddcc0f622b0590e27ab25d7b3a9871d4c", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120841, "uuid": "238aa69e-d011-49f7-82e5-283036c80218", "value": "T18B1402172CCDD35AD9DAA7760686A92A4783DCF60B4EE51915CBFF340AB0B914232733", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120841, "uuid": "c2762dd6-64ab-44e8-94ff-a99eb6538df5", "value": "3072:k89s00b2bTahUpxcg9tIrN268lSU5rYh3a3H0T9/PlsCwskFvAqgi3aiv:/6Zb2va2Izd8lxrYA3O/PCCkFYqg0pv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646120841, "uuid": "377f30bf-fb51-44a7-ae38-1f58aca5c387", "value": 191064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646120841, "uuid": "f8b61b28-50c7-4367-bfa8-72e9fd9b4aa4", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120841, "uuid": "7381436d-e31e-45a5-972f-f60e406aab01", "value": "70.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42b67cb9-99a6-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646169990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646169990, "uuid": "adb269d6-35a1-4025-add0-345f186f4082", "comment": "Malware payload (AgentTesla)", "value": "651690e9368dc06efa598fcf21f79d1a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646169990, "uuid": "9df4130a-88dc-4dfc-b121-3f6bad80cae6", "comment": "Malware payload (AgentTesla)", "value": "b27c2bf3186f78afc6b4df61c0df7bfcf65a9228cedf0281a602854c83413840", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646169990, "uuid": "980f5b05-3919-49cb-a015-5db7516df256", "comment": "Malware payload (AgentTesla)", "value": "f35d40cf46aec37dd78cc64d99be622118e9c2bf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646169990, "uuid": "325da36f-886d-4efc-9320-8dec134d5c21", "comment": "Malware payload (AgentTesla)", "value": "aaf7443962a993dff7025bd691f022cef8cf5ab5a26dd97418212ade63eb521b92e24fc1787405c35bf2ce635d9635e8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646169990, "uuid": "dcf004d2-492e-485b-8af0-2b4c67def0c1", "value": "T19F15BF4835D6603DE836CBB1CAC0EFE0DB69F272D54960B650020E19560EBBD8E59EFD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646169990, "uuid": "41b0e99b-c338-4f23-86dc-1f0af9240a9a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646169990, "uuid": "cfd881a9-9fa3-4e4a-b93d-03de85c348ad", "value": "12288:Nvsdmhv7c29Nh/dzyHQFwKOz//EgCEfD3yoMSs4tpSyNSIINUwmq39KZv4a26AUA:mivQ2nFdsz/8gCOTtptwmc9K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646169990, "uuid": "09dcc127-96c1-485b-ab39-796185dcfc21", "value": 951808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646169990, "uuid": "f2cdd8ee-3468-4d4b-89b2-20ef8d802e38", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646169990, "uuid": "62e230ef-2321-4ded-9c5e-09bbf35f6287", "value": "new order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df2dd427-997c-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646152214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646152214, "uuid": "6ad7fe61-56eb-46d8-bc42-08b3b137d980", "comment": "Malware payload (Heodo)", "value": "abae46af81de374e49a15686c8ab8497", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646152214, "uuid": "eac13314-61d8-435d-b616-4a080cfa7b7e", "comment": "Malware payload (Heodo)", "value": "b2d7ffbf94acad1acd2bec5370b5e551b13f89cb5247b334ec61ae65666fbae4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646152214, "uuid": "04b4c307-b985-4f9c-a22c-85cdddd0a28f", "comment": "Malware payload (Heodo)", "value": "165ecfb265d855b2ba83192bcb75b5e78233232c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646152214, "uuid": "ea3cb669-472c-40e5-8319-d3c1e13b255c", "comment": "Malware payload (Heodo)", "value": "183c1d50fbc427bf9470f7bada99746181cbd913a1f4c386adb50956d71c747a38cdf5bf6af6b7ad9e0027d23772d196", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646152214, "uuid": "c7d81948-996c-459a-bd16-cf595eebde8a", "value": "T1EFB4AE12B790C076D1AA36342526A7B51AEDBC709EF5C3876FD03B7E5E301918A3C35A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646152214, "uuid": "16a8c604-21aa-4d32-9177-44e17e46c435", "value": "f08242131de62ca6d7c4b2727b491b3d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646152214, "uuid": "2947b78d-25e4-41bf-accd-04873c8d406e", "value": "12288:jE3TMKM/JjdkdO4+BNhOwyt4h43JopSz/o:jE3TM/JjdkSc3Ko", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646152214, "uuid": "f2ab952c-7876-4160-b19d-1d673bcd33f0", "value": 505856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646152214, "uuid": "2edcc56f-e6ad-4a6d-bf90-611b459063ee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646152214, "uuid": "96a3e459-4fb7-4cc7-b256-45ff906d7088", "value": "abae46af81de374e49a15686c8ab8497", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd5dc07d-9946-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646129071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646129071, "uuid": "4b5fd885-d53d-4870-85dd-cee6b9870819", "comment": "Malware payload (AgentTesla)", "value": "2a50c251345f8efdedb296d883471e12", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646129071, "uuid": "6a1b876b-9041-450e-916e-a0aa3631acc7", "comment": "Malware payload (AgentTesla)", "value": "b2ffcbf5f2e2b05bd21222c0f3b0a7f2b2101c5d1a0dd9bd0447d3ae96486555", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646129071, "uuid": "42afa6b6-11e5-4c84-b58e-5463aa43c2e4", "comment": "Malware payload (AgentTesla)", "value": "075bcd914176a849289f3144458b7030645945ae", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646129071, "uuid": "ca6d128e-7488-442c-bc1d-b4a0efdf9ad3", "comment": "Malware payload (AgentTesla)", "value": "d56fbb3da7ed9b72c7a36ff941d45f2f4ae08b220f0a951c925f7b9b27585ca46cba23317ae20f277f8b9b0cfb1dfe84", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646129071, "uuid": "d270b9f5-c309-4701-8d42-bea0f7905396", "value": "T166F423C4940EF5955223E7892325B1EF867A895DDA1D5BC0330CCEAFB69C78CB728153", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646129071, "uuid": "aae5f9a3-bce4-4f3f-a51a-239946df170d", "value": "24576:/HJQQzte69zgZkOiKOWTU0lW4wQpzZqTLI:K2tIZDfNH44jpkI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646129071, "uuid": "8844b897-9726-4039-8d7d-4feb00a0e81a", "value": 788526, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646129071, "uuid": "260cddb0-4c2f-40c4-bb77-bf8d4d195f87", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646129071, "uuid": "2a169f25-5cc8-45e4-80c9-b41a4ac972c4", "value": "Outstanding Remittance Payment.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3990a48b-9934-11ec-9275-42010a9c0029", "comment": "Malware payload (RemcosRAT)", "timestamp": 1646121012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646121012, "uuid": "79a1ea79-49be-4760-bb67-c02c7eeff8c2", "comment": "Malware payload (RemcosRAT)", "value": "29da7d7fdb0a7904c023088e0c84ed3b", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646121012, "uuid": "6c91cc8b-d6e9-47d4-aa05-fa8999b0fb5a", "comment": "Malware payload (RemcosRAT)", "value": "b340e0a5f1a0177916fe0e416901bb8378aff137b0e95f8f7c3c5024aabd3790", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646121012, "uuid": "b36bad9e-0346-401e-9856-4fb952912ae0", "comment": "Malware payload (RemcosRAT)", "value": "187423eb81fa8e0535e867809e2c28ed40078567", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646121012, "uuid": "6e1c6c28-d80d-487b-9ccf-7d68c3a482c1", "comment": "Malware payload (RemcosRAT)", "value": "d3c847a5d8f2bf2e91b9345210dbe0632ea5393047c8f56cb95bc474723b2d1fd638ec59af4123e172881c077c2062b5", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646121012, "uuid": "7b421e0b-4da0-4966-9977-efc9cfab838b", "value": "T136141244674F8002E66711B81F698D7667EBDEB02A28F7DE94FA793048F1CC50F426A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646121012, "uuid": "3cff8bb3-fc48-442d-a49d-08b371abae79", "value": "3072:T5BF8nm0qPSGWbU5XrrNyXoCFJY6IRfRmR3jVX3U2wUj6NTj5AQ1qEJz+Q4E6IFm:nF8tqKrGXrrgYCFW3RkvX5wAC0ETXauG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646121012, "uuid": "ab7ccd8c-9f58-4178-9d39-aa2f699035e3", "value": 191224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646121012, "uuid": "137f32a4-9c0a-4cca-b911-894c2ed94100", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646121012, "uuid": "45a71a28-4a3b-49f2-84f6-b84d1fb7f407", "value": "+9053598666_1118-081312-109.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5967466-9938-11ec-9275-42010a9c0029", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1646122938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646122938, "uuid": "8f4e9f62-db1e-4abf-913e-8a5119e7583a", "comment": "Malware payload (ArkeiStealer)", "value": "cd037995d52161eb56d0e05f30cf3fde", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646122938, "uuid": "7b458f4b-d26d-4569-80cf-408594509781", "comment": "Malware payload (ArkeiStealer)", "value": "b3b001cc7aef5e7402c0da0fa6c496fd5845037f07c258271352faedd352eb8d", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646122938, "uuid": "0473184f-631e-4325-a28d-6ae579aa4ae0", "comment": "Malware payload (ArkeiStealer)", "value": "0df3be33569ffb7808e603306f6fc5fda17bc8a8", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646122938, "uuid": "6a961596-0776-4149-a4ac-80fe34ab55ad", "comment": "Malware payload (ArkeiStealer)", "value": "176ca493a062e7160f9f0283511322f6d002c6226092323752cfdd5acbddc48fb4bd505eb9a75b454306c04f194a3bb5", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646122938, "uuid": "c25a9cc4-5983-4d60-a38e-0cf47cf98d08", "value": "T1EB74AE10AA90C035F0F752F88879D3BAB53E7AB15B2564CB63D51BEA16386E1EC30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646122938, "uuid": "c7179c27-12bb-4ac6-9057-95430de68272", "value": "070604688899afa7e1438edbf6a9e9e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646122938, "uuid": "05422c93-eb85-4307-9182-d6ca652e2b4e", "value": "6144:zkVCicHNGHnsnsP1NN/ApEKcJFeNIMvGAqztp:oUHNGHnsnEH/AbcJFwI3nf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646122938, "uuid": "43c7d871-43b6-45b8-85a8-8bb2fd0084cf", "value": 345088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646122938, "uuid": "2f8bea3a-6db3-4247-9c36-5f805636f552", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646122938, "uuid": "8d74473b-46f7-4b55-b6ea-b09b13dfe41f", "value": "cd037995d52161eb56d0e05f30cf3fde.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a88366bf-9956-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646135801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646135801, "uuid": "616b3702-a272-4add-9d85-e4447b6bb2ff", "comment": "Malware payload (Formbook)", "value": "c7012ce63b4ed9e49bf7be48fc27beae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646135801, "uuid": "c98ffed5-44ff-48f4-8382-28faaa3140a9", "comment": "Malware payload (Formbook)", "value": "b3babb49432b3d09adbf7e79dfb2fe84f4d417ad394ccd59412c9e083a42a673", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646135801, "uuid": "db5a4d4b-92bd-4915-9332-4942f38a5238", "comment": "Malware payload (Formbook)", "value": "8c91c8e2a90b9e9b3d3dde1fb32e02e5de5dd347", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646135801, "uuid": "67e8632e-7fde-4395-81e6-8df5235cd1c8", "comment": "Malware payload (Formbook)", "value": "5cbcb0a1cb0a5c72180a4a49dbaa142341400944069805ecba361a43281ef0b03c04c3ca2df535074c4f9efc05eec6a1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646135801, "uuid": "efe8a76c-cbf4-4562-8243-b211522b876a", "value": "T1D164CE427ED78CA6DAFBC53D1DE18E389E6D71CB0970017F3A5EDA2E29211864E4D18C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646135801, "uuid": "f8b941e7-2d7a-4140-9a11-940af8ac1a1e", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646135801, "uuid": "f876f7c7-dc22-4bfa-90a2-c09753976e6d", "value": "6144:1xDKbv+TNLcntj5abpBleU8+twIfCODYkx:uccwpXeU8+twIBf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646135801, "uuid": "fc1ebe0f-c054-4028-89ab-e50a4386f114", "value": 308180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646135801, "uuid": "15e29b77-6e10-4caf-ba6a-58dea37c05ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646135801, "uuid": "03b07ce2-1f6f-4c50-9473-41917fd3a3a8", "value": "RECEIPT 0266255252.pif", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fb0a47e-998e-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646159623, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646159623, "uuid": "cbd6f903-161c-4ec5-a403-42d92e285a9d", "comment": "Malware payload", "value": "8e1cc1e4ccefee63008ff49219345a44", "object_relation": "md5", "Tag": [ { "name": "ramnit", "colour": "#6E87D3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646159623, "uuid": "0de48f3c-a93b-481e-8ae8-64ff1fa4d35e", "comment": "Malware payload", "value": "b41d64df33eff5fe041782eb6b1d54121b35985aaf57ef852dbdf08f4a7abc2e", "object_relation": "sha256", "Tag": [ { "name": "ramnit", "colour": "#6E87D3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646159623, "uuid": "50b98c4f-8a75-4029-a88a-a5782a44f2c8", "comment": "Malware payload", "value": "73f71bdf3c986caab0482a503700b24150d84b20", "object_relation": "sha1", "Tag": [ { "name": "ramnit", "colour": "#6E87D3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646159623, "uuid": "592f4f46-724c-4b9d-8ad2-fd45c8b405da", "comment": "Malware payload", "value": "15e7f9fcfbf73abe7535fd338861f2b9b29afd5c98564653d1f621da373e582f4727c7aa7f09702a3e92735c589be20d", "object_relation": "sha3-384", "Tag": [ { "name": "ramnit", "colour": "#6E87D3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646159623, "uuid": "aa610326-e182-4526-8cab-ce58f0260f18", "value": "T15074B0C9516944C2EC063EC5AC643BC74735727387F4043426AFAE489FBBDAD8449DBA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646159623, "uuid": "a4b0de71-f666-4751-80fb-62978916f44c", "value": "6144:EsMYod+X3oI+YVsMYod+X3oI+YVsMYod+X3oI+Y+:S5d+X3v5d+X3v5d+X3M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646159623, "uuid": "36548dbe-5310-4ea2-9a58-138a47ad2788", "value": 339192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646159623, "uuid": "cf03e514-0784-4a53-85e2-65c59e7f22ee", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646159623, "uuid": "9e6f299e-3a03-4e89-8e7f-5b1de81f0ca5", "value": "ramnitdouble-original.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fd32191-9944-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646127868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646127868, "uuid": "7bc4b46b-fe07-4dbb-b6f4-172dbbf587d7", "comment": "Malware payload", "value": "e3c9babe76eaaf038bb37b02471ec8e1", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646127868, "uuid": "07ab36b1-a48b-496c-8743-c6ba67021bec", "comment": "Malware payload", "value": "b4c6982f256c03cf57711b1d5099427f5bc9feeb61cc6f835d1764ccb324e302", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646127868, "uuid": "4b733f51-5521-438c-91a3-29606ebba57f", "comment": "Malware payload", "value": "3930161fa9996282f5245657fa19ebf4caf7eff1", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646127868, "uuid": "191016e9-83be-463e-85f4-076f05041e4c", "comment": "Malware payload", "value": "48441bee77adc0b213ee5ceabbae61a837c381c4a925f0ccd8119e724b7d9dc287ade5e9a998a99e4e1960e87ece641b", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646127868, "uuid": "695c8886-df37-40e3-9d8a-e4bfd87e7007", "value": "T1555423F7109010C9B4ABA1339D68D050771BD2FA73E9A72CCC48673DDE88A7B51B6E12", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646127868, "uuid": "b8a8f950-4dcc-489c-8e2f-843b4db6097f", "value": "6144:nHebdm2tb/Iqp1QLif5dpqfdSDVVPcOBpryTzeRL/6G3ONqGxCfGxDxe01g:nHebo21/iLif5dpq1SDVVPcwhyTzeVyq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646127868, "uuid": "220c84b6-d4bc-43cd-823a-8ebf5b770b73", "value": 304692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646127868, "uuid": "67016172-492a-4a36-8854-9908bcd4b902", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646127868, "uuid": "be095ea5-2ba5-485f-a387-b301f772b877", "value": "RentalQuotation.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec20f0e5-996f-11ec-9275-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1646146652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646146652, "uuid": "da915f91-97cf-4d4b-bcaf-c5d9ee12fe7e", "comment": "Malware payload (Quakbot)", "value": "dfee71363ea3fd56804cd78d7aa7b625", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama161", "colour": "#9F5DB8", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646146652, "uuid": "bb5a9554-9b12-4351-9503-787c651fc788", "comment": "Malware payload (Quakbot)", "value": "b564bf1a18dd98c00a9b99e80a6cc11e1f800d3fd0a4a4d234d9c7763359d74e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama161", "colour": "#9F5DB8", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646146652, "uuid": "4287703b-7718-49bc-9882-75ab5dc8b761", "comment": "Malware payload (Quakbot)", "value": "5ccc9584355f0fc21e7bb3f2486ebb06566d92d1", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama161", "colour": "#9F5DB8", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646146652, "uuid": "0698ef36-3682-47d8-96a8-3440d39bc2cd", "comment": "Malware payload (Quakbot)", "value": "2c41a8b0bdcaa4525a57dd3423e151d5d631db9dff88e7782fec8f68a51ad3c116b81a291e02656ff0373963853f7dc2", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama161", "colour": "#9F5DB8", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646146652, "uuid": "01694a46-b40e-488e-9fd7-a1817bbcf033", "value": "T19C25BE61A2D155BFC1733B7DAC3B2194DC24BE912D10DC8CB7CD1A9E0F296A227215BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646146652, "uuid": "d1680b5e-137b-45c4-b196-bd229c69c611", "value": "f3a2b34cbcfe1640f11d8b0978b1dab8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646146652, "uuid": "7c5e950e-3852-4b01-a337-c12f3cbcdfac", "value": "24576:HBl4LBmTVxqyZWUgxB31FFbDt3xywiDSR6bs2:HTaGGxB3LZB3Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646146652, "uuid": "7bf5c94a-1791-467b-b01a-c536b796967b", "value": 1048576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646146652, "uuid": "1dc85c31-9068-4710-9390-e10e4fddd345", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646146652, "uuid": "476bfa10-3b68-4470-ac69-7cff0db98e1f", "value": "44621.6628975694.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e9f5edb-9943-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646127436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646127436, "uuid": "e971a362-6548-4445-8bde-2348e781160b", "comment": "Malware payload (Formbook)", "value": "d47469a80d2c6b9003af1e944d8c3dd4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646127436, "uuid": "da12499a-a0f8-45e6-ad79-da6e0ccea5b6", "comment": "Malware payload (Formbook)", "value": "b56dedac00004e64eeb25d2819759146ce1f5ee212bd441feb0e0671747d6415", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646127436, "uuid": "ea0c8e0c-8495-4ba8-8699-b00123449127", "comment": "Malware payload (Formbook)", "value": "8af982228ff351aa61b87583c827e7c0f5d032db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646127436, "uuid": "dc051a2d-55ee-4886-a218-ab0555de4d3d", "comment": "Malware payload (Formbook)", "value": "170defaf0c497bd46240f16f10145f1d274793f6a8196c54fe994a079f9dd46db1e7ba4fa1c283c74f764e0e307f05fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646127436, "uuid": "74aebca0-21c9-4978-acdf-3d3df23678f0", "value": "T1E7B4E04B7A355B96D83DA7346425120CCFF6E962C71EF2B87CC6B5C900B2F0B4626927", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646127436, "uuid": "b604c0a2-450c-46e2-946f-8ef0caa45ec1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646127436, "uuid": "3a56f05e-9f01-44f7-8718-74419a9badfb", "value": "12288:4Vvy6zxnGRUcZ64tcRm00dTmGZicNTa+aI5IcWQPxBRZDQzyC:4PncUHRmZdTmGZiGa+a7hQLUzyC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646127436, "uuid": "bef34639-7ce9-4697-8d72-671349d5cfdb", "value": 542208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646127436, "uuid": "40cff98a-8c1e-41a7-8c6a-401fc9959f77", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646127436, "uuid": "1d0a41e7-fab9-42bb-ace4-51cc06440264", "value": "HHH.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d23abe2-9992-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646161552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646161552, "uuid": "94c2916c-cfee-45e9-833e-3eedf4b0d079", "comment": "Malware payload", "value": "e9f5fd2e9ab44bde618a8bb3891857b7", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646161552, "uuid": "24f1ae01-6cf7-47a7-b2bb-8b241806cc1b", "comment": "Malware payload", "value": "b60cda227861fe724f9e0a504ced4e726f5b7c7e5a7933c12e6d8e306dbc0aff", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646161552, "uuid": "36846d56-88b0-48d5-a727-77dfedd4ddd6", "comment": "Malware payload", "value": "5e071b7caf6c87dc40f2188cedced1beaf4e6e58", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646161552, "uuid": "3bea0217-448d-410f-a6ce-322aeab2efe1", "comment": "Malware payload", "value": "1dc406ac687a5249b489b53d6d88cbc221a69063853fccfe3805a98c95ee74029c19f63e3f65794c367113aaaa1b76c2", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646161552, "uuid": "4c4af93d-b56f-49c2-bd37-8c5462b5017f", "value": "T1C823E116C560682CC73E8C758200AA93720A7901D9D5EB993585BB4C3B96FEB53DF5CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646161552, "uuid": "d5608f8c-918a-4b49-92c1-efc07fcc321c", "value": "768:Ko9DOevZCwrvtOzdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Uh0VPPDks:Ko9D+tT5fTR4Lh1NisFYBc3cr+UqVnDZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646161552, "uuid": "04c44c9d-0ee5-4e62-ad17-f9f573284871", "value": 47696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646161552, "uuid": "6daa79bc-033a-4209-a4a9-9f996822ed84", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646161552, "uuid": "efb5b951-af80-490e-b544-d0f908dd8d7a", "value": "Message_0103.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41d81006-999f-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646166982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646166982, "uuid": "d94e13dd-7d98-4b3a-aebc-44b122ede127", "comment": "Malware payload", "value": "f73865acc3fea52c7b41fb456e4305df", "object_relation": "md5", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646166982, "uuid": "d3b18854-e149-49b8-8502-31451e39840c", "comment": "Malware payload", "value": "b62e9a326d2e8d6c4cb95d523fd49f424de739fde60dde4eef3c54cfe0a654f0", "object_relation": "sha256", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646166982, "uuid": "8c8c40dd-83d2-4b80-bb40-260742fde4f5", "comment": "Malware payload", "value": "da03f0021b8ae71f76989b5fbb6c7f6a75a55126", "object_relation": "sha1", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646166982, "uuid": "dfde7d4f-9554-46d5-a5f3-a11af1e67a4b", "comment": "Malware payload", "value": "0f7dbe9645de2d03f32e34a8c6375f7b59f2538e04abef12387a815e8355d6878945083fbfe954db07f7d6ed5fb4db1f", "object_relation": "sha3-384", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646166982, "uuid": "a04c772b-cbb6-47c6-bf9a-7dca9e47b561", "value": "T1C723D025C1607828C73E8C759200EAD2720A7D04D9D5EF893585BB4C3B96BEB57AF9CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646166982, "uuid": "9ecd2402-6d91-4d64-be20-e663e33559bf", "value": "768:iio9DOevZCwrvtD608zdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Uh0VPWft:iio9D7UtT5fTR4Lh1NisFYBc3cr+UqVC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646166982, "uuid": "2aeb3eee-4923-433f-8282-5163237ae41d", "value": 47699, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646166982, "uuid": "e5f92476-e0ae-4b06-b9b4-72596e4c91b6", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646166982, "uuid": "39ce3b40-ffe2-446c-a46c-20fe4adc9099", "value": "OPEN ACCESS EBOOKS_2.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc282f26-9943-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646127781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646127781, "uuid": "2fcce117-2e68-48b7-a3c2-1dccba485ede", "comment": "Malware payload (AgentTesla)", "value": "5da58dc07042eb806e18ca0721f4ae0a", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646127781, "uuid": "b976a27a-4a32-4fee-a015-72c09f3652f2", "comment": "Malware payload (AgentTesla)", "value": "b66cbafc450fe283c132cfee368392484f5dba0c4f88862dc4aeccccd5636df3", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646127781, "uuid": "8b369e53-605e-4eda-90b4-75680e00c111", "comment": "Malware payload (AgentTesla)", "value": "f8cb0e4a2d3fc919bcdc5d87cd8637651e26c83d", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646127781, "uuid": "4e64a00b-1230-4665-9002-427bfab1ea2b", "comment": "Malware payload (AgentTesla)", "value": "e00ede0307140b5dd5548210495321e066b0faab7beb2a5667cca08f16b8f4c5209b03d12c33fce61009a4091c885901", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646127781, "uuid": "b321ef5b-0b33-4134-8997-8d67c9d997de", "value": "T16F03F1119BA5183EEC74D824F84A62F5027CC99F92F05989CF5EAD2234FB0C865F9F48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646127781, "uuid": "eda0d90d-69cd-4788-b8da-1021c48b7242", "value": "768:lJyfqlErw+t75NghV/UeSY/M6NJl7CzY7chB8c/HxTrqei:lJBKrbta5UHklD7cT3/R6ei", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646127781, "uuid": "3c105277-a8b6-4d87-b8e8-0d19f4550805", "value": 38158, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646127781, "uuid": "79268415-a696-4818-b549-5f100c171d3d", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646127781, "uuid": "bb2b63f7-1f75-4c89-9b29-d36f65a39f3e", "value": "copia de pago.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "109a8621-99a7-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646170335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646170335, "uuid": "03f5b639-7160-4a7a-be5a-1296d39ef768", "comment": "Malware payload (Formbook)", "value": "9545719421db1d6a54358433b78f12c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646170335, "uuid": "474329ef-1c26-4eac-8ef4-76bcf46efb22", "comment": "Malware payload (Formbook)", "value": "b696aa2ab2bffe77db1a4623aa2769e7941af4ea6286f026ad09365180dd54ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646170335, "uuid": "c4557d85-741d-44be-847f-5a5293a53ec8", "comment": "Malware payload (Formbook)", "value": "2500f40c99e21fdb99b42a3d3cd38662b204cb5d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646170335, "uuid": "db4eb3a2-0f45-4445-8f11-8731b61867a3", "comment": "Malware payload (Formbook)", "value": "bc604f59e184749e8259cab126b6aad5455ce08ca199c115ab2074a480a9e8918aea83c1986cac3114690ffd5ccc2571", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646170335, "uuid": "4c911b04-bc20-465b-b383-973eaede0097", "value": "T158E423E0BA243797C8A926F9552121D053FFF0937602FBDACCD1B5C520963D86A11EAF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646170335, "uuid": "8a009f5d-9602-40c5-9530-2c5c7d28dcbd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646170335, "uuid": "c69b5166-77fb-4311-a206-a2637d8e51c4", "value": "12288:OiyyXr4eQ7bRBjHa8PgPbew0FAzwS7yZO/NmDOxybSfYKnsH1j/6ew:zyy7MbXjHRIPl0FAMSsO+bSdsVj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646170335, "uuid": "978fa16a-775b-42c5-8608-7a8dbb47a8cb", "value": 677376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646170335, "uuid": "69e4dec4-3ea7-41ef-a311-8ea8974d8a7e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646170335, "uuid": "42ccb639-88c7-4905-9048-478e0b62015c", "value": "Purchase Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5ffeeba-997c-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646152198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646152198, "uuid": "1716c08c-d316-4966-9bad-1b7b21fb70a3", "comment": "Malware payload (Heodo)", "value": "acf77d7d91cc1f924701f7a979c9a853", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646152198, "uuid": "3133f80a-39d3-4910-8952-d10c351fa8e9", "comment": "Malware payload (Heodo)", "value": "b6f820941f75bc276c77a7fc2ffb0a9c8edfb3f02276960071c5cf8de5a04005", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646152198, "uuid": "6adc87c7-dccc-46f1-a4ec-2800dfb42492", "comment": "Malware payload (Heodo)", "value": "747f006b58cd252385bf5237c429dd31bfa26f04", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646152198, "uuid": "f89a4dff-06d4-465f-9965-4d6ce81aa980", "comment": "Malware payload (Heodo)", "value": "7b0cc6e42fa4df0da950e767a10582eda057dfd59b96a9c21e50dab2ef51a88c7d067cb5bc495d138a23aa89e0b6aacc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646152198, "uuid": "5d348599-a889-4b88-b901-04d135407efb", "value": "T1E4B4AE12B790C076D1AA36342526A7B51AEDBC709EF5C3876FD03B7E5E301918A3C35A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646152198, "uuid": "75374a6c-6a59-4c1b-b0f3-88bc9d52e7b5", "value": "f08242131de62ca6d7c4b2727b491b3d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646152198, "uuid": "24cae600-7386-46f8-8bed-472c28c5cd8e", "value": "12288:jE3TMKM/JjdkdO4+BNhOwyT4h43JopSz/o:jE3TM/JjdkS63Ko", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646152198, "uuid": "6336932c-27bf-4047-b732-2e093e1b1af8", "value": 505856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646152198, "uuid": "5df59d5e-fe49-4585-94bf-309359e3797a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646152198, "uuid": "e88c8c68-ac83-4cb7-923b-7d2d7b97f123", "value": "acf77d7d91cc1f924701f7a979c9a853", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5cac619-9923-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646113919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646113919, "uuid": "1992bee3-4d76-4e90-90e8-f85ddd557089", "comment": "Malware payload", "value": "c2da7d47d46a525e766b399ee057956b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646113919, "uuid": "8becd234-565f-4629-9c7e-f2c52c936a3d", "comment": "Malware payload", "value": "b7765b65a7b35d3fb393883bf6f70579ad76b1e04573d9cf9825aed259a67a7a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646113919, "uuid": "8f00ed21-15dc-456c-8ee9-03f83f46ac69", "comment": "Malware payload", "value": "92c096af4a6b1a4472eec126deb2bfe4bb886d6e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646113919, "uuid": "6387580b-2818-4fa7-9281-6da375c89b36", "comment": "Malware payload", "value": "9081f14d4f0b536a39490032e27f2d234857eb2df27a800b014f6a4ab9125df3bf51a3bd2fc4c30d63e86770a37bb341", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646113919, "uuid": "c8c2c010-8cdb-4e8c-8511-56b74d0ad7d2", "value": "T1FDB319079A407E33DB67867B4D7B0636E5A3C200873899CBAF60586967267D1BE3334D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646113919, "uuid": "c606c5f3-9853-46ff-8587-11ac5d368773", "value": "802dcac7aab948c19738ba3df9f356d9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646113919, "uuid": "9728f3a7-f462-4c68-a307-03b37436b507", "value": "1536:ytri2+Oitriztri2nOitriztri2mOitriztri2nOitriY:Urm0rp0ru0rpH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646113919, "uuid": "ea198540-fcf8-470f-9cd1-523690b74210", "value": 114688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646113919, "uuid": "ee76bc91-a2ff-4468-836a-f1e0be1119a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646113919, "uuid": "69f42b2d-7bac-403a-8bcb-8678c3fa252c", "value": "sem1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a74c2ba1-9900-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1646098862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646098862, "uuid": "55c5837d-91fc-4693-aa4f-9cf279ae97ed", "comment": "Malware payload (RedLineStealer)", "value": "58f363c9fe5244aa2a953a196bd7146b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646098862, "uuid": "954b85f0-a103-4429-af93-ec9651db73d6", "comment": "Malware payload (RedLineStealer)", "value": "b7f72b580d2ae1f4d8f3bc243ce63a28cb41363077992214c7b63f71adfb3d91", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646098862, "uuid": "1c343dc6-3575-4e7e-ae9e-5426b21abc67", "comment": "Malware payload (RedLineStealer)", "value": "e8c4bba3a08f23656a354b16b53952945d8b8a4c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646098862, "uuid": "2d7e6488-b6c8-48bb-b7a4-ba92211ba899", "comment": "Malware payload (RedLineStealer)", "value": "0ed755c24899bba38aa2ff9c1ae09521398163492942424c5d7d67618b404b2c387c015199e1f55d5ec63a451ca075a0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646098862, "uuid": "5ab7ab92-ae4b-4874-9bda-5a9dd23fb714", "value": "T1EE64AF20FAA0C035E5B312F8497A97ACB63E7DB15B2064CB62D527EE16356E4EC31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646098862, "uuid": "f376a514-6c48-46a5-a47f-1db2c68bd57a", "value": "571651a80e4ab2d7da8009fcddc6a93c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646098862, "uuid": "fea15740-3a63-4e9c-be1c-b9e13dfe0a04", "value": "6144:WIn83n2pJCGZlKNZ65uYw5ZzW8+phGHEhuz:lk2pJCGa365nr3bi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646098862, "uuid": "8457e15c-7647-47b0-bc5f-5cb6a43c22c7", "value": 334336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646098862, "uuid": "fe7517cb-bfa6-4b90-ae16-5128af56444c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646098862, "uuid": "3807f141-6166-4170-80f6-a5fc3fcaa72f", "value": "58f363c9fe5244aa2a953a196bd7146b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d5fab98-9986-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646156183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646156183, "uuid": "21b81d35-809a-4e80-b529-2414094e4cd3", "comment": "Malware payload (Formbook)", "value": "c3c62d7714dd5af682876b8fcc9c5185", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646156183, "uuid": "6a8201fd-2e1f-407b-a08f-f2a5f12f9daf", "comment": "Malware payload (Formbook)", "value": "b81070ab1c53b68f110a8127a7b1bc7fc83d9726c50e787949cac94f809bd92d", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646156183, "uuid": "a09c6d8e-355b-4fbf-9b46-0418aa6f152c", "comment": "Malware payload (Formbook)", "value": "de7c7c7f22b1ebb0225502b1faf2aef5909898e9", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646156183, "uuid": "1aa3e604-0eae-45cf-898c-46cce1219c83", "comment": "Malware payload (Formbook)", "value": "6633e859c3fd969d7271cf6ad3307b4f7546ff497aa66f3adf6b8961b9a04a27d0c6639d4bcbc473d08dd0dd83c66183", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646156183, "uuid": "e28f5906-444c-4aa0-8499-dea4e119c29e", "value": "T11D04C4FDFDC42730D4C46F37F64853FE6989EA33829514796A283A4625706E198BEC38", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646156183, "uuid": "52af0c1f-0524-4da2-9034-81f777d2a8ca", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646156183, "uuid": "77979d93-ca44-447c-b108-f40c69981672", "value": "384:DWkj5CAb1hZoeLbLa5PI81ECzo1pYsIW2uegHWsXQjnpEWqs6yJi3tfAsAz89nhS:7bqCbSRYNIWybqs6yJidfAsAz8lhuMi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646156183, "uuid": "19c07542-2fb0-4f4e-a49c-632bcc66a78c", "value": 176640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646156183, "uuid": "4849fd73-784c-45cf-b836-1496668ad729", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646156183, "uuid": "0d021cd0-a89b-4898-85da-d9b6dd3161f6", "value": "DHL_FORM-01032022.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c241389d-9985-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646156031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646156031, "uuid": "22b40f5f-fcce-4b13-8e8a-203549e9a215", "comment": "Malware payload", "value": "ba52b573727c7e326820f1cc37e96f5d", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646156031, "uuid": "99b82653-1fb5-4e0d-b345-dd5db38993b1", "comment": "Malware payload", "value": "b89e443a8d5100f92448e0ecf3ea682af6a3fe31a3530cf1d4e4da93d76e2de0", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646156031, "uuid": "c07f610c-573d-4614-974d-e72b106ebf87", "comment": "Malware payload", "value": "98a2965ba2987baf41d36e961fe035f65341617a", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646156031, "uuid": "dce9251e-f594-41a5-b0c9-6e55675cdfbe", "comment": "Malware payload", "value": "868234ac10392990fda774ad476a6c2f2f4423affcc99f6c2e07feac3fc516c8eca1a9998fcaebb60ee9dfbaf5bcc2df", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646156031, "uuid": "7ec261c7-55b7-4cd4-bba9-e3fc9d871464", "value": "T1DC1412F475A9C9ECC256E375CC17E95EAAA2CFA03C48E7DB2212700F4C71A58E207356", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646156031, "uuid": "8b8891cd-80f6-4b23-a657-b15e46fd7cbe", "value": "3072:Kj82uJByQyVex18mYu7DgoL0nfsSt01Vu4Og6ivBBzyw0G5aJILpTQUoeC9Dxj:6Rujy5Pm7DYhK3u4O6zzyBaorRB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646156031, "uuid": "e12ad37d-02ed-44fa-a4b8-d8053bad13f4", "value": 190664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646156031, "uuid": "3494dc84-67b6-4ac0-9b57-279749956fd3", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646156031, "uuid": "a3787cfc-32c8-41b5-9e08-52cab87561d5", "value": "New additional_Sub2.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c32cfa89-9932-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646120384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120384, "uuid": "ca73146f-7116-4b2a-8f98-8b55b8c37bea", "comment": "Malware payload", "value": "ae4d8c9d03682e8c7fabc1d0f3b18e96", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120384, "uuid": "cce60832-eebf-422d-bb30-a341a7a8fa36", "comment": "Malware payload", "value": "b98ed0b56caabd2a859387bb9d999a0b179708869014bedd5f679a0494df1c66", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120384, "uuid": "db93da96-9a1a-499b-9cdc-40b2d86163ac", "comment": "Malware payload", "value": "40fdeeb56c59d14237d32c8b6aafabf4286afb2d", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120384, "uuid": "172ef7db-b587-4829-aff8-4e9258184bac", "comment": "Malware payload", "value": "4ea37728711c9075ee55a724b71943fe2bf958d4517f6d072036ad387a7b7bad9efb70cd6fa330455e92bd02cf052ec1", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120384, "uuid": "5f837020-7458-4451-b19f-54236d618c1a", "value": "T11BE3CF117586C865D55803764CE6C6DA3327FC02AEBA031B3695F32F2EB7BE0CA13649", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120384, "uuid": "7599053e-c146-402e-a0d3-bba869cb8222", "value": "3072:zrxEtjPOtioVjDGUU1qfDlaGGx+cL2QnARLr+HeSGmiUfPsDpiAYkoP/7phIoOG4:3xEtjPOtioVjDGUU1qfDlavx+W2QnARy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646120384, "uuid": "f0041992-c4a5-4291-8066-5efffda93e06", "value": 157184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646120384, "uuid": "fe1c7504-78f0-45cf-961b-0bfef9c0cfa8", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120384, "uuid": "e35a1bd7-38d6-479c-a812-34f8ea809a29", "value": "Pago.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8d07b43-992b-11ec-9275-42010a9c0029", "comment": "Malware payload (GuLoader)", "timestamp": 1646117414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646117414, "uuid": "f5cab591-2def-433e-a2c5-c2d8346b7082", "comment": "Malware payload (GuLoader)", "value": "78038d6d3f58586a6e9ccd0066a38458", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646117414, "uuid": "5abc2cbe-2a23-4cc1-8e7f-7c2038198ad9", "comment": "Malware payload (GuLoader)", "value": "b998ef514e54e6045aa0f63af9ec069c56846b43564b945f765c2d97d0e7e5e3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646117414, "uuid": "b4337937-adaa-41b7-bf0d-e2067464bff0", "comment": "Malware payload (GuLoader)", "value": "fb3acbc0633f499da7f8d5b535f97fcea34d6144", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646117414, "uuid": "4263d1aa-fe12-4391-b85f-2130e19d86ae", "comment": "Malware payload (GuLoader)", "value": "a20cc3a97248a88bea16b476203d8005f55cb743daf9505884f8bd3602c1d937a9d7c5696ca3c1862d9cad07664b61ce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646117414, "uuid": "9285d606-9676-4729-908e-fae9f9df6ffc", "value": "T1209412512250DA13D4A75A35CAF5F9FE27E6AC33E94A739B1744BF163837703A309222", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646117414, "uuid": "c644e95d-42bb-49a0-a79f-aed0cf0572b3", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646117414, "uuid": "98a5d74b-b46d-4896-a453-27eb2a1d8fdd", "value": "6144:nNeZZ2WEeEYDxWSOHU5MFDGr1nagnHB5GnFVoiHUQz6s44pPXszk/ILmCT+5Un7f:nNrh4MgrhagjGoMmkuXLl+5Un7V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646117414, "uuid": "ea4ecaf0-178b-4801-81f2-991aa04d5580", "value": 426424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646117414, "uuid": "c284e750-ba0a-483d-8593-396e4d776642", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646117414, "uuid": "1b487f6f-5782-4dc3-a4bf-434eae0d5e10", "value": "RECHNUNG 28.02.2022..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bb26d23-9934-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646121069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646121069, "uuid": "629e8ab3-97ba-42ca-98db-1d3249da3604", "comment": "Malware payload (Formbook)", "value": "f8af29e0634e26ee188e76be7c3f4337", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646121069, "uuid": "91e7d1e0-bf71-4713-b85b-9a73002c50c3", "comment": "Malware payload (Formbook)", "value": "b99ee6d1625f7b0c9685c3bb49173c4425e39fbfe6a1a4eb6faf039b1ecbbfb8", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646121069, "uuid": "3a45e718-856b-44bd-a92d-193a93a31e94", "comment": "Malware payload (Formbook)", "value": "7c46dbc562d79530f7b7306fb18e16d82adf2bef", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646121069, "uuid": "40ecff86-d45a-433c-a984-109a25e68ccf", "comment": "Malware payload (Formbook)", "value": "c018cae647c3e2fb55255e1c248dc937295dfdbfef96fa8473d891ff13612abe0a1ce89ae5f13bd0fe409af605222b7e", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646121069, "uuid": "ee1c695d-9b0a-4da5-9dd8-16a486cf2867", "value": "T167C51256BEC56EB5DFBF42B74361E62D1225736E03A196CF7603049D3A61EC2843EA03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646121069, "uuid": "6a76c26d-0063-4e37-a496-fa298193de89", "value": "be710ba34b048ab0098050ccf62e369c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646121069, "uuid": "088fd4c5-788a-4f32-96e3-e02e75050467", "value": "49152:RmqGi7RLLaFKXGRoKCpUBRAsBqJoYXFh1A/XYd:UqGi7VWRGkRPBqhF7A/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646121069, "uuid": "9d416916-22c3-4593-b771-1eb6b937bc39", "value": 2560512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646121069, "uuid": "93e0a4da-0566-4d93-b61a-6dab459db8ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646121069, "uuid": "a6de84cf-c7a6-4a2b-8faa-c4f4fa235f98", "value": "CONTRACT VP-SYM102022 PI 21060008.xll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d16a8972-99b1-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646174954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646174954, "uuid": "40e61fa3-c3ff-4edf-ad7c-0d04255fc0b8", "comment": "Malware payload", "value": "81895765721b4e8c2c4a733b90d41512", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646174954, "uuid": "e64b95ab-e082-4cdd-9f2f-9a6a1a4b258d", "comment": "Malware payload", "value": "b9acf5ef4d92be979f03625c4fd8f8a1332cea80d1b2a05e5e0912a4e9a0367d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646174954, "uuid": "a4f2df12-5353-41c4-89f5-1c93092487aa", "comment": "Malware payload", "value": "c79b26865af0669aca4b5f64121d80027a59062e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646174954, "uuid": "b7653c75-4d88-4cfe-8f3c-fffac7e1028b", "comment": "Malware payload", "value": "b0cb894465d28781ca1d06d018a8af63f4794ad33429680a88b9b0c207decd6bac61045fa2a683f696206cc5ff0847a9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646174954, "uuid": "e6b44468-2a69-4ae2-82c5-7e4c8b8f7a39", "value": "T13DB4AE11B7D0C072C26A35342926E7B656EEBC719AF583876FD03B7E5E301D18A2835B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646174954, "uuid": "401474d9-7dfb-4d22-9bcf-4ce405b1d146", "value": "d02245ac5c961d83d0907c826d8ba5c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646174954, "uuid": "92b1bf2a-26bc-46f9-8d87-d05d0f6c5dba", "value": "12288:JhC1q3aXOwkiPs2iCtyjbOAIlgOkar//wJY8Itgm:Jgq3aFkiPs25ab2Bkm8jm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646174954, "uuid": "0e870ce8-4590-47b7-b6a4-eed8dde8eeb2", "value": 499712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646174954, "uuid": "72cdaf65-9bfc-4abd-b333-016dbf17e63f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646174954, "uuid": "e09c6510-ff6d-4f03-b140-8d5defd41c99", "value": "81895765721b4e8c2c4a733b90d41512", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fd365e7-999f-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646166979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646166979, "uuid": "e7467e3a-6ae6-461e-8657-e34a828b203a", "comment": "Malware payload", "value": "f74bc76bcc5ce64a3b1c4ddffc98411d", "object_relation": "md5", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646166979, "uuid": "8d42d384-a104-455c-a298-7736ae6e842b", "comment": "Malware payload", "value": "b9b93b80e03e86fc723f15b2e404c3bf2add21fc107964abb430b4a4515e1b10", "object_relation": "sha256", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646166979, "uuid": "8487d940-a058-4fd5-9de7-c8ec34d77c30", "comment": "Malware payload", "value": "59add78519b737293e54971e3de600f9a2be48bb", "object_relation": "sha1", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646166979, "uuid": "1d686454-b60f-4570-a349-a03237c9c799", "comment": "Malware payload", "value": "315e04f9a94dd105a51896f79fc998c6ea6287111ebd00852f4107b3aca76730456dda04c0509aeed1f26c8f4c9d7e0e", "object_relation": "sha3-384", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646166979, "uuid": "7013f5ea-63b5-4d68-b4dd-ea9a41dca392", "value": "T17123D025C1607828C73E8C759200EAD2720A7D04D9D5EF893585BB4C3B96BEB57AF9CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646166979, "uuid": "53aad562-a3de-4326-a68d-063dc9c1a469", "value": "768:Oio9DOevZCwrvtD608zdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Uh0VPWft:Oio9D7UtT5fTR4Lh1NisFYBc3cr+UqVC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646166979, "uuid": "c59a3afe-df11-4ca7-9fb4-24c2e14efa40", "value": 47699, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646166979, "uuid": "5f19fafc-8cb5-44c2-b799-5b18921f51bf", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646166979, "uuid": "171436c4-97f4-4dab-9c5f-b40971d38f6f", "value": "OPAST GROUP.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9769b6f3-9958-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646136631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646136631, "uuid": "0b3f2b7e-e0c8-43d2-86d3-0bf207963f97", "comment": "Malware payload (AgentTesla)", "value": "bf7f954b306a753a315cd7a6c8f11c94", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646136631, "uuid": "eb10fcfc-d8b8-4ec8-a06d-824a2afbeee9", "comment": "Malware payload (AgentTesla)", "value": "b9c9270b0bc33fd3e014265cac967ca1f48f397fd34b5978b28906a76c2132e5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646136631, "uuid": "f2948706-49ec-476d-8b29-896bb52461ad", "comment": "Malware payload (AgentTesla)", "value": "06ab5d7e75356245fddc70a49962eac69bbdbd31", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646136631, "uuid": "d16c1e0b-6f13-42fe-a33f-1cc42d60e796", "comment": "Malware payload (AgentTesla)", "value": "ccc1a830708c650b88e14cc56b998a0bb7240ba7f41b0183f94bde737d2971c6c94cbbdf345f0e92cf531885d27df53f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646136631, "uuid": "b5f3807e-8a52-4c83-9ba5-417d468c0849", "value": "T13D74237A75F298AFE1E51F734976A236E3FF558836204A87531C0F7F2D2291289811D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646136631, "uuid": "631c37e8-34ae-44f2-9695-04722d98b9cb", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646136631, "uuid": "cd0e9697-5144-42b8-be3e-5a23f1b3e60b", "value": "6144:rGiYnAFXNC9T+q2TjuPP1FLd4FBNba2oMM0ZS3faorVGC1g2uyGfIJBzck63+n:UAFVFqdeChM1UfaoJGC1gxyPBhtn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646136631, "uuid": "2db9c0cb-a19f-413e-9af6-4a6553490184", "value": 365881, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646136631, "uuid": "c30c8f0b-d4c4-415a-b796-439ba953e526", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646136631, "uuid": "ea27ef41-7208-4f4f-9113-c83b4b887f93", "value": "Payment Advice....exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fd8b75a-9958-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646136538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646136538, "uuid": "eb59e46c-a04d-49a9-ae17-dfb816162fdc", "comment": "Malware payload", "value": "6d131a7462e568213b44ef69156f10a5", "object_relation": "md5", "Tag": [ { "name": "Daxin", "colour": "#652B35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646136538, "uuid": "296a56f2-48f3-4e98-919d-48bdf355e840", "comment": "Malware payload", "value": "b9dad0131c51e2645e761b74a71ebad2bf175645fa9f42a4ab0e6921b83306e3", "object_relation": "sha256", "Tag": [ { "name": "Daxin", "colour": "#652B35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646136538, "uuid": "1b51cf8e-e949-48e5-aa68-4f78667cf299", "comment": "Malware payload", "value": "25bf4e30a94df9b8f8ab900d1a43fd056d285c9d", "object_relation": "sha1", "Tag": [ { "name": "Daxin", "colour": "#652B35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646136538, "uuid": "a6f37a1c-c46f-4d9d-a068-1b66a0438868", "comment": "Malware payload", "value": "313f91df0f26c4c2c6d122e174abacc777758fe1ed316c5374e5f7db26be6c236ad5e73053815ef8f6e13b124c259c79", "object_relation": "sha3-384", "Tag": [ { "name": "Daxin", "colour": "#652B35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646136538, "uuid": "2db2f96b-67bd-48a5-922c-44284d289ff7", "value": "T1D2636CCA22A41079D4BBC27DC9A1963FE7F2745113604BCF826147EA2F13BE5A739325", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646136538, "uuid": "90463144-65c6-401d-a6e8-b421f3c95870", "value": "c32d9a9af7f702814e1368c689877f3a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646136538, "uuid": "7255c148-90b7-4091-982c-9ee7dd1065a2", "value": "1536:HRM1VWgS1lYpKCNTzc8jt4riPJdBnH2dXDGZ838tGVxJ:HhgUup7NQiP9H2dz08ssVxJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646136538, "uuid": "8213b572-5351-4b9a-863d-9642a8cf84df", "value": 72272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646136538, "uuid": "717a8e81-a5cb-46c5-be98-3e76292ade90", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646136538, "uuid": "587123c1-fa9e-46e8-9eb8-1fc2df25a33b", "value": "b9dad0131c51e2645e761b74a71ebad2bf175645fa9f42a4ab0e6921b83306e3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "854c18fc-9984-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1646155499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646155499, "uuid": "3366f912-7cb0-4c99-8759-0d953111e446", "comment": "Malware payload (SnakeKeylogger)", "value": "d4d7d46b78893c0d1709985d3b5e0388", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646155499, "uuid": "7c159664-6846-45ef-afee-1fa401189bcd", "comment": "Malware payload (SnakeKeylogger)", "value": "ba58111448848b12be33d13c10b50ecfcb6bb636e7c0d8d45464f004e0b326c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646155499, "uuid": "488b10fc-1e8e-4094-b0fb-be7eccbc5898", "comment": "Malware payload (SnakeKeylogger)", "value": "dd59347c03f612a0e395afc716a1f277cace2a24", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646155499, "uuid": "d765e3ab-fe5d-474d-b80b-d8a271a25f4c", "comment": "Malware payload (SnakeKeylogger)", "value": "df72478e063154bd13276d90ffdab153551db7f31e2d04abd80d8a4137b7500f90d3c997af97d431fcee0206f45693da", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646155499, "uuid": "c74bdf81-bd26-4a0d-8822-7da73ee9152b", "value": "T1A6355B80B0D084BEE83B47F1ED59EB701796BE6CD498403C51567F1A66B337A108EE6E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646155499, "uuid": "4a53ae62-033e-4057-a4ee-eddea1aa1db1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646155499, "uuid": "70a1f8e9-de13-4993-8bd6-8fac68db2dca", "value": "12288:IV9z5iQiicAc3QhL6YgDirudPYh0RJj3rwQhX5qTpU4uwHC6KKdZGvcnhGlMyv2s:I4gc3QR67irkPYh07j3la2dwHCrWIv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646155499, "uuid": "2fb00813-b425-4e70-81b0-77a2f8a04ea5", "value": 1132032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646155499, "uuid": "98ac959b-18b2-4a7d-baa2-f1198eb44d21", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646155499, "uuid": "2a7f7c11-6e6d-43fb-913e-1c67f4f5d2d1", "value": "Re REQUEST FOR QUOTATION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ccde59b-996b-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646144559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646144559, "uuid": "fa834b1d-2e09-4a71-b9ac-85fc4ce8757c", "comment": "Malware payload", "value": "7d0c06a219b98d390101a5f0aaf3e912", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646144559, "uuid": "073e6338-bd36-4dc1-9eb4-b358982b5a26", "comment": "Malware payload", "value": "bc272a080338cf222be86737a340220dc965aace5c222ffa03bed52b1912ccaa", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646144559, "uuid": "b911e556-ee67-4564-82b0-5065938fdbb5", "comment": "Malware payload", "value": "78eceea8a9c405c1b76e3447b091fd06a2458922", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646144559, "uuid": "b8442bb7-d8a0-47c4-8207-61533e4bc39d", "comment": "Malware payload", "value": "76e6006596ad4e7532ae54f566fb190a8e3d98fde5f60c9ba65d84c75c7daa3856ab061893fa804bd31c90499384f414", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "coper", "colour": "#EED7EC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646144559, "uuid": "fd74d215-4761-4c7c-9c26-3e08437647e4", "value": "T11565E145B3C5FC2FCC7384364BB98A2AA4468C5AC646D7135DA5B62C4EBBEC04E45FC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646144559, "uuid": "c33b19ce-aa77-40aa-952c-39494cedb62f", "value": "24576:8/rDvDkPbc37Ff1nN5TTVA4uKIl4LAb9R5T3ePq920qRzckPVxC5Nk0S8gvGTFC2:8zDwI3d1N5TTV+KqY+9RJuS9jqZckPVy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646144559, "uuid": "e2a39538-d869-4e79-9cb9-db8b3c99ca9d", "value": 1504082, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646144559, "uuid": "f319f818-dfbe-404a-b9aa-47a258a8bdd6", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646144559, "uuid": "beec17ea-837c-478d-b4ef-8ab381bfd0e1", "value": "a1.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43ff8a96-9945-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646128331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646128331, "uuid": "50d6ecba-0428-4f63-94b0-c1d3a8ff4b15", "comment": "Malware payload (AgentTesla)", "value": "41508ed36d3788df3f007dc9b7bda71f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646128331, "uuid": "17f50106-db96-4888-8485-1a259a7a8cfe", "comment": "Malware payload (AgentTesla)", "value": "bd650c4a754fe15122e1d89aed97db21c5e9155d0ad78a78bf62b807a4383cb8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646128331, "uuid": "e7fa5a36-68c8-49fd-9b1c-c87a4c24582c", "comment": "Malware payload (AgentTesla)", "value": "707f2b0d914fefee58ed47afd157d461731a96be", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646128331, "uuid": "ff662d7b-c225-4623-b666-e853261efd11", "comment": "Malware payload (AgentTesla)", "value": "d825d68231678ab57ae8ef35e5f88574697dcb52601bae629b495e62e9d62ee8ae31626376066bea16986c830cf2e354", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646128331, "uuid": "e03b3a4d-11b9-443e-9dc5-b1f5a63e3bc1", "value": "T10CB4E08B76745BA6D93D97356821021CCFE6E9A2C30EF2B97CC571CE0172F478A22917", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646128331, "uuid": "7e3f144b-f80c-45d0-b54e-83bb6dc23ef6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646128331, "uuid": "b13b0ba2-03cb-468f-acd9-fba60b78d992", "value": "12288:wb6SXQGRUcZ64hcRm00dTovtckOc2jitLgfFYYX4hf0dyUDzzp:1cULRmZdTol3PHLkc05zzp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646128331, "uuid": "705e72b2-e353-4612-9811-4513dca791b3", "value": 538112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646128331, "uuid": "03a6f42a-8f4c-4f11-bf99-8d1d4726c2a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646128331, "uuid": "07dc87eb-3e51-4926-887d-941b625936b2", "value": "Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ef6543a-994a-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646130604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646130604, "uuid": "d5192431-4f8a-40c6-8a1d-fcf8a5a23d44", "comment": "Malware payload (AgentTesla)", "value": "dcd02df838ea6e0dde056dbd380ee667", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646130604, "uuid": "44be60b5-9986-415c-a86c-66ae16ea5540", "comment": "Malware payload (AgentTesla)", "value": "be4260d31744f50f8adac61f2555126d90089e4f4311dcfca8974bc538adbfe8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646130604, "uuid": "ca2ccb80-3899-4b82-8219-04bec0081b3d", "comment": "Malware payload (AgentTesla)", "value": "e3efb7511da0dba9fcea6cff81b4131383742bf8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646130604, "uuid": "8f46327c-65cf-4786-90d0-206f55bf9312", "comment": "Malware payload (AgentTesla)", "value": "5930c50e098b9ec1a52e210fc66678cef0c84ee3b08b87b6aa8421c0e33cce43b864033ef5aeb3add56f91ada27af16a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646130604, "uuid": "a9c72c09-daf1-4481-87de-8125e5adb554", "value": "T1C1B4E04A76355BA2D93D97356425120CCFF7E9A2C34FF2B83CC576C90072B4B4A26A27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646130604, "uuid": "688430b5-784e-47c6-ab3c-2209f98ac114", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646130604, "uuid": "6b197d3a-ffba-48df-a6ca-1a0d9b64584c", "value": "12288:wVvy6zTGRUcZ643cRm00dTIcgQU88dhFs1KwlugQGY0BTjCftIavBP3iA:wJcUJRmZdTIcgh88dhFVw4c33gCs3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646130604, "uuid": "db6311aa-5c4e-45b6-b083-6d82487d9ff4", "value": 525312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646130604, "uuid": "ea2bf113-0346-489e-8d41-de4a278977fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646130604, "uuid": "382f1225-aecd-43a0-b395-32819c605592", "value": "Swift Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a0fdee8-994f-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646132556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646132556, "uuid": "1fb1c6c3-f9ef-4b1d-bb87-2bbf7802fece", "comment": "Malware payload (Heodo)", "value": "c513df0da4205fc8c69e8027561989d7", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646132556, "uuid": "6c627bb6-7e04-44c4-8cd3-d25f1ef16b35", "comment": "Malware payload (Heodo)", "value": "bf1d5813a90d933fab6a400fdb016fbc7cef65495203cbaff66bc0153733e161", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646132556, "uuid": "ecb47c59-6c8e-47c8-b8fb-ca3ca30ad90e", "comment": "Malware payload (Heodo)", "value": "20083f0aa181b0c73e98ab4d8a702105d2001c66", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646132556, "uuid": "ca250a84-dcfa-452d-9e1d-8af59a1263da", "comment": "Malware payload (Heodo)", "value": "aa501bf6fbe1fc7b3adeb3c9804f0b90d6e4528640147d7cbb2e14c3da820f9dd5cd2d6ed646355163c0a6a61b1eca67", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646132556, "uuid": "5d3f020d-e5c0-4f48-81e7-19dd55392ac8", "value": "T1DF13E02AC0961959D727283DD6148EF4124C0E4A89E5F99B1D50B3AC2B6E1FB0B4FCB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646132556, "uuid": "a2c3f0db-d2db-48a9-9e38-3936a45d5700", "value": "768:i9oms9O+pOevZCwtxyKfcrND59V+L9Rw4eWrXcTqw0VfWZE:i9oms7tylND59V4jwmXc2RVfW+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646132556, "uuid": "fd0da106-4d9c-4629-879a-1ec58b106919", "value": 41841, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646132556, "uuid": "cc00e6e8-5bb3-42a1-99f5-37f44ac36567", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646132556, "uuid": "ee664cb5-4560-4aa6-b610-960a4283c573", "value": "OMICS Online.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54f0c5bf-9934-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646121058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646121058, "uuid": "d2fc07df-d799-4d0c-a5a2-eac2690005c5", "comment": "Malware payload (Heodo)", "value": "f0e588efbed70177bd68502d3c53eabb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646121058, "uuid": "00aaced7-88cd-44cd-8b58-9785004739df", "comment": "Malware payload (Heodo)", "value": "bf47d3aea34be8bc31bea98a6c7dd5b417dec978a116caba04db5a5ba2cca3ac", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646121058, "uuid": "a85709ae-8345-4728-933c-1d05e32f73d9", "comment": "Malware payload (Heodo)", "value": "e53b98453e91ac8452d4db4b724bca15c3b34c77", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646121058, "uuid": "98e9f53e-fc2f-4bc1-b3c2-be47b3598406", "comment": "Malware payload (Heodo)", "value": "22dae9a860c15906405f9a68785f46430ff2950dfb76654596fb7a797160d187531b3b4c8463062d70c809274bc8bde5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646121058, "uuid": "971fa816-0774-4f8d-95aa-e78c4800f314", "value": "T193B46B992251F077D11B503D0BCC2AAD7EEB88F09A6DF27FD2A3558D0F31190A62D993", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646121058, "uuid": "229b4b44-c743-45c8-8dff-f97041dd0e30", "value": "42fe0d732d1bb90c6a7a1bcfb8ef88aa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646121058, "uuid": "5b0ceef0-b013-4b6a-867f-07f9f2d608bb", "value": "6144:cH4C1DzgG1GCQw2HOOnPE10JQNqztvrC4cHV9jp6YagzSAIVCL4Ry:cYC14G1GUgOOs14Qkztm1xpdIVCLqy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646121058, "uuid": "c85571ae-f87a-4380-863f-ca8f05e6acc3", "value": 528384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646121058, "uuid": "3e8c77f8-a117-439f-8893-73610714b988", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646121058, "uuid": "db564750-abfb-435c-9b28-96027f6317ab", "value": "f0e588efbed70177bd68502d3c53eabb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15e10f0b-9936-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646121811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646121811, "uuid": "2d9dacb5-d5cf-46cc-81ff-c423d37d3398", "comment": "Malware payload", "value": "ea108c6f6b805e54cc8457573447a885", "object_relation": "md5", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646121811, "uuid": "7113a098-126c-42ff-a4c3-bd2b189986f7", "comment": "Malware payload", "value": "bf704992ac80b21ea48de1d29244b67ef34bdaff4ba692f785c422381faaf2ba", "object_relation": "sha256", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646121811, "uuid": "2223df2b-99c9-4bbc-b53e-59b0a48ff56c", "comment": "Malware payload", "value": "4bafbc85fba6fd06ff35c0ae9a06ad3f81ba114d", "object_relation": "sha1", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646121811, "uuid": "39558049-51e3-4e0f-9452-12b45f6b69c9", "comment": "Malware payload", "value": "bfa524a6e87be93d21e7c7e02079e6392bc6a7b4917727dd15f2c0ad0c792a67e948026fdc3399d861395b6b0aadb702", "object_relation": "sha3-384", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646121811, "uuid": "f084425f-d42b-4c83-8757-05f23f425a82", "value": "T11A13BF18C052610AC2B3E53DDD3884E55C6ADC136225498FE1D6B94B0BE5EFB2B4EFC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646121811, "uuid": "9a3f88fa-43e2-4785-ad41-adec4b32b808", "value": "768:d+XRD4S0JS00SneSnjS0yS03S0IMS0bS02ScxbV+cUs70Nn2srTpxKC6yDsfudHN:d+hMVU7N22Tbwy40zVMMACIpm+kO1/KD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646121811, "uuid": "34a04ed6-68c5-43b0-8a3c-bf4f58a9f04c", "value": 43595, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646121811, "uuid": "305ebb34-17d7-4077-a044-3f7f790a3ac7", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646121811, "uuid": "9fd6f68e-6c59-43f2-b646-f156006d6acd", "value": "MEXACARE - Orders 122001-221.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "952856fc-9942-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1646127179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646127179, "uuid": "76ad49c4-62b8-497d-928d-9609e80775d5", "comment": "Malware payload (SnakeKeylogger)", "value": "16bb90034928f562923e83f82dae5327", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646127179, "uuid": "49ed220f-8a01-48f5-b923-b7399d2c368d", "comment": "Malware payload (SnakeKeylogger)", "value": "bf96ace0f56d5df67fd0b24c34a48e2690be556823ff8dfbdaaa5833f7cb256d", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646127179, "uuid": "281719e9-f2d6-4e49-806c-22a9eff8ef9b", "comment": "Malware payload (SnakeKeylogger)", "value": "6cd20058b6214bd589be49c0b7d17da2ff1a4271", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646127179, "uuid": "38858f5b-00f0-4195-abb9-b9e880248568", "comment": "Malware payload (SnakeKeylogger)", "value": "39b598c083b283fc4733e75c843e4396e37d13f1922126e6bbfacb1e5afc3487d93ec59af40089331211702ab8532559", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646127179, "uuid": "9cc8f904-a1d9-4ea3-88a9-b2df096142f5", "value": "T128C4239B058B2F006760306D2BB950BA0E69B9474668B77FB8BBBC62C71D80455FFF44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646127179, "uuid": "283cbfc2-fe12-47b4-b71f-d5569f5fb7fc", "value": "12288:xlG8B+jqSgRGyK6og4R1HLZlwg55p5RMcMLWMqaDo4/6XG4Xe03:xU8UjqSgMrr3McMbqIoa103", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646127179, "uuid": "d3e7eedc-2563-47c8-bc22-c48a7c938243", "value": 590080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646127179, "uuid": "2419e660-4bd9-4359-ae19-d052dcbf9575", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646127179, "uuid": "361419ff-a45a-421e-88d2-accd5fae39d6", "value": "20076564_pdf.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e88c43f4-9927-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646115722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646115722, "uuid": "c7f731df-542a-4842-84ac-268e3d4e879d", "comment": "Malware payload", "value": "81a1335e99444c243631de2b60dd8b74", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646115722, "uuid": "ba9f6ef9-a41f-4a75-b850-49f8baf42d83", "comment": "Malware payload", "value": "bfb4791417b2d9e0c5661961d5db8616cafb21e6d3e6e7ad70c043fab841e62f", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646115722, "uuid": "dd6e791b-3d20-46f8-b5dd-59d4df09fe54", "comment": "Malware payload", "value": "fa09f610aa1c7ad64013fe04e291809995d1ef4f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646115722, "uuid": "e380f6b1-711a-4d51-b7b3-ee22a2e804da", "comment": "Malware payload", "value": "3839f8678845261edd94de45680995ac206ea5bfd9f5e5aa729b08e5e3402a143610bffc1fd3afe6a36902ab933502dc", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646115722, "uuid": "b10658b3-2257-464e-8dd1-80920b4016d5", "value": "T12443B403B0AE052122D68F2BA5B3A57E87E769126F3A250D40DC7151DFC3A54CAA37F7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646115722, "uuid": "49779cf3-a96c-4392-a341-ad67a3ec5628", "value": "1536:uvE5/VJ8m0HJnppEnANcFqAsVH8cO/ecS/1:ksh6pl/H8n/K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646115722, "uuid": "cbdd1e83-9853-4557-94c2-035f856c0e3b", "value": 59310, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646115722, "uuid": "a35afbed-bb09-4595-acd2-c5c3239b2058", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646115722, "uuid": "5c467a4d-4e2a-4168-907c-45c5cca0594e", "value": "autorun.inf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bba8d820-994a-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646130679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646130679, "uuid": "7e805f45-5c8a-4201-be80-9920fc6d4c13", "comment": "Malware payload (Heodo)", "value": "00ba50d7a9a877bd6ff5bbf41c71534a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646130679, "uuid": "12bf7b70-d7c4-4282-a68d-5ff5cad286c8", "comment": "Malware payload (Heodo)", "value": "bff268d1cbc6e6038035f62214bf1be1af0a074f724d8b5e990b2736ac7fb7d1", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646130679, "uuid": "99245cbc-0edc-4343-9f30-ae594b6e7345", "comment": "Malware payload (Heodo)", "value": "1624901263cbfc69e7922ba74b9af572e706a9ae", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646130679, "uuid": "c589985c-ae86-4605-b9b4-a2a143c9c03d", "comment": "Malware payload (Heodo)", "value": "64b0f055f2b116c0c5ce6b82eaa35926b458a2eb32992428982a5234e29bb8e781e5aa9d3c7552b752ba51c10cf43138", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646130679, "uuid": "31f106f6-1541-49c1-a045-faa3325932d9", "value": "T163D47C82F7429EF2C00B03347C32B2586BADEAD5D2158D6B9398A5AE1F35573493DE43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646130679, "uuid": "36e2990b-43fa-4cf0-b7ee-06df09b7baed", "value": "e0b213ccd96f46d30dcd8e225f4e9fc9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646130679, "uuid": "152e6b14-2fa6-41e2-bf53-94f7102b99e7", "value": "6144:XjPgWGbb0OEmS9Vzf5WI9nI1LSfca1MyhKmZHNRuIfv7YtaIIo0cm59CH7PQ:X0bEtf5WyI1LSfcAfxhstaICRLmrQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646130679, "uuid": "f0c90fd2-6c4c-4c2e-9543-0bec87436bda", "value": 602112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646130679, "uuid": "77d4f29c-24d7-44e9-b2dd-1c3ae523d96c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646130679, "uuid": "7e71e648-022e-490e-8661-2485194217cd", "value": "3uRLqD74UuLb.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a0ea80a-995b-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646137817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646137817, "uuid": "478beac0-5ac0-4951-8902-6fcbce962c7f", "comment": "Malware payload (AgentTesla)", "value": "d266e62fdbd57e8752c3a09567e2c2c2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646137817, "uuid": "033a0bcb-c858-476c-bf82-afed5df7c5fe", "comment": "Malware payload (AgentTesla)", "value": "c05a7c68b4c758c3dbd64d88d7c3cd516ffe9ac465a321a75f3843b79a02d6d7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646137817, "uuid": "5fc08e6c-ad55-4e72-b800-56f44c7e3170", "comment": "Malware payload (AgentTesla)", "value": "d2755e4c63b872f6567b85e8b338e89424ac00f9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646137817, "uuid": "733745f1-b8f8-422d-b48c-4fa276b6f77f", "comment": "Malware payload (AgentTesla)", "value": "0f1eb5e5c8550d8db03ca46cd23590229ee1b64cf9fd455597e73b2f80e917924fd21dec28c1bf4bf92f1bb2166d8bc3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646137817, "uuid": "cf112f37-fcf1-4d0c-9b70-1a0ee74376fb", "value": "T190B4D08B363547A6C93DA7346825560CCFE6E962C34EF2793DC675C800B1F478B2692B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646137817, "uuid": "b5f84488-d151-4227-a602-740669b56fed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646137817, "uuid": "1024c044-5d16-406b-9594-5cee5fffa359", "value": "12288:ihdK5QGRUcZ64acRm00dT+eDbJxH6YCpk1jCqu7TruBG:gcUSRmZdT+AtfCYjpSTrC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646137817, "uuid": "601da4bd-ae33-4195-8ae9-dd419d544fa7", "value": 506368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646137817, "uuid": "40e610ab-7f67-497b-ae70-1d311aa8f1d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646137817, "uuid": "72105bba-a146-4859-bdb1-80a2fe173daa", "value": "SC 7910013155.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0a45a09-9931-11ec-9275-42010a9c0029", "comment": "Malware payload (Socelars)", "timestamp": 1646119923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646119923, "uuid": "b703d046-6c05-400e-86b0-448e107cf448", "comment": "Malware payload (Socelars)", "value": "5b6b6abb22d25b88c0f2785160d396a9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646119923, "uuid": "c59fffff-4687-4039-84e6-69828f6fdddd", "comment": "Malware payload (Socelars)", "value": "c078ed2928930ffa5f7a5a3effbe42748e0ad590be54bd02e26eb666bb081347", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646119923, "uuid": "7d9778b5-5c79-40a1-94f0-6a5ae7b1b164", "comment": "Malware payload (Socelars)", "value": "f9022f3f9f8c59c1dae2f23df2506ea73efda6bd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646119923, "uuid": "bbaa99f3-0ebd-437d-b047-813114614edb", "comment": "Malware payload (Socelars)", "value": "bb6c4b8774a7eda578383415dff65c2a7aa7f77033bfd9d428900746cf63ce1c6a88c68a3d9c1f69cb8305ff567d1ac7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646119923, "uuid": "79c4491d-9011-4154-992f-99826c8a4abf", "value": "T176658E11F642A036E8E3007382FF56FE9D2C6E21031494D7E3C47D6A6A715E27A3766B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646119923, "uuid": "0bf9546d-ae2d-4ba2-bc88-3f4bc2533e2c", "value": "d69e4c13e25f0ad622344ac56118c0df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646119923, "uuid": "9b158bbf-1794-4d69-bdb9-9ff3845fa793", "value": "24576:c9opFqoCv+VsqF7nZYll2QDUrygcC0JY3ZAwS8c95/d6sOjRA+fu:RpH1sSDu6Auq5/dhOj24u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646119923, "uuid": "1a7be51b-d52c-4df0-bd51-2b46ec0cc14e", "value": 1520128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646119923, "uuid": "d0c17b9b-8fce-4ed8-a725-baa23f099f21", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646119923, "uuid": "77ac2fc8-222d-4f38-9a22-2cb27602058f", "value": "5b6b6abb22d25b88c0f2785160d396a9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11b216c4-995a-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646137266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646137266, "uuid": "31db0d86-ab1d-4d88-98f4-fc8edc051362", "comment": "Malware payload (AgentTesla)", "value": "f248f904bec6573cafd877b5b5e39f20", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646137266, "uuid": "b22d6c83-1881-4c3b-8eb0-907d45fa0a22", "comment": "Malware payload (AgentTesla)", "value": "c0a27af0674c2fc9434a244306d7e25f7d4228097993ce2979b624ba66e84b10", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646137266, "uuid": "26e6a509-1388-40c6-9062-a5f5c04e3fe3", "comment": "Malware payload (AgentTesla)", "value": "07faabcc903159439af6d75b5b366f7a8d253c05", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646137266, "uuid": "a807bcb9-3860-44b7-aa3b-4cfa79ad3890", "comment": "Malware payload (AgentTesla)", "value": "f82d8b6037cf13d0bc5afefbe306f5c878b67e446cbbeb7ca2ac39b597fd8ca89435aa5b4b547283f252250f3e4db1fb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646137266, "uuid": "7d30da51-157f-41d2-a1c7-bbdf87313d89", "value": "T16215AF4839D6607DE8368BB2CAD4EFE0DB29F122D54960B250020E199A0DBFD8D55EFD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646137266, "uuid": "b5241ff6-b57b-400a-949c-4ad40f76b484", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646137266, "uuid": "3355358f-6b61-45ed-8c8b-0a719379c1a3", "value": "24576:J0IbJ6/Ig9/cV5UpnW1KPZht5ak4Pz2M1:2S7E/cV5UpnW+Kz5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646137266, "uuid": "c2d493de-eaa7-4b5a-a368-6c267256584b", "value": 947200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646137266, "uuid": "b8e12a37-0565-42f1-84e8-d655d7672b3a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646137266, "uuid": "81b5780d-93c0-464e-bfd7-45a261888b8c", "value": "Shipment Advise.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79a1a9d8-98f7-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646094920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646094920, "uuid": "98539e57-e611-44ef-8700-b580cc52e9ef", "comment": "Malware payload (Heodo)", "value": "c874971907846d4e6ae9d848439d3ca5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646094920, "uuid": "1bff35c7-7800-4a9e-b250-350a4c625000", "comment": "Malware payload (Heodo)", "value": "c0d7dce9e0627a74e96e011f8b5e4bda620042fc7685617d6dd2825ce1fc5cf6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646094920, "uuid": "c125d9f6-c3a3-45ee-a882-c50bb59bc30b", "comment": "Malware payload (Heodo)", "value": "3b008e0c7ac2dbc51dae54d555e5b62e1d23ea8a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646094920, "uuid": "136692ad-dbf1-4fe4-a05e-5c11271c30d9", "comment": "Malware payload (Heodo)", "value": "5f1465df407d21323557e0c0aea63f341ac0a2ed076ab4410eadf355cb1186c6694eb48ace63bb15834ad140200ff23e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646094920, "uuid": "4c99e79e-09a0-4a91-9e9c-f265961ef129", "value": "T121B40706B152B13DC24BD0B96E0167A951AED9FD0BB137A3AFA813CC06A34D5735DBC2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646094920, "uuid": "985bb1e9-595e-466a-9c06-c363f94cb5da", "value": "42fe0d732d1bb90c6a7a1bcfb8ef88aa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646094920, "uuid": "b3abcbc4-d17c-400e-82b2-8586213e33bc", "value": "12288:AASStHx1vVHO+1Hx54Qg0p9n4WNL7XE0UdX:ecHfv4qxJnp9l7XE0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646094920, "uuid": "77bd4a54-750f-465e-8821-15c0ea9c731c", "value": 532480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646094920, "uuid": "32733c2d-2de5-49a9-b39c-74f792d53ff3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646094920, "uuid": "e3715e56-9d89-499d-b44c-ad2563b85045", "value": "c874971907846d4e6ae9d848439d3ca5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dac39ba-9958-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646136508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646136508, "uuid": "bb4de4e3-fbc8-476c-9b05-662f407b4593", "comment": "Malware payload", "value": "50b39072d0ee9af5ef4824eca34be6e3", "object_relation": "md5", "Tag": [ { "name": "Daxin", "colour": "#652B35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646136508, "uuid": "28464a02-11a5-4f9a-bc5e-b840addbb80f", "comment": "Malware payload", "value": "c0d88db11d0f529754d290ed5f4c34b4dba8c4f2e5c4148866daabeab0d25f9c", "object_relation": "sha256", "Tag": [ { "name": "Daxin", "colour": "#652B35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646136508, "uuid": "2cf084ba-fdac-4a8d-9d10-d7f1e620b68f", "comment": "Malware payload", "value": "064de88dbbea67c149e779aac05228e5405985c7", "object_relation": "sha1", "Tag": [ { "name": "Daxin", "colour": "#652B35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646136508, "uuid": "d2b6d5b5-aecd-49a1-8605-13fd14c118a9", "comment": "Malware payload", "value": "4ff0a5f3e65739810168d6865250a54c5e11bf43e6f3c6ec255fd8000b6c33ce01c795369ec3258647e03a1081f804e6", "object_relation": "sha3-384", "Tag": [ { "name": "Daxin", "colour": "#652B35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646136508, "uuid": "1852f183-be1f-4faa-b5c4-a96e572f97d4", "value": "T100B21703F7D50FF1EA621A7A58637B1162775E380B256AC3DF6039995DBA3D02A312C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646136508, "uuid": "2e723174-1600-4b45-b549-eba18262a748", "value": "a7bd820fa5b895fab06f20739c9f24b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646136508, "uuid": "f1214275-3022-4ee3-aa87-4aaf49168d6c", "value": "384:dz6GkKqcpDhPm9uYpWvF4SvFkyyuzfVpqwKweg78+789g+gsW8c:dzb3HPFFwurJKwqg6c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646136508, "uuid": "6d2b2ea3-3a41-44e5-a142-a64b235af1e5", "value": 24064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646136508, "uuid": "e4610a04-e973-48a2-a2e1-a5d77ae82e04", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646136508, "uuid": "10af71f0-89fa-4fc5-9081-0316e39135cd", "value": "c0d88db11d0f529754d290ed5f4c34b4dba8c4f2e5c4148866daabeab0d25f9c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83890190-9984-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1646155496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646155496, "uuid": "9a6d1873-7799-455e-8198-b00f26a9a9b6", "comment": "Malware payload (SnakeKeylogger)", "value": "12f01193b33fc3d312d6630894d44625", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646155496, "uuid": "b6440557-0935-472e-bf38-6ff449e504b7", "comment": "Malware payload (SnakeKeylogger)", "value": "c1344e45cab7fa4807a738734a08eaf968a885dde6614edfd6668a96efc2f902", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646155496, "uuid": "f79edd9e-1f7f-4237-8400-7e3af9f960a8", "comment": "Malware payload (SnakeKeylogger)", "value": "5911791995aab99e360efb1c473458d268471b71", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646155496, "uuid": "36164489-bbba-48ff-b885-e04074f3f5d9", "comment": "Malware payload (SnakeKeylogger)", "value": "d97e9a2d3549c657e5cc588815f8fb36ea3112cbbe9af5219480ab40376901993d70be1c208fb02da9de441470534f95", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646155496, "uuid": "6b146b9f-7126-40c0-986d-f4da1270b9e5", "value": "T10715AF4835D6207DE8368BB1CED4EFE0DB29F232D149A0B654020E599A0DBBD8D45EFD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646155496, "uuid": "f98f6e1c-90d3-4449-aa63-5a123e9fc865", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646155496, "uuid": "af3deea0-f171-46c1-b83d-0e043216c529", "value": "24576:SchfDFnF96ff98WIQtc+40Li9nrKf0EG4X5:Scx/Mq7Cc+40LmrKf06", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646155496, "uuid": "bd826f32-8a1c-4c3e-be4c-1ec8aeb16bd3", "value": 880640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646155496, "uuid": "322cc216-dc7f-41e0-b894-da24b61222c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646155496, "uuid": "607b07d2-3145-458c-8b09-793780156f73", "value": "OC IMG600928147359.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bd63845-9941-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646126733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646126733, "uuid": "faf0595c-8f08-42d1-a246-55590b72949f", "comment": "Malware payload (AgentTesla)", "value": "b6430abfd5e6e4aaa3400196e4c19ebb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646126733, "uuid": "3e64e8a9-e97c-4681-a447-eb74367eecc0", "comment": "Malware payload (AgentTesla)", "value": "c1c4efe3fecd680de5ef29415e1e364f8877a10ac7f5457529a749a3661a6771", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646126733, "uuid": "3bb724c5-da8e-4938-8e2f-b516a421cc92", "comment": "Malware payload (AgentTesla)", "value": "480050190fa8f1981dc4f2acca0f1ef26b0328af", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646126733, "uuid": "7493f7e8-720f-40b4-b169-cda10dc93dac", "comment": "Malware payload (AgentTesla)", "value": "df2be328671e532c452f6a1c4ac7d100004dbfb23d07510954e53276b01a00d19f43ad1abf3d43bb00188cc2667f6a83", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646126733, "uuid": "2e6f8e91-52f1-40ae-99a9-58855227acf3", "value": "T13D05C00838E65039F83A8BF1DBD0EBF19B7DE221E48970F554000E559A46BBC8959EFD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646126733, "uuid": "bb79da4a-46ed-4360-8382-49694aecf59d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646126733, "uuid": "6e25f9f8-603f-485c-946b-2f8556d0f6e1", "value": "12288:ZEyKR/IPdfe82Xsg+JaAc3cxGOb8x0DWUZb2m0jhJKxmI+QzWztSV01X:Hdfe82XRlAc3cpb8C30jhJKxmI+RtSw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646126733, "uuid": "23657175-5da0-4286-93d6-a90a022f592f", "value": 829440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646126733, "uuid": "d1ad17d5-2494-4cd0-aefa-9bd1c67405d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646126733, "uuid": "b325c1ef-a249-40a3-b91e-4b9fb257cb2a", "value": "b6430abfd5e6e4aaa3400196e4c19ebb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19d79a60-9937-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646122247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646122247, "uuid": "6a823233-1a0e-4cb6-9ffe-11b8678dfcf2", "comment": "Malware payload (Formbook)", "value": "751738f515996f05e2e02db5a8f316e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646122247, "uuid": "917fa804-b74f-4396-a25a-58a6ebe64d39", "comment": "Malware payload (Formbook)", "value": "c252479bfb6cebbb01e698ade5db7a3cc8cd3a3e0ca118bedaf3f0c26721ee31", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646122247, "uuid": "b6d9c5c4-8bc6-4155-88fb-8e37d0a03101", "comment": "Malware payload (Formbook)", "value": "fb3ee5897133d6b263ace2029c10db152460dfaa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646122247, "uuid": "59b279e2-4d5e-41d0-a8b7-0a575f012e5e", "comment": "Malware payload (Formbook)", "value": "da7ac8fb7dadb7f6cfd55874ceddc7361b97ab3e8e849f943c41e085824fd8aed5344aae9272bcf81810ac529b5db684", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646122247, "uuid": "8702e201-9ff0-4182-a919-f20aa6f2a469", "value": "T1B6A4BF778C79D662C402A035F836286463996C5EA9EBFC7372E4D76C8830806D78DF5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646122247, "uuid": "ae91264c-0959-4539-b240-d75599120ebb", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646122247, "uuid": "f550a1d6-719d-4e3e-bccd-747e946c7562", "value": "12288:LGfffffffffffffffffffffffffffffffQA8jzRMoS5y6jtlle:LGfffffffffffffffffffffffffffffi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646122247, "uuid": "2605e702-efc6-4c14-857f-cf904c631fbc", "value": 487108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646122247, "uuid": "0705e068-a1da-4118-a456-2e7e77234a7f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646122247, "uuid": "3db6572a-1f71-4c23-a4d6-c56b8ed2ba2a", "value": "Dekont.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "892b62c7-996f-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646146486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646146486, "uuid": "032bfe08-50ac-48d1-a832-d4b0198387d2", "comment": "Malware payload (AgentTesla)", "value": "cb9b3abcb1a550e66da1903bc01201c8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646146486, "uuid": "27dd2f3a-3123-4879-98b2-ea1c6d700b52", "comment": "Malware payload (AgentTesla)", "value": "c2a8dc5bfb15961794acddfab66dd072a138a6ed17a7ed4f83c2d4f2f3d682f1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646146486, "uuid": "1581b595-dede-4768-995d-97d573e171a4", "comment": "Malware payload (AgentTesla)", "value": "6b666f3c159cafbaa905719c1a25b3f5dc14ae57", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646146486, "uuid": "33a1b878-4dbb-4386-a6ab-03393542484e", "comment": "Malware payload (AgentTesla)", "value": "f46f6bb8a08a587f3326adf07ca14c9ccb9b69beeb27cc4050a036c3bb34c24494e21145f33f6346f36cb86377308f47", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646146486, "uuid": "a9a37a30-f1c7-4d5d-b4b0-b317f7c80f14", "value": "T13C32D6A6CB600D62ED678F3070E0C716BB71B6826AA2C1F7E15DC0549F8178235BD5BA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646146486, "uuid": "0228859d-f2bb-4bbb-9a56-405341fdf5ba", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646146486, "uuid": "f7872325-f916-4b7a-87db-f74dc2a58d64", "value": "96:+PJd1aWFizNtKr9mb6NDlkBlpHpIaXuHuixkm+TQax3EiaO7l3JUfhdyEi7ZHeYr:QLE0LDWpHFqlxk7TrEQbBZHka6xN2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646146486, "uuid": "825a9289-9e9b-43f3-b032-e7834eb10b51", "value": 10952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646146486, "uuid": "96d8934c-512c-4008-a92f-1401fceeda70", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646146486, "uuid": "74e7481c-505c-44ee-b31e-08131e402741", "value": "PAYMENTSLIP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88084240-9941-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1646126727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646126727, "uuid": "82898a21-4f29-48e3-a9f0-e8d7a0723fbd", "comment": "Malware payload (Loki)", "value": "091c1f4e0b8ad4e44fe9ab6d0a1341a0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646126727, "uuid": "81eadc8d-3241-4a01-89dc-b7a8a9ffb2f3", "comment": "Malware payload (Loki)", "value": "c395cac84bc2e0b97881975f47d3a6213c2f0b162ebdc8037d5defbe89a63f1b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646126727, "uuid": "c3706657-999b-451c-adf2-4d1630231cb1", "comment": "Malware payload (Loki)", "value": "b4323aac8cdec7886085a121e46db84d6cbdfd23", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646126727, "uuid": "abf6c665-cd04-49c0-8067-2f24f1869ea9", "comment": "Malware payload (Loki)", "value": "bc9a28ea88c67bc0ddf6c2e2e3fc79b99742697814ae7183d0eb23726e4c0f1b02124ec5c3a586eb2f91934cb8a2b418", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646126727, "uuid": "cb006243-3ea3-4214-8ad8-32b81b57f06f", "value": "T1DE64230FBA0E6CB3D1C12D35A2B7EBA9F3F662948651162B8BF01EF77D819061505CD2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646126727, "uuid": "04030719-ee6f-40a0-8d46-b074c4065140", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646126727, "uuid": "be46570a-8b65-4b0a-8442-50136bfb9cc3", "value": "6144:rGi2I2X23J01CTBZuu52Liov3MzQeiWl1LyRvfiDbv18JLvXtwH4O/mSPgRZN4y:i3V1oT2Lfvcz7l1GRv4bvaLvSH4OuDR7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646126727, "uuid": "6df17505-eadc-4370-9a6b-0ce5ae27f937", "value": 313519, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646126727, "uuid": "eb2f29f1-b291-49ff-b4d0-92fdcc7cc804", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646126727, "uuid": "ef14b676-f96c-4567-b5f3-a53c3dc7a3e7", "value": "091c1f4e0b8ad4e44fe9ab6d0a1341a0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "285c5fe7-9933-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646120554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120554, "uuid": "e46e42bc-1795-4df3-93ed-70c643618a94", "comment": "Malware payload (AgentTesla)", "value": "dbc3ad109b27ed63057a3156ed79a563", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120554, "uuid": "88472957-a28f-4abc-8169-a567e0490a78", "comment": "Malware payload (AgentTesla)", "value": "c3e86463ee9439d42b23afcf18eeeb24d02da60ae432423295e80ba9d4feebcb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120554, "uuid": "5a378a88-3156-448c-a99c-2148fc0a6043", "comment": "Malware payload (AgentTesla)", "value": "cb3c1b1dc5cfa64b87dacbc3bec33f284dc59f91", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120554, "uuid": "a4ebaffd-e37a-4714-820a-d2cc049d1bad", "comment": "Malware payload (AgentTesla)", "value": "feac4d5d1a05f2164d26c0aeccbc42c7697bc8571e761288e5f2fb08190836212044306e66ea4c208a1e54db5cec497b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120554, "uuid": "72c91904-6e88-4081-870a-f8bfc279d641", "value": "T12A1412DE2B258540FB47423349877D1EE9A1CE1B99466701C129F709AF30FC3AB86E66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120554, "uuid": "4f24772d-2f80-45fd-9498-f1653f9cd1eb", "value": "3072:UsnJCSV736xMZZ/p8xD949yRxSojGTUBg8Rv2q1wQ1CN/oHzOIf5:NJCyexWZ/OxdRxS8q2vn1VMaTOW5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646120554, "uuid": "b5e1bc5b-583b-4598-a82c-8e6c5d5b2549", "value": 190968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646120554, "uuid": "06768564-a1c7-47cd-9922-6756a86c1e54", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120554, "uuid": "ae477c6b-1401-48c0-870d-0dfb9fbdfc7d", "value": "ARYA SASOL IRAN PURCHASE ORDER.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "990a9272-9985-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646155961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646155961, "uuid": "900d3afd-4bce-48c2-937f-d2fc6f0d49a8", "comment": "Malware payload", "value": "84a3e4a8f1cb8347512d3fbad99d7155", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646155961, "uuid": "3ccb331e-29db-4f4d-b885-1bf87b7d6aa8", "comment": "Malware payload", "value": "c4c48dcea022b724f1daceb11b9e0404661d0815c3f80c61ffef489cded45708", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646155961, "uuid": "190cd9a4-11fd-4a78-84af-edd13fe1b9f6", "comment": "Malware payload", "value": "ef2f8d9c36998e339093a00851d16900008d4bed", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646155961, "uuid": "1b0cdf46-dfb6-4f1d-9b05-0c5f361ed0bb", "comment": "Malware payload", "value": "e08f09a0db846793e734c58356829e6a95dc51920d18865c55f5ac5ce9e61a4af02b8784f444a5fe68b4fa2118ce0b96", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646155961, "uuid": "02976838-a27e-4cae-8038-c428afa2322f", "value": "T15014123278E86D04EE67F5B62E058874DBB1EC95CA7EF131F820736A5139A39044F6B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646155961, "uuid": "7ec45db7-9472-4541-bd6e-210cc88e7557", "value": "3072:DM48V6X8fTdod3ojAhFTtFxBB/CgpHpNoLQDuZYysmVveRAYhlcH/8qO13olcju2:onfTd+fhxH/LpJNaQDfmVAxcf84r2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646155961, "uuid": "f3ae0ac3-73c5-4b67-ba55-19e08c9eed3f", "value": 190664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646155961, "uuid": "0240d9be-8fff-4f45-adde-62696d14fb3e", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646155961, "uuid": "f006542b-66fa-48f4-91c1-dfd1820bea38", "value": "DOCUMENT.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8afa305e-9946-11ec-9275-42010a9c0029", "comment": "Malware payload (njrat)", "timestamp": 1646128880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646128880, "uuid": "6e9df2bc-c6b9-4936-aae5-8f0d2c1f179f", "comment": "Malware payload (njrat)", "value": "eca62bc81048783ee01ef08138bd5565", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "s-400", "colour": "#511520", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646128880, "uuid": "397bdc60-4e1a-4192-8f1a-ee785254a27f", "comment": "Malware payload (njrat)", "value": "c50b14be52addaac071e25ca25c9249cd97eef4556b93db74f6aba00b8202b8a", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "s-400", "colour": "#511520", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646128880, "uuid": "900080f1-5d3f-42a9-a7b0-b12e02413e03", "comment": "Malware payload (njrat)", "value": "a2de679146b3ca0a7b8260e698aa5c0cb1c2dbba", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "s-400", "colour": "#511520", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646128880, "uuid": "fa3c55da-51b8-4248-9ff7-62993f7adce7", "comment": "Malware payload (njrat)", "value": "46d964c3e932e301198cba22f934808e0ec5cbacf7cc09647ca64bea21eefbe049a3e87677ad58f62b9a35ab36593262", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "s-400", "colour": "#511520", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646128880, "uuid": "db206488-6819-4f8b-a6d4-39492a0607ad", "value": "T109D24A4877D44BA8C5BEBBB7866386A103B6D50F4836DB1F2CC470DB6E6768206209F5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646128880, "uuid": "f2671077-14ef-4453-90f8-467aa1f51e1a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646128880, "uuid": "9196bcfe-b36e-4733-b46f-3dd6a72b63d1", "value": "768:9S9BEuteIgX5nfPOHcA5h2j1hK0Cv1s4GQJ:cB3XOJ7uhm/QGQJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646128880, "uuid": "73769aa5-eb90-40bb-934c-122f4162ddc3", "value": 29696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646128880, "uuid": "f82c92e2-98ec-4b5c-b5c7-295fc0ae9601", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646128880, "uuid": "77adc440-22eb-4ead-8375-6ba25ffe0cd5", "value": "s400_unpacked", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad2b2f28-9956-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646135809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646135809, "uuid": "2e89ad46-b161-4bf1-8cd1-46ce8b5c5810", "comment": "Malware payload (Formbook)", "value": "c620da75f2263270b89bd909e677ddba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646135809, "uuid": "57d1d58c-969a-49fd-b7fc-5a2ef087e910", "comment": "Malware payload (Formbook)", "value": "c53e2ae1ca7da6c2e19ea85dd362b3298481f0bb767eef29caadfd541c232915", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646135809, "uuid": "aafa9de9-528f-4b41-91be-5ccc4850acac", "comment": "Malware payload (Formbook)", "value": "37b9acdbdf463904f4d959ae1b5df78539edb42b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646135809, "uuid": "a589502b-7388-4195-912e-4b6e4cfd7101", "comment": "Malware payload (Formbook)", "value": "204daecee0a629ef49aca21a5dbe18c34abee2d48f73a81d9705c3c0e8b450b601b4a5d552a498fcab900ca080fffd21", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646135809, "uuid": "2551199e-6745-4a40-9588-36763fad042a", "value": "T1A315BE543A674F38E0764BB248D1DC70B7A9EE275C18F33E3841369BDA727518C826B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646135809, "uuid": "39eb7787-fe7f-4191-b2f8-5a59f8a0774c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646135809, "uuid": "eccea412-442b-42dd-9c5d-bb46ec8a7631", "value": "24576:6INvtPPCl5jOg4/BtG/b3q4b9suZKXFhHmebr:9tn0T4irq4RsmKXXGeb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646135809, "uuid": "6f2027e1-09db-4180-aa5d-b0ab1a02885a", "value": 956416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646135809, "uuid": "132da141-1890-415e-9f54-03e3cae2e708", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646135809, "uuid": "a93a5a6c-8f05-4403-930e-2a9f0da7929c", "value": "USCT00832.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85849e68-9941-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646126723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646126723, "uuid": "1d377ee8-9925-49e4-8f08-90bc8a40f2ee", "comment": "Malware payload (Heodo)", "value": "4e815757648c694ed8425154b3f9ebe1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646126723, "uuid": "13bfce39-b6a4-4c7b-956c-785f507ee333", "comment": "Malware payload (Heodo)", "value": "c59a1a2cd3a7bfccc3119d8610fdf65f6548b805e983bcb489cd1982816b37ea", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646126723, "uuid": "f1713cd9-79bb-4191-86ce-349188d7fe61", "comment": "Malware payload (Heodo)", "value": "742b727be5e58da0d3662b010366f5dbc5af98e7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646126723, "uuid": "8398e93b-2720-4574-83ed-cc8ad8cb60af", "comment": "Malware payload (Heodo)", "value": "b17b1c23d56be2e80cbd5010d46dab2dc6d621d8e76583b46668aaddd9825904150cadeb9561742005169415d50c1ef8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646126723, "uuid": "0201fd19-0929-47f2-9cbe-eb2ab2c24afa", "value": "T1A4C4AF12BFD39072CE2F293C503DA77413A95C65971A8863979C9BBE1D3F9428B3190E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646126723, "uuid": "0316acb5-89cb-4e45-acbd-34432cb1f5c2", "value": "e0b213ccd96f46d30dcd8e225f4e9fc9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646126723, "uuid": "84d08ebc-c324-4773-a134-f663a1e46668", "value": "12288:onEtDywy8SYlHD70WychG0QOCM8T9xvCtyDyPgyQz/VDNeg:onEtDywy8SYdnhG0QrM8hxKt7a1Ne", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646126723, "uuid": "fb7963c8-8a4e-498a-be2d-75e981458120", "value": 585728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646126723, "uuid": "ce41772f-dff9-497f-860f-a2d8b50e6867", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646126723, "uuid": "5ad98221-45b2-4e55-956c-2ccd10f4d967", "value": "4e815757648c694ed8425154b3f9ebe1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7c9983e-9947-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1646129357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646129357, "uuid": "c8e13220-6da7-41cd-8895-37c867d82173", "comment": "Malware payload (Loki)", "value": "a02edde9d8f1309ce4164e653f5ecb03", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646129357, "uuid": "0533ec4b-387b-4fd0-be21-fab934fe8788", "comment": "Malware payload (Loki)", "value": "c5adb0b5da2f72760e94147ed8041dbf6cd57243e82f00e1594ced9a725188a6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646129357, "uuid": "8f8f8ef1-9d24-42d7-b2fe-4f9bcd5b4d5f", "comment": "Malware payload (Loki)", "value": "ec3976f07123230b4fe8657a340a7ccca50db49d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646129357, "uuid": "d1a13be4-6d61-4767-bebb-60185023a052", "comment": "Malware payload (Loki)", "value": "a1e6d35289d522dd8e500c4eb1dacf5e4741c4a60eb2e44044b3087c32b970961043f6b5987d23deb3cb94774e02bc80", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646129357, "uuid": "b04b1e9a-45a0-4911-8fac-a68fd1434a8c", "value": "T11B642306A9E297BBDFE253B0B0B625E37BBF52D145022D5B0F650F3FBF1988101495A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646129357, "uuid": "24b34e6d-ce78-4187-b860-27aaddac1bcf", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646129357, "uuid": "69483670-f1a5-4749-810b-39a3eb789523", "value": "6144:rGiDzOrt3dSV/emcWxCk/yXakt7hxgPLK7sqAmLvmKqfyz:38SVGmZxfsakt73gPLKQqnml8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646129357, "uuid": "78d3be6d-fc20-4542-8ef4-e381f91db678", "value": 311184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646129357, "uuid": "b3ef72d1-c398-4987-997e-e388ea9bf2dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646129357, "uuid": "ce6b28b1-fcbd-45c5-9196-d82ab0a02447", "value": "a02edde9d8f1309ce4164e653f5ecb03", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c534cb2-9941-11ec-9275-42010a9c0029", "comment": "Malware payload (NanoCore)", "timestamp": 1646126654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646126654, "uuid": "ab8de97c-d8ba-43a0-baa0-ff76072e200e", "comment": "Malware payload (NanoCore)", "value": "863fe80fc26a81c8021a3f520c216169", "object_relation": "md5", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646126654, "uuid": "cb52a4b3-3050-4d9b-bd91-26f1b2fb15ae", "comment": "Malware payload (NanoCore)", "value": "c7bc02e7998ba9261c8ad2cd5e50428650fef4a9e0a44e59f6f5a0ad90557ed7", "object_relation": "sha256", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646126654, "uuid": "5abb577c-1d98-413a-aa7e-ce4f66f61498", "comment": "Malware payload (NanoCore)", "value": "9f14389043c9d2838181dc75f81987bcc2055b28", "object_relation": "sha1", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646126654, "uuid": "e23ea7f2-28e9-4725-ba42-c1bd97ed8b21", "comment": "Malware payload (NanoCore)", "value": "c84b8556cc2e80ead38e2cc1b7e951553a5af2b5e56e0cabd218cda24e35abb1f4ae2d1bff36dca79e4e0221ace6812a", "object_relation": "sha3-384", "Tag": [ { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646126654, "uuid": "4f2bf68a-39ca-4e81-9f94-b98c4ef97d6a", "value": "T15402BF1C53182AA6E754D87638CF3CE4CA75E117296AFA42163AC4C9A3C4B2FFF51208", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646126654, "uuid": "c69c55c3-bdc8-4393-ad37-51922de63d52", "value": "192:UsHuL5rzZet5kUmKf78QoQ37G2uaawAzwJZLa7iAP1Nrdz9WAZa2C26e:UsHuLLetmKf78k6nwTS1jg8d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646126654, "uuid": "9636780a-5ceb-4039-bcb2-fd3238d4f263", "value": 8614, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646126654, "uuid": "661f30ac-a260-4bc2-8e9b-d9c4e2e14f1d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646126654, "uuid": "734d004c-1067-4d0d-adb8-de5b19bcb405", "value": "Crude Oil Lifting Contract Offer.arj", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e36af921-99ab-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646172407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646172407, "uuid": "814bba31-76a9-476d-88fd-1a804422d91b", "comment": "Malware payload", "value": "9f12c499ed4be43340dc7511b96710b8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646172407, "uuid": "2b0bda9a-467f-49d9-a7d9-fd7b3ed39140", "comment": "Malware payload", "value": "c7f6b7799d797c9ffee5db51fa9392106bfa73363b718a53756d8666a9ad3fe7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646172407, "uuid": "40f34b72-f917-4df6-9838-c4a8c00828a9", "comment": "Malware payload", "value": "444d54258cac7a0a4827187fc191fa4633e7bc0e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646172407, "uuid": "7b9539a1-f469-4d66-bee5-944966108af2", "comment": "Malware payload", "value": "bbe0ccab2849c0e184bdc377add98bfd14183f71ec2d12399c414a9a2e0dae95c22049bec8d881458c977207dd1d6d71", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646172407, "uuid": "317c6100-85bd-4a73-9130-956ccde9ec34", "value": "T189B4AE11B7D0C072C26A35342926E7B656EEBC719AF583876FD03B7E5E301D18A2835B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646172407, "uuid": "2dae9b5a-a92d-4793-ae10-1c7e424d6c42", "value": "d02245ac5c961d83d0907c826d8ba5c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646172407, "uuid": "d341cf0d-b23c-4f03-b48c-05b65bd09bd0", "value": "12288:JhC1q3aXOwkiPs2iCtyjBOAIlgOkar//wJY8Itgm:Jgq3aFkiPs25aB2Bkm8jm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646172407, "uuid": "0475093d-b68e-477f-a8d5-3414ac7ee6fd", "value": 499712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646172407, "uuid": "17c5636e-7670-4ac2-8621-2ac990b00e87", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646172407, "uuid": "78883d01-2d28-4ee3-85b9-b7b717a19baf", "value": "9f12c499ed4be43340dc7511b96710b8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "498d8a15-9934-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646121039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646121039, "uuid": "bd4eb47a-9d0c-4e0f-9aaa-315a8c63889a", "comment": "Malware payload (Heodo)", "value": "58d460d5127cfd4d2ca097d4d40a995c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646121039, "uuid": "aa01967e-0b37-4b58-a5f6-93e4e6e9ba3b", "comment": "Malware payload (Heodo)", "value": "c8e934e8484de12bc650e0fbbb0d41ecde075bd8b9bdae986c376d9dd614f4f5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646121039, "uuid": "ed6b2ed1-f875-409c-8159-67ad19537748", "comment": "Malware payload (Heodo)", "value": "f13466ddcb374d5a5733d64e13930da359347250", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646121039, "uuid": "eeca9a41-5717-4f13-bb8c-32beace7097e", "comment": "Malware payload (Heodo)", "value": "2acfa93bfe06d08efebeea6c1a3b8ade73279ec4d6896d592077979b99cb055ab9f54e222859a5a246e8cd559ee4a026", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646121039, "uuid": "d8653ce6-6b51-4830-bd39-f51a75e5b70c", "value": "T108D47C82F7429EF2C00B03347C32B2586BADEAD5D6158D6B9398A5AE1F35533493DE43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646121039, "uuid": "cf2aeecd-e471-4141-ac47-4162beb41701", "value": "e0b213ccd96f46d30dcd8e225f4e9fc9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646121039, "uuid": "9179945e-772c-406c-94a9-2ed9e482ad85", "value": "6144:XjPgWGbb0OEmS9Vzf5WI9nI1LSfcaoMyhKmZHNRuIfv7YtaIIo0cm59CH7PQ:X0bEtf5WyI1LSfc5fxhstaICRLmrQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646121039, "uuid": "b44fbbf0-eb05-4c6a-9d6a-05e30705c964", "value": 602112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646121039, "uuid": "bd366dea-7f42-44c0-9d45-1a6fc5372e9e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646121039, "uuid": "ad1afc94-6d97-43e8-a8be-dba714f3139f", "value": "58d460d5127cfd4d2ca097d4d40a995c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a27492a6-992b-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646117322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646117322, "uuid": "a4e4a0bb-9594-4e77-a595-c0c3de66ba50", "comment": "Malware payload (AgentTesla)", "value": "98c2bfa1bfe0a13c9a40516d8dbbc776", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646117322, "uuid": "326cbded-829f-4d0e-b43c-7e82ba91342b", "comment": "Malware payload (AgentTesla)", "value": "c8fe2136344b73f73fd892840bdc5895dd63ddcfd1ced78fe0973a84e6c7c148", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646117322, "uuid": "0374d400-cc56-434b-977a-5f9f2af2b047", "comment": "Malware payload (AgentTesla)", "value": "58d86982e7afac1c62cc5d18556c3a2bc4a7ae56", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646117322, "uuid": "7dc4d413-696c-4181-be21-e9dc5b69a4da", "comment": "Malware payload (AgentTesla)", "value": "192b17e67a76816a0b89558a4e90597e49a54c52c164d8cd0d38a19830ecdf0f5d8a65f6a9da900ad73b6d7fb7c7a667", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646117322, "uuid": "0e8c530c-9199-495e-bd55-fb87e8a01295", "value": "T1E105C00439E64038F83A8BF2CEC0E7F19B6EF221D48975F558000E559A55BBC895AEFD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646117322, "uuid": "e1786669-35d5-48a3-876f-ad6e3ed2171f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646117322, "uuid": "126878ca-3b6c-4646-85ba-e946596c7c83", "value": "24576:Su7NqPo3wtrUYcINQgDPUSs/ftu4sm4//ZPqeKz:Hs6wtEkQiM7fKnZF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646117322, "uuid": "69a26870-74e9-4f75-b777-c5d61b1b09d3", "value": 816128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646117322, "uuid": "6eed1d96-e23c-429b-9401-b7497928e79b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646117322, "uuid": "678b9c2d-4405-4030-a8ad-dd95b8dd0874", "value": "New Order_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b08358b-99a0-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1646167427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646167427, "uuid": "9d951c52-d60f-4679-b981-3bba9b1a48e9", "comment": "Malware payload (Mirai)", "value": "e263c809dce88e650f291734b32de8d0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646167427, "uuid": "9e47b8f3-e689-4e4e-ae51-b04357a95a2f", "comment": "Malware payload (Mirai)", "value": "c9ad6c678a3fad7bdd4e412f8e2768e001b919d6a42a00ee986e3423e0fdadb5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646167427, "uuid": "26ea7ce0-7669-49fd-ba28-5ef98dda1005", "comment": "Malware payload (Mirai)", "value": "8634f3de482cfbd71656883b4888c1cdd5521941", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646167427, "uuid": "393205bf-ee2d-477f-bb6e-03df227c8cee", "comment": "Malware payload (Mirai)", "value": "2b6ceec3ecc1c00f7c7b57602973923ae4c90779cc6ed641e70b5c689fac27bb0bc5188732b66b1b33788608a5599a06", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646167427, "uuid": "681a904a-f6ac-4f80-8485-5f882b6bb209", "value": "T1E4D2E1B51316554BC29906F9A3B903D28A730BD1A047DFC76AC458F7E15B130F9A37D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646167427, "uuid": "e988eff2-f6f8-4881-ba36-e4c4db1d8151", "value": "768:BBGDrWWUNjtfj/QfHNuF8w8RbZvMqUzqYyIhQJgGlzDpUYsBh:OWWypj/QEz8RbZkUaQVqYMh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646167427, "uuid": "46e0fdd4-aa57-4045-92e8-7fece4293a9e", "value": 29156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646167427, "uuid": "0b7c2d08-f4ca-4b6e-8a14-42a0d0255e5d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646167427, "uuid": "4e8a4d27-ae05-4808-a68e-f457046e7e94", "value": "e263c809dce88e650f291734b32de8d0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "111b0782-997a-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646151009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646151009, "uuid": "421e1e38-ed6d-4f15-83ae-be835a615ac6", "comment": "Malware payload", "value": "3aa86b07c8884a0dc1acb9f9192ee68a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646151009, "uuid": "6f00a725-5e56-4164-847d-533c9154632e", "comment": "Malware payload", "value": "cb0f171987e9dc994b119ba7a62ff05dfb64a656d3c78b7c26cfa7bd5b1964d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646151009, "uuid": "162074b2-b783-4eac-af98-16ba0a11ea65", "comment": "Malware payload", "value": "78ea1da622bd3c2f5151adcda88f3825c1360a56", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646151009, "uuid": "8cf41e8e-5794-4a10-bc79-c13cfd15f377", "comment": "Malware payload", "value": "523cfc4cc9722fecf5fdccaf8b00b14c6912c4b3f8a9c213db85e3f8be32c8fe54b5b6b3bc4bb044ace9847d866dd2fb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646151009, "uuid": "998f366b-f95a-4a14-8313-4b3cf4082fad", "value": "T1A3C38C4132D3413FE9A1967259A84A91C6EFFD212979CFC76B8C217E8C741E0073AE67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646151009, "uuid": "aa05d1d6-570a-4f42-9893-d3d05d96a8d8", "value": "971f3f0b77b45ee5dd5e2c85cfc3039d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646151009, "uuid": "00318360-b89b-4782-b488-d7c755fff8cb", "value": "1536:T897t18ILTXXs/zruxUX1naPC2GKHaoF1aAeHUdZHDdypcj1Bql3O0qaSc8tKJsO:Yxt2ILTXX0HuqX1sVGK30CywB3/t9QA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646151009, "uuid": "3ba9f117-bcf1-4604-adf1-ac0292576541", "value": 129024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646151009, "uuid": "dc6aa0ba-2043-48f2-aaad-ac7f7a4f2289", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646151009, "uuid": "4e3beac0-0ca5-442e-b5d9-a231b3174df7", "value": "SecuriteInfo.com.Trojan.Win32.Formbook.4c.20049.21489", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a920dee5-992a-11ec-9275-42010a9c0029", "comment": "Malware payload (njrat)", "timestamp": 1646116904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646116904, "uuid": "df3096db-4459-475d-88cc-4aca7ded8fda", "comment": "Malware payload (njrat)", "value": "d884e8b9d8130830d87eec3390f3204f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646116904, "uuid": "1fdcf06e-15fd-4caf-91b1-bcf0704b21a0", "comment": "Malware payload (njrat)", "value": "cb296dc76a80e1608c4af7ae0053211578b2e52e6fd325338885d86f9a295793", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646116904, "uuid": "4d4b4aa7-5d8e-4e04-aa43-b62db80922dd", "comment": "Malware payload (njrat)", "value": "323b37984248559bbc4fcb3c4c54c9bfff4946ff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646116904, "uuid": "003e9179-f4a6-42c1-80ba-8a9459fcbeb9", "comment": "Malware payload (njrat)", "value": "439cee04e7f03240c22dafecddf692ae4cbaa6db74f9eed71e7f2d1a3868622dd15212cfa19f905a75b071e1cd578fcb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646116904, "uuid": "9d9d837b-a046-47b1-a1f2-857e44078dab", "value": "T14464AD3923D86FA9E07E6B785974901403F6B646EB22CB1F3DF100D96B71E818663B53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646116904, "uuid": "00c8bf9b-91a2-4363-9966-b23d9062637d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646116904, "uuid": "52918b9b-a6f0-4f7b-b7f1-74e11f29b42a", "value": "6144:gvR8hUSXIY30pVgyJHfCJWr8NmmIwFF356jL90K+ZK52ClfZ1r:gvR8FOVgEfC8r8NeyVs0K+Y52s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646116904, "uuid": "044126ec-6fdf-4b9c-af65-b1b84bfd92c0", "value": 334336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646116904, "uuid": "6e71115d-7d88-4c10-a439-5c6ce7fcb0ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646116904, "uuid": "ab0c111d-c50e-4eed-b7d3-6ea0f9899fb4", "value": "slip9845678988.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65123208-9932-11ec-9275-42010a9c0029", "comment": "Malware payload (Socelars)", "timestamp": 1646120226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120226, "uuid": "79fc060f-5ef1-4792-ab02-512997e5f9c4", "comment": "Malware payload (Socelars)", "value": "36cbf2981c8fc44bcc1f806d9c43cbe1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120226, "uuid": "3d3ead8e-3b77-4a1f-b782-4ba03e7828ff", "comment": "Malware payload (Socelars)", "value": "cbcb30d07e458aa9dac375fdde7ad8fb5c9073b0e1fed73782cc3290e3cad4cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120226, "uuid": "f6c8239c-e040-45e3-be9d-61406a40add6", "comment": "Malware payload (Socelars)", "value": "bbe68b5a4f3ae0451177fb36b282a9dd32a3a5d2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120226, "uuid": "08d1a477-06d2-4446-b39f-84f723b8eac2", "comment": "Malware payload (Socelars)", "value": "8d334d9e7e1b790c719676b5457857689010658942ee46ff4cf11570bf4398a6454e4fe88325f7f33597d9f4353a213d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120226, "uuid": "59b45c9f-7ea1-4864-8fb3-da7a0c36da12", "value": "T129658E11F642A036E8E3007382FF56FE9D2C6E21031494D7E3C47D6A6A715E27A3766B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120226, "uuid": "9034fc44-856e-424e-bcb6-af2951925e72", "value": "d69e4c13e25f0ad622344ac56118c0df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120226, "uuid": "58a197b9-e1e2-4c55-900c-2142003133e7", "value": "24576:l9opFqoCv+VsqF7nZYll2QDUrygcC0JY3ZAwS8c95/d6s8jRw+fu:QpH1sSDu6Auq5/dh8j24u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646120226, "uuid": "4d7fda3c-f2e0-443f-8160-54928445219b", "value": 1520128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646120226, "uuid": "0b6d625a-3a42-4222-a5ac-c7d8c204a203", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120226, "uuid": "61ebada1-8814-44bc-bf6a-4b0a54d95e85", "value": "36cbf2981c8fc44bcc1f806d9c43cbe1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca2988b1-9935-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646121684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646121684, "uuid": "d2dd3ede-a81e-465a-9b5f-db2a2ab297f1", "comment": "Malware payload (AgentTesla)", "value": "3ffad8e86aeeadc9596a9bcad8527136", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646121684, "uuid": "f28b157e-f64f-4d3b-8a94-1ae4d707e918", "comment": "Malware payload (AgentTesla)", "value": "cc2b07c790673d377603b0f7edc8680e35bf6c5e98d05df0657748c3423632cb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646121684, "uuid": "e07746ca-88af-4a75-94a7-26369858a188", "comment": "Malware payload (AgentTesla)", "value": "8be57233b73e404a3306ad5afb16f6d1a5a33421", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646121684, "uuid": "cf782663-c65f-45ea-a74c-98664c8dccdb", "comment": "Malware payload (AgentTesla)", "value": "b87f7c8e15d168ccc56eb324c77da9efbb728df5b9fbd7f591613d8846ccadf0ca766003f9ec020e5b95ef9df43a57bd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646121684, "uuid": "1fa3f8d7-72b8-42ed-aafb-61a8235fd70a", "value": "T1031523B310AD695C801B81522676EAA8C5F7EC34FA1239EB32370BC9EED1134B5DD617", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646121684, "uuid": "982f30af-2348-4f61-ac19-516dddfb7d87", "value": "24576:E79gUAif4txhiIeuXnI/Pl+79DeMqw9/2jRwD4W:ERo70uXIF+79D1q5CD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646121684, "uuid": "cc2abe98-cef7-4c0d-835d-86b1fc2475c0", "value": 882684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646121684, "uuid": "45f3b49e-61ac-425a-bee1-10c8fec28cf0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646121684, "uuid": "e7ec713e-40c5-4eb2-982f-acd2e60f4403", "value": "QUOTATION.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd87341e-99a7-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646170679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646170679, "uuid": "c6f69a68-9d7f-42b5-8112-61670bbfd53e", "comment": "Malware payload", "value": "7de82294c3f63f199f547b5996b7f645", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646170679, "uuid": "082673c9-1e2d-423d-a48b-b88d829806c2", "comment": "Malware payload", "value": "ccc29069e9e6be1ad194521c9d7b7c3d1e59f99a253e89cb95b09c5e8049c5ac", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646170679, "uuid": "31b86982-1635-472c-8ef9-fe5acdb1320a", "comment": "Malware payload", "value": "2f76d49f97a307c82bf25dfbd5e222bb9114fcc0", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646170679, "uuid": "d88ce7c2-7717-4d14-8c9b-2c43f73e03d4", "comment": "Malware payload", "value": "db9fce3bfd2d24141037b1025141d3b6b258a5839a618b026e645f9f635664f43cbd96e191b1da9f0f7ef40003a96c42", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646170679, "uuid": "75a511b9-4771-42b4-8e55-39040ce3ca5c", "value": "T1A8B4AE11B790C076D2AA36342512E3B51AEDBC709AF5838B7FC07B7E5E315918A3835B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646170679, "uuid": "9232a0fa-d7f1-468f-b341-bc5a6ff4c457", "value": "f08242131de62ca6d7c4b2727b491b3d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646170679, "uuid": "045f5a90-bcdc-4868-9c5b-6a7d3a7234e7", "value": "12288:dbFLiEzuSo9guqHuWjr2pyf4W6SpktSuHE:5VWSo9guWz6ZE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646170679, "uuid": "7db797ad-b579-49c3-899a-ff071c89aa70", "value": 500224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646170679, "uuid": "a9931b21-e076-46b2-b102-cda3daf1ddc4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646170679, "uuid": "61d477fb-a5dc-416b-8c63-8042c66fabd1", "value": "SxzJQupQhyso.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96faf1d5-99a2-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646168413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646168413, "uuid": "415fc505-0466-4544-b70c-e2e3d6b3437b", "comment": "Malware payload (AgentTesla)", "value": "b537607994ceae76d7de6d93be438be0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646168413, "uuid": "243ed902-5402-4a14-9d1c-262143df693d", "comment": "Malware payload (AgentTesla)", "value": "cdda08160770418f4edee010927514c7a4ae884f103c57092be9abe552ae0645", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646168413, "uuid": "eda9c085-d596-4162-9dc0-965688ea487f", "comment": "Malware payload (AgentTesla)", "value": "ee1bce294c7c5f35731bd44e86965d8271365f95", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646168413, "uuid": "b487cfeb-1450-457d-8696-46f3583e0af8", "comment": "Malware payload (AgentTesla)", "value": "a9478a7c756cf3027588771b09c33467efe012c8ad4b21750dda5a3fecb2ae8b846c29d253311bba7ad3b2651350891f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646168413, "uuid": "21be9771-e1a0-4d78-855b-ff20ac60d6d6", "value": "T1D105CF0839EA5038F83A8BF1DBC0E7F19B6DE361E48970F594000E155655BBC895AEFD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646168413, "uuid": "115d9c15-5091-462d-a33e-62fb51a689da", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646168413, "uuid": "6fed4baf-5346-4cb9-992c-65105ab9997f", "value": "12288:kEHlR/Ir5W2sWf0RLuHqggMCCplnOFGSnOriPlozuMmmWpnRzLsww9td:85W2ULuA6lnOFGQOriPOzuYqnRzLPyt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646168413, "uuid": "7e937d3e-e9c6-4973-9ea9-4da6b22d6449", "value": 823808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646168413, "uuid": "af2f0405-d174-4c52-a605-1e8486b24cc6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646168413, "uuid": "4aa89963-724f-40a2-9aa6-93e89cf20b99", "value": "swift copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2f555c3-9968-11ec-9275-42010a9c0029", "comment": "Malware payload (Gozi)", "timestamp": 1646143603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646143603, "uuid": "7833881a-d0af-4269-be08-06da277a5ed1", "comment": "Malware payload (Gozi)", "value": "2eb8b15f33b772166b158c94e5e0774d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646143603, "uuid": "6514a8c7-228e-46b6-9174-dd6b228eb874", "comment": "Malware payload (Gozi)", "value": "cde070a46442e1a06c722393a335e8c104904a0581d890bf25a13f9c0db39473", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646143603, "uuid": "a18c32da-b68a-4492-b45b-d005fc1d3d87", "comment": "Malware payload (Gozi)", "value": "e0457ce05a7fecc0ac0c8af24c8052295bfd5c99", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646143603, "uuid": "49c09af0-f588-4666-a3dd-02a4ee6174c8", "comment": "Malware payload (Gozi)", "value": "4d9ae85f48fe21a70c422ccf6b83f70253ba250030cfbbbd5fae3f0bbccb44d6758949a921178cb69158cf90a176ab69", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646143603, "uuid": "059012c1-158a-44c0-9644-e9e25c4a6133", "value": "T1CA448E5AA3E50D95E9BBC5B9CD93D227DBF234091A64D34F52B4CE966F03322B21C342", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646143603, "uuid": "e6e9c819-5356-40bb-a01d-5710937745c0", "value": "6144:1jOc9lLYJm9qCR8h2O1CCP1GzzBpbf77WtM55FKMu:139VYJj0g2eCCP1GzzT77WtN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646143603, "uuid": "82ed25ea-05c6-4e67-b08e-fcda267eabda", "value": 262144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646143603, "uuid": "f1e4d344-b9ce-4176-9426-2ffd1b367611", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646143603, "uuid": "ea77e12f-00e3-4bec-8017-9bd03962de2a", "value": "20de2430000.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "749eb5e7-9933-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646120682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120682, "uuid": "b57912fe-d791-42bd-b445-9cd3b099b4ee", "comment": "Malware payload (AgentTesla)", "value": "3ea7e8ec69b10e0912d36f76c70fbaba", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120682, "uuid": "290c123d-0fef-4def-81d6-1678b7dd76bd", "comment": "Malware payload (AgentTesla)", "value": "cdfd47d2eee884d24592f2dc75236e79a7ce8b4f5e84a0e87bbb15b5b7b19a60", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120682, "uuid": "0a0d43a3-cfa1-421d-a177-205ba8de78d0", "comment": "Malware payload (AgentTesla)", "value": "a35da69577c8d0025de5583a562274c75744ba10", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120682, "uuid": "32679cc2-24d7-43b2-868f-ee64db9ef3d8", "comment": "Malware payload (AgentTesla)", "value": "f00ac8c6bef245dda3fa4eb667f810c4e34ab9e3aac9e7c474523720406f6b7304b529e7bc5668a998154cd65be5d302", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120682, "uuid": "246e05b8-7b11-4ae8-bcf8-592aca912c5f", "value": "T1FF141238350664B9C66B1039701A8DB479D9FF604A1CD4B3EDA6FC4E81FD4D29421BAF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120682, "uuid": "d2907cc8-ea76-4130-9ba4-ce533db5d453", "value": "3072:Swg4/prqn2ED9YqsoVGD5ws2+YS/bOc50DuoFawD0pJgv/w:U4haiJkGRoS/6c50DnIwgEvo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646120682, "uuid": "60bcb92e-3e1b-44de-bb3c-c057ca672342", "value": 191352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646120682, "uuid": "d224d8b5-f893-4e0d-a44c-5dc04f8b1eb2", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120682, "uuid": "82f88c95-899b-4fcb-baf3-583774af672c", "value": "Urgent Order.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f2cc70e-9931-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646119894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646119894, "uuid": "2e7827de-046f-4b40-82f0-ebeec039faf6", "comment": "Malware payload", "value": "822d0635ce8e8a669fb73217e39b28a3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646119894, "uuid": "92e0f7e0-0a12-4e76-8cf9-946f819163f2", "comment": "Malware payload", "value": "cdfdbc1a118907536a77e07cbc82f960495c9807812047cf3b0a54e28c1363d3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646119894, "uuid": "73eed8c6-4f4b-4d26-be59-70fcab29e860", "comment": "Malware payload", "value": "da32176e3ec824e6c030828a48e1473da3453fa2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646119894, "uuid": "cbc73948-32ea-4c09-adae-b169f0cc4913", "comment": "Malware payload", "value": "12a4ca30b79a17a786ffe6cf4e94f28e4981a5993b847e0b239f8d9072778bae351ef69c9d9a8fbf1a3d674af656e878", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646119894, "uuid": "5dd1952a-e520-44c1-800b-1742c376baf8", "value": "T1C22733BBCE0B9052FCAEFD309BE8084A4E560F54F29CC1C7257D98147C7698C69C7A69", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646119894, "uuid": "7115da50-493a-4c2a-991c-60ebbc65621a", "value": "ff0dfa05658a149b7b21130a1a8daedb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646119894, "uuid": "7d76e444-1734-4a10-a05f-9cebd2a964e2", "value": "393216:sHXkofJZuQmSRusoPXnzOhSoH05vdj4q+5YvqDeTsKvfK1iVjsYzuB2IBoZ5YO:GkofJZeSQso/nzon05+qnQZcZaB1Bo5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646119894, "uuid": "df5c209d-a9c3-4f14-b46a-5b0360d118ad", "value": 20880137, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646119894, "uuid": "5368e44a-e6a0-4b62-9d38-69f55862daa0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646119894, "uuid": "7c5249b3-e6e4-42c9-b91c-6cbd288f4dd0", "value": "822d0635ce8e8a669fb73217e39b28a3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a364036-9934-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646121067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646121067, "uuid": "83afc614-e3b7-47cd-b6ec-297739f60438", "comment": "Malware payload", "value": "71070b61ae1d0e50f4b8e2ad5fd13b2a", "object_relation": "md5", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646121067, "uuid": "1ee40333-5d2f-4746-9c1c-8a369cb81729", "comment": "Malware payload", "value": "cec790e8dc5ddfb32069cbf195f258bd83eb370ece448b5b0d4bc1da760a3889", "object_relation": "sha256", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646121067, "uuid": "0738b8ca-ba72-4e22-9447-778ec13d74ce", "comment": "Malware payload", "value": "c02b4ffb0a3a2e2441715037e9a84c0d69643086", "object_relation": "sha1", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646121067, "uuid": "7a26e966-c8c8-4741-ac66-690469e88919", "comment": "Malware payload", "value": "908ac5c59ebff4d29b99bb169cbefd4c7d01ccda0021372564f8416b0fa87e2a624d4511a6c853a2b812c015c422d1d5", "object_relation": "sha3-384", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646121067, "uuid": "3f6922ef-a27d-44aa-8f95-a0551b6e3a3d", "value": "T158D46D55BECA6EA1EFBF47B78361D62D1126736E03A0A6CF6603019D3951FC2453EA03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646121067, "uuid": "ad64c6e1-6984-4f3a-8d03-1ffb0901f6d4", "value": "be710ba34b048ab0098050ccf62e369c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646121067, "uuid": "ba13abbe-7ec1-401c-acc2-f2c58734812a", "value": "12288:S0Ws7IMsR4yVld8bzbBSrewBY4ZyrE7K3yl8PeVooA/AB2LEJZsAQPUqjc:S0bskX1ABY4ZyrE7K3yl8PeVooA/AB2f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646121067, "uuid": "cb6c9387-cfdd-41be-a92f-8fafe711176b", "value": 648704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646121067, "uuid": "cff0a6ba-f272-45d7-bed2-360bad87f1c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646121067, "uuid": "4957914f-567b-443c-80a3-02beb2a3421f", "value": "Ach List32.xll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22dc3d97-9987-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646156622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646156622, "uuid": "26c6f54b-3e16-40cd-9cb4-bb81428057d8", "comment": "Malware payload (Formbook)", "value": "3655190fafc2458d31ec35b305a820c7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646156622, "uuid": "edec57de-26ad-4eda-8fff-a8990b31b524", "comment": "Malware payload (Formbook)", "value": "cee2290e27d378faacd5a9ab5fc579e912c1ecee9db29e4e79d8b9cd7ee10c94", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646156622, "uuid": "9178b684-88c7-4695-84cc-de2a75209913", "comment": "Malware payload (Formbook)", "value": "8569f1f264539b906a7d03c56245648ea7e04fc6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646156622, "uuid": "bb972185-7b6b-45c8-8a96-b89d671dd50c", "comment": "Malware payload (Formbook)", "value": "be21392f1e4ba49b9c856d8d2351879dafa3faeb76c310d67a643aee1efb12b0afcea97a05faeb08d038c37418d8f2de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646156622, "uuid": "97f7ed00-a8f1-470c-9706-1735d0411a20", "value": "T17F84E16DD7E7822ED5B4867BC4F637602F10EA57D07B872B50820A171C933B9BE901E9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646156622, "uuid": "d6c803de-2dc2-4026-bc95-ff3cb69d06c2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646156622, "uuid": "3082509b-208b-4e24-996d-22b9e9c8a6b7", "value": "6144:0bOSgirgjUCDLNeyQuYZ/ltKnzW65veotSkS1cAe5h+D8D5OyKH:qMjUi8BZGn9mokXe7k8DA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646156622, "uuid": "4e38eef6-fbbb-4a66-bdb9-a0a1e18750c2", "value": 392704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646156622, "uuid": "2d1d278e-1f21-4250-a4fc-2839253f3f76", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646156622, "uuid": "c82cb6cc-f671-44e0-ab33-525152fdfa5c", "value": "3655190fafc2458d31ec35b305a820c7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "373a9ef4-99aa-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646171689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646171689, "uuid": "b3e2269f-7139-4e07-82c0-2f407e030661", "comment": "Malware payload", "value": "bcec04954d4eaf9afcdfac796d3927f6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646171689, "uuid": "758f78ca-b814-4b3f-a613-9346851b4dec", "comment": "Malware payload", "value": "cf18429ec0cd177ed734ea521305496ff3db86ca7cdc1ec50c52e94cc3391b37", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646171689, "uuid": "39cc9723-f845-4cf5-b19b-f49725a32392", "comment": "Malware payload", "value": "0c1584c97cd272429ff4c342b7e005e730b92a3f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646171689, "uuid": "58bc7dac-d2d9-441c-b076-8a53dd758681", "comment": "Malware payload", "value": "8ddb95e740975766882e209a166c5301854c465d6abaafae2d486cdeb0229651990f5708f09427caf7c2d31f0a6db686", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646171689, "uuid": "f397ce08-490e-4a07-a082-b9da05febdb3", "value": "T19CB4AE11B790C076D2AA36342512E3B51AEDBC709AF5838B7FC07B7E5E315918A3835B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646171689, "uuid": "868dfcf8-d734-42d9-9e99-4c37c95c84d7", "value": "f08242131de62ca6d7c4b2727b491b3d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646171689, "uuid": "fdb99aa4-4aec-415d-b921-2bd4cc2180fb", "value": "12288:dbFLiEzuSo9guqHuWjr2pyn4W6SpktSuHE:5VWSo9guWD6ZE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646171689, "uuid": "de34fc16-a1f9-4146-b6cb-b58e3ff9d1d4", "value": 500224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646171689, "uuid": "e24c1fc8-9c45-4ed5-aaaf-f886a09fff13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646171689, "uuid": "e5b5e8ab-9ee3-40cb-b34f-de5c0966559b", "value": "bcec04954d4eaf9afcdfac796d3927f6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29d55ae1-9943-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646127428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646127428, "uuid": "77fe2c5e-1af5-4847-8763-711d0f76d837", "comment": "Malware payload (Formbook)", "value": "5b4e1af246af82949e138e01e22e682d", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646127428, "uuid": "8ce446ac-351a-494c-9c3f-d4254e61f197", "comment": "Malware payload (Formbook)", "value": "cf681381ef48e3621d117d38b8fe811e69ff1fef55e707d23e78d94f3a8c2b9f", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646127428, "uuid": "1e9f545f-28fa-4f0e-bcd8-a8c6241bf43e", "comment": "Malware payload (Formbook)", "value": "4dc7cec39462a733ff90ee0549f46d0d4adf37e3", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646127428, "uuid": "aabdcbf3-321d-4be3-b97d-6fd69d8727da", "comment": "Malware payload (Formbook)", "value": "e45825a47dbcdc2d1d5cc0a88b738f9efdd44b5ddee54cbf831d09e24f07b257d11dbb703ba8d0b3bb9b1d953c81dfbf", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646127428, "uuid": "7801df3e-6617-4d4b-904e-9b774e7439c8", "value": "T1099423997D33A98B18DC43979C66E8739B0E3C03B868CE9D7821B50A09B4B7CBD5E150", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646127428, "uuid": "d9e1bfd9-6348-46fb-a6cc-b29e6197db93", "value": "6144:wbCmZ5ceQ3UscD8wwVm07cXeM9QWAiQK9kH9Tnh8pDKD0qhnoq4GlkIi2L00P5m2:EZRscgww45eMCiQVdTIDY089k0d8Fe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646127428, "uuid": "5959d733-f88e-4b88-9ce3-04cd0a2ef122", "value": 443140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646127428, "uuid": "385806ed-6f93-4f95-8686-9ea5ca17870b", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646127428, "uuid": "2428f3ce-9434-46e3-8b4c-1d4be170c448", "value": "payment 001.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81275d46-9956-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646135735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646135735, "uuid": "75688b0e-c887-42ac-8750-78e11fdb5c1a", "comment": "Malware payload (AgentTesla)", "value": "20e58d35e2186819db68b3f43984c978", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646135735, "uuid": "cc6fa38e-acd5-4230-bf16-791b696ce9e0", "comment": "Malware payload (AgentTesla)", "value": "cf73c21e42d1a1fc3ff06566b826cac210f62616947efe39eadd3d958df47bf8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646135735, "uuid": "051a48d9-ce42-4477-8fa2-b36a21a93e99", "comment": "Malware payload (AgentTesla)", "value": "f932ec38a562115151e91a2c3e66b8d2ee2c3122", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646135735, "uuid": "717d74d1-f980-4ee9-97c9-024ddcd40c4b", "comment": "Malware payload (AgentTesla)", "value": "23d5155e885dfba280760f0ea8b01627679bbbd0907116ffb9d76eebad1bbc1104ee9987768a1c736dfb8dfd1a687a46", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646135735, "uuid": "db8c71b7-223e-465f-b949-4eef0917c963", "value": "T13A15BF4835D6607DE836CBB1CAC4EFF1DB29F122D549A1B650020E199A0DBBD8E05EFD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646135735, "uuid": "bc2fd5fc-d386-4305-a3d5-17e7e3432c1b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646135735, "uuid": "38ae68d4-6ab9-4ac8-bcba-385a6a1a7473", "value": "24576:MM0wjj8O6f+3cOksDQDcwEBy7Ei9QcbiruG8cfWhDV:DNP35ksD676UEobirnuhDV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646135735, "uuid": "37a5b52e-6c2e-436a-9c48-35002da21b46", "value": 949760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646135735, "uuid": "f129246d-4821-48c8-83ea-8aa55395d00f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646135735, "uuid": "1398eebd-a95f-444e-a230-ab00a5f2d525", "value": "SecuriteInfo.com.W32.MSIL_Kryptik.GSK.genEldorado.23310.11631", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aeca7b0b-9933-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1646120779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120779, "uuid": "3fead8c9-3378-4c76-a668-49c97ab3fba9", "comment": "Malware payload (Loki)", "value": "81f2eec2fd6512f6012f2f24639e5da1", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120779, "uuid": "4e467137-196c-46f4-9308-48d542b39c94", "comment": "Malware payload (Loki)", "value": "cfa8b153806e2d07f8a83bb711b9a3f1e1d357118922143f0473df89eff4e20c", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120779, "uuid": "032fcb61-11fd-4388-a5fb-376e573abc4e", "comment": "Malware payload (Loki)", "value": "207483821e0a2534ef84fdf4e9e5cc079181b274", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120779, "uuid": "75b0a29f-3354-4c38-9253-7fbed4b6c4c0", "comment": "Malware payload (Loki)", "value": "af368d82e4cb5dcad95a2b88aded048ef5a52a44ea125e938b5cb88ad13c200a1fc345ba41923b289a5398b0b6ce763b", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120779, "uuid": "52b7133e-b1c0-430d-b706-b61320203a19", "value": "T11814024C7B9CA4A9D6636DFE40571EE87742FC3CE40CCA0E9565324FC3BA6419F648A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120779, "uuid": "b1125a35-bfc0-4640-8dd6-bc383ba27385", "value": "3072:Fuc8DQd6cwbBGrPTAy3rf4fKCx3w+KCtp3wS5Gw8pxQ6GD:oe1wbBGTTLf4SCRw+N1wS51AGD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646120779, "uuid": "b7fda3a4-2c65-4ec7-bc3a-eb2b6cce0627", "value": 191464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646120779, "uuid": "135b83ae-1307-4435-904d-c9c86b09cbcc", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120779, "uuid": "e81fa566-270d-4946-999f-6079ea4b8835", "value": "Payment-request282.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "794fd13d-993d-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1646124984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646124984, "uuid": "c4faca55-b2a3-40ef-8887-69b791823b3b", "comment": "Malware payload (Loki)", "value": "96b412b7b19db7817b7485bd49e1d314", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646124984, "uuid": "f80f27b4-197b-4101-81ec-40f45854804c", "comment": "Malware payload (Loki)", "value": "d070985741f4469026b12984e4c55820a60dfb381da63eb86b42c8f6bb49fe23", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646124984, "uuid": "ecb2f9f5-613a-4c1b-8f07-dc097feccecb", "comment": "Malware payload (Loki)", "value": "11ea3d96d25de02b8aa2e3963d53de45155ace76", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646124984, "uuid": "882ddd1b-ade0-419c-91e8-e83085edffcf", "comment": "Malware payload (Loki)", "value": "42784861fa1bf8a39a41c872f850b6c13db6816b7f2b929648affdd85879af64ef2fea4f9e14e9e5ca66a6dfcf5303ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646124984, "uuid": "d2c14d62-7ffc-401b-ac7b-8c1441f6ad98", "value": "T18C642342D498CCF3D8BE57786633AB68C3F5AB8C4283A71B57605F6F186026B4E8D153", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646124984, "uuid": "54556cf6-ed25-4270-85ee-c65a50395dcf", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646124984, "uuid": "3150c245-2c38-41b2-b6a2-ed90b6073279", "value": "6144:rGi4779jwZkqqwj2MUom0YHG2J5k9dzgVkDyA0Z+4r4ja58RwHHDfqxxB:AjwZkk3SoHzoOm+raMwHHWd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646124984, "uuid": "a8bfc88d-caef-418b-8f73-7b2450032df5", "value": 335109, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646124984, "uuid": "b14c5ff7-4371-47b9-b1f9-5fb2817eb25a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646124984, "uuid": "030ca1dc-2fd3-4922-896c-b086765ddfb2", "value": "96b412b7b19db7817b7485bd49e1d314.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16fdb8df-9937-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646122242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646122242, "uuid": "65023f41-0bb2-4230-9e34-d726c714fd55", "comment": "Malware payload (AgentTesla)", "value": "baaa16bcc4a4e1b79042d9ef4beffd87", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646122242, "uuid": "e13bf0c6-ca8d-4124-be1c-5bcb1c9399da", "comment": "Malware payload (AgentTesla)", "value": "d09834e61f459e41d6abc13831cb6c488e4b763a14e83d9634aaf1fb37aa91c9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646122242, "uuid": "d33fc135-8e35-4070-a08a-ad87216a8c6c", "comment": "Malware payload (AgentTesla)", "value": "775bd7544c16382e7751d280e7313c36210cda9d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646122242, "uuid": "b22cd1ef-2e06-4dec-b00d-4dfe7e40759f", "comment": "Malware payload (AgentTesla)", "value": "902f81fc24b4ddcc308e0a7e9e1ab6cf06560dd7e06c8f095e54d3d8201e957b9caa8cab23790ee580974467f2d5ffd5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646122242, "uuid": "886a141f-aaa2-48d8-816b-0bdc12e752d4", "value": "T11135AE5835D120BDD837CB71CA90EFE0DB29B166D60A907660030E59990DBBECE15EFE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646122242, "uuid": "2287db90-c233-4db9-a75e-6187c1a3d54e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646122242, "uuid": "0e63a202-d1f4-4298-a6a8-1e703b88837d", "value": "24576:Y4XqaKswAtIVKaQvWA4EFrpREXhcJIQzBEtwt:YxEwAuQadAxYKJnzBE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646122242, "uuid": "a08ca72a-49d1-47a2-96dc-0e9f85209c90", "value": 1096192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646122242, "uuid": "a487877c-9c3b-4c41-bac5-b06a0c4e5b10", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646122242, "uuid": "91accdb0-c4c1-410c-a8ee-633ca442b34b", "value": "Dekont 00%122000_Gelen Para Transferi_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d4db4b3-9987-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1646156586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646156586, "uuid": "07f0672e-b698-42fe-b799-89dc88977bf9", "comment": "Malware payload (RedLineStealer)", "value": "873ca9a403832322a5fb46aa29c9d7b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646156586, "uuid": "d68dbb50-0ed2-40b3-b228-77b8c571f6e0", "comment": "Malware payload (RedLineStealer)", "value": "d1244d6fb1d1c51503fba72ada8c37af49c024b7adb5f5f24e2e91507cd7e835", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646156586, "uuid": "1baa680d-26a9-44d5-acfc-6a670010dae2", "comment": "Malware payload (RedLineStealer)", "value": "23b46d69d2472cc49a3050925730b17947c43867", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646156586, "uuid": "fa3c867c-f519-4aff-be77-0045ce18888f", "comment": "Malware payload (RedLineStealer)", "value": "2f0521312eb0b51d406a76531b8d4cfe4fa4802ee6a8da9c2dadfea2333459e216cbbdb8081147ec2c1e44c67aea322f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646156586, "uuid": "7ad55d9d-d580-4502-93ce-c9093e235dd2", "value": "T1CE649E10BE90C035E5F752F855B993A8BA3E7AA15B6560CB63D866EE17343E0EC31307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646156586, "uuid": "aabfb40d-a39f-4695-8f43-4437e5653520", "value": "803999de15851b525de7455d6fbe3205", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646156586, "uuid": "57b3e6ec-efaa-415a-be37-f42371326885", "value": "6144:BcMqGN8ktzU8uUcQW3GDNRRWQRY8TJQv:eeNLtzU8oD3GBRTgv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646156586, "uuid": "ce4e2df9-27c9-44ca-afca-1d15ba4ab3f5", "value": 333312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646156586, "uuid": "75bdf830-032e-475c-a116-d2814cb2c38c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646156586, "uuid": "47b920f8-034d-4498-b03e-3e5273c032b9", "value": "873ca9a403832322a5fb46aa29c9d7b1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26f4c650-996f-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646146321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646146321, "uuid": "47baad0a-dc0e-4543-9d59-88d4ed7d5c8f", "comment": "Malware payload (Heodo)", "value": "a728805f771c3568604ee3f5e840b80a", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646146321, "uuid": "bfec9359-b5d1-465a-8c35-94888057882a", "comment": "Malware payload (Heodo)", "value": "d163202b224cb4111b39c593c5d1b01144671984ff26b605d400dc0800356bc2", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646146321, "uuid": "7774fa00-9c3f-48b8-9cfe-43eebeeab339", "comment": "Malware payload (Heodo)", "value": "e8334d44f8b529a2afd86c21bbc8891c7e3ac28c", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646146321, "uuid": "54d2020d-f6ca-4e93-a0d2-b36cacc8c916", "comment": "Malware payload (Heodo)", "value": "75fca47bb6d71b35772611592cb9afdaac39192462ddbd002da8c8397eb63642f6f413c39c574c41641c4cb6c0166b45", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646146321, "uuid": "0486df3b-d7ce-4569-a07f-3f30a0f957db", "value": "T19D23E129C1606828C73D8C759200E6A3720A7901D9D5FB893586BB1C3B96FEB53AF5CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646146321, "uuid": "800669ba-5d16-4c6d-8ccd-7b3ca95def84", "value": "768:6yMo9DOevZCwrvtE9WzdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Uh0VP9HW:zMo9D88tT5fTR4Lh1NisFYBc3cr+UqVk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646146321, "uuid": "123bfd2f-3946-4e2f-848f-05a5839a965d", "value": 47703, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646146321, "uuid": "763cb6e0-cc84-408c-9c1d-4fdfb6d33242", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646146321, "uuid": "fa0ee31c-0a8a-456f-be7b-987ec4acda8f", "value": "info_0.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e90c385-9961-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646140428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646140428, "uuid": "d0703cce-334a-4ca0-9933-0002bd610d71", "comment": "Malware payload", "value": "ae4e766be2c17c76d22bd299fc78bca6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646140428, "uuid": "ef948362-8638-4d6b-b1a7-dbc022dcc100", "comment": "Malware payload", "value": "d165c7622a6b22443e4eaea07dd3f5f2176b84587abe8a64a1dd738d337cae52", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646140428, "uuid": "31c5b698-109f-4ef6-abeb-1ebdc9bfd8d5", "comment": "Malware payload", "value": "67f7b56656ecb4a448e02e469bd6b5f9f6db4881", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646140428, "uuid": "9fcd9449-328c-4653-83f3-36b1115c4254", "comment": "Malware payload", "value": "63a2b60f71f430a2c20da93118da86302fd886117372d87e9bfcaedafd64506787b87d2d72b77564081c5e7262b407e1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646140428, "uuid": "22757669-cbd6-4059-ae6f-401d65540eb1", "value": "T19AC38C4132D3413FE9A1967259A84A91C6EFFD212979CFC76B8C217E8C741E0173AE63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646140428, "uuid": "1149b5d4-2dba-46b4-a154-fd4a9d5deabe", "value": "971f3f0b77b45ee5dd5e2c85cfc3039d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646140428, "uuid": "7b256127-d3e8-4cf5-ba69-c02fdef0519e", "value": "1536:E+897t18ILTXXs/zruxUX1naPC2GKHaoF1aA0QrrNZHyz2p2R1B0l3O0qaUc8tKc:Yxt2ILTXX0HuqX1sVGK3Ot20BFtt9aA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646140428, "uuid": "e0a29dd7-9222-4358-b578-e7178a21baad", "value": 129024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646140428, "uuid": "68c9f72c-31cb-4592-923a-d0ee6b950302", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646140428, "uuid": "a8fac0fa-b1fa-49f3-99c6-aaf2d3c38e6b", "value": "SecuriteInfo.com.W32.AIDetect.malware2.10888.25507", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16154f60-9939-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646123100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646123100, "uuid": "b83a64fb-eccd-4fe0-9f49-2e970836588d", "comment": "Malware payload (Formbook)", "value": "14972fd711aeba372d759ff002139321", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646123100, "uuid": "39d258bc-2d7b-4527-b599-9eb8895996f7", "comment": "Malware payload (Formbook)", "value": "d30c20e0685764513feb26aec0cddb5040a2d50d4f65cf1872349d7b852f55ac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646123100, "uuid": "76ef9a81-a292-475e-9331-baa783dd3a48", "comment": "Malware payload (Formbook)", "value": "df322f3c1730fec853465bd03951d89aabd6d777", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646123100, "uuid": "98f26075-d104-47cd-bc3b-4ec5b8e8a934", "comment": "Malware payload (Formbook)", "value": "62e35228448cceb00ce1753b8e88d1d68429a1580b1217d9adcdb3f6fda165c9aa5c065156e3c7dca01f06bb5dd8f6c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646123100, "uuid": "b980fd3e-aa12-4bdf-aa7f-0050a736ef39", "value": "T1D5F4BE4838EA5039F83A9BF1DFC0EBF19B6DF221D48864F594000E555A05BBC895AEFD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646123100, "uuid": "4c70b3ef-571a-453c-93c2-474b8487901c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646123100, "uuid": "9add774c-5138-4bfe-8481-e8aa408731ac", "value": "12288:tEHiR/InZBM2XqmE80NuAB7+4sphuY8vAPFYNBVHdgvM0BdStvkisokPaqi:eqD8vA6Xz+qADIM0XSqokPaq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646123100, "uuid": "6fde81cd-6b05-4819-8ac3-5a3d2e54ac38", "value": 784896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646123100, "uuid": "ba22980a-38f4-445f-a1d8-97881e9839a1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646123100, "uuid": "f4bfd942-f1d6-4c20-81ec-aad2618daa96", "value": "14972fd711aeba372d759ff002139321.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1078c35-9933-11ec-9275-42010a9c0029", "comment": "Malware payload (STRRAT)", "timestamp": 1646120783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120783, "uuid": "a30359ed-7661-4708-b214-dfa85ddba476", "comment": "Malware payload (STRRAT)", "value": "83f59218b41a3de69e0544c6f97ec596", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120783, "uuid": "381043f0-0e14-4437-8006-e2fa3ac8a5c0", "comment": "Malware payload (STRRAT)", "value": "d38b806812c7610cc3349a2ec4b60b0fcf61a92295fe7eea72da2a255b204b5e", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120783, "uuid": "12bf480e-6b12-43f8-8b29-cf886b3540da", "comment": "Malware payload (STRRAT)", "value": "79a691407b467a4e892cfc13736394b197bdc674", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120783, "uuid": "756ba01c-2433-44b7-afd6-e6e6164245ad", "comment": "Malware payload (STRRAT)", "value": "d9b94c7484017c86aee36ecdfc34f2cbc73e4d29b2f4d16c3505b7d5e317a84baf8d20f66abad3ab1a120646ad28a589", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120783, "uuid": "045c0411-26f1-4d26-9925-dbf11265ad00", "value": "T1D5F3F16B3C6AC4D4F04B593360104372265D81ECD629902B36FD8F761E74C99AB2BADF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120783, "uuid": "dc43c7de-f99e-481a-b8cc-0b0900ecb43d", "value": "3072:VdEb5TUQUW5hajsZ+VpnJfupy471X95GGmHjTUc5FKCB5/rQoLrbNdQ:VdE1UQUUajsZqBdHmNYGujT16o5/nrx6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646120783, "uuid": "05a17a53-6511-4673-b513-fcb76bb82aea", "value": 164918, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646120783, "uuid": "84874f31-6e00-4b06-bff7-ef62bcc700d0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120783, "uuid": "0c8ce648-1ff1-4de9-b77e-11615816873e", "value": "cnf12106805..jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43de7684-999f-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646166985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646166985, "uuid": "1e903a01-cb99-46af-ad92-122bcf93ad07", "comment": "Malware payload (Heodo)", "value": "90f70bf69dd111a6d7243ded966723ab", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646166985, "uuid": "a3cb448e-e44c-4953-8441-3c6f83e92f21", "comment": "Malware payload (Heodo)", "value": "d3d6402985176034acb85ba0ff7ea33a8f3df86bcd130788d26a6fae96adad13", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646166985, "uuid": "622bc1d9-d37e-4440-a00b-b9ca18f41898", "comment": "Malware payload (Heodo)", "value": "e8fb61405a56fab9de35fc7a72e9dfaef736d1d0", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646166985, "uuid": "5fa0ff84-4dc5-4dcb-b840-65759ace6e6c", "comment": "Malware payload (Heodo)", "value": "8eb64fe41b6813fbea4e059acb127f50f0b2749093bc894a3977b36018edcaa25a31faeafe23ad108bf1c6449348dea7", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646166985, "uuid": "c4e526da-1c3f-45e5-b978-a6f644720df5", "value": "T13423D025C1607828C73E8C759200EAD2720A7D04D9D5EF893585BB4C3B96BEB57AF9CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646166985, "uuid": "5390e4d6-9e90-494f-b605-1774edae96b3", "value": "768:+io9DOevZCwrvtD608zdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Uh0VPWft:+io9D7UtT5fTR4Lh1NisFYBc3cr+UqVC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646166985, "uuid": "257c86f9-c14a-44d2-a359-2b310ae7477a", "value": 47699, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646166985, "uuid": "5ad2bbc6-b6fe-4e4e-b414-10ff47333c5a", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646166985, "uuid": "d06140ee-1c54-45f0-b035-82201ccf7d79", "value": "Open Access eBooks.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fc833bd-996f-11ec-9275-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1646146416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646146416, "uuid": "05233e85-897a-4d19-8720-7fb516b4d69b", "comment": "Malware payload (Quakbot)", "value": "28bdfa6c1359765469be0edde4627487", "object_relation": "md5", "Tag": [ { "name": "obama161", "colour": "#9F5DB8", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646146416, "uuid": "9b540349-eb19-4a42-b1a9-261229238617", "comment": "Malware payload (Quakbot)", "value": "d411e1c743aa8cb917b2d7be26a5da765d8696b40ca95923e54b82296220faeb", "object_relation": "sha256", "Tag": [ { "name": "obama161", "colour": "#9F5DB8", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646146416, "uuid": "4d973e0f-5f9a-4cee-918c-66278299bc0a", "comment": "Malware payload (Quakbot)", "value": "2dc75bf519b2d42c773059c8123e3b9965436631", "object_relation": "sha1", "Tag": [ { "name": "obama161", "colour": "#9F5DB8", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646146416, "uuid": "4fbf9318-96a9-45a5-9d00-9b0f6946b707", "comment": "Malware payload (Quakbot)", "value": "c49f01cf9b3a8c7792d09b923037c2bd2b1663b3ebe3c430b262f6821f484d6e02f9e4fd5e99654501e556894c58b7d6", "object_relation": "sha3-384", "Tag": [ { "name": "obama161", "colour": "#9F5DB8", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646146416, "uuid": "c5593d67-d4ce-45d5-a0a2-1630521a0b8b", "value": "T11274123CE2265806C718E83DC61E4EF8EA0601CA3892FA0B56D47A5D7DB65F35FDC198", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646146416, "uuid": "59d29bf2-26e9-4b92-b750-d8ef67c1b981", "value": "6144:vO2Vjy1WyndEXJF48WIMpuqaqj9NDsA/DUzYeeKjmFQHL:vOoy0jnnWIMpucj9NsSQY/KjmFQHL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646146416, "uuid": "e77c0721-3abc-4abd-8a63-006bf0673d77", "value": 341177, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646146416, "uuid": "789c83b2-fa29-4b7a-9ebb-02de10d23492", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646146416, "uuid": "3cec9f50-fc02-4dbf-a610-b371e5089db1", "value": "Srv-Interruptt-1002649912-Mar-01.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d19b3f7-996f-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646146331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646146331, "uuid": "5ce8ed8e-0eae-4cf1-9380-4108ce665c54", "comment": "Malware payload (Heodo)", "value": "df3b783e575c47debb694b33f3485d66", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646146331, "uuid": "c6ddde47-397d-4e98-aacf-08135cbfb741", "comment": "Malware payload (Heodo)", "value": "d56d6c38f6338fcdb208d670bb04a7f73d96122905afaa3da1e2da215548cbfa", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646146331, "uuid": "5e7a9b28-a9ea-45f5-aea2-e42c34a1074c", "comment": "Malware payload (Heodo)", "value": "c25c96ab2e85af07232dcebfbaabb79d761f9c75", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646146331, "uuid": "b8998f2e-6767-4b64-bec6-49fbe57389c1", "comment": "Malware payload (Heodo)", "value": "703e19439b0a123ec19cf89ebca320f3074d3e05970bc62e0e4158eb2fa0da4428083fa38c57ab9bcce08dfcb37f53d6", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646146331, "uuid": "1ddd03aa-e454-4d7b-92ea-5a806c25277e", "value": "T14213E029C4961A9DD737293DD6148EF4124C0E4A96A0FD8F1D44A3AC276A1FB0B4FCB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646146331, "uuid": "946f8b83-45a8-49b8-897c-288bfe75316b", "value": "768:Tomihd8DOevZCwt79yKfcrND59V+L9Rw4eWrXcTqZ0VfEw/5:Tom8eDNylND59V4jwmXc2CVfEA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646146331, "uuid": "34d0578e-a8b3-43cd-af13-8fa332a863dc", "value": 41813, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646146331, "uuid": "7e861509-1394-4a2f-b2ad-e7b0ebd77d25", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646146331, "uuid": "e9aee3d4-bf88-4132-a904-1341667b3565", "value": "PACK_7.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3be284ad-999f-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646166972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646166972, "uuid": "3da52a28-9195-409f-98ec-b333fdad476a", "comment": "Malware payload (Heodo)", "value": "9ec4ca74ba039a799214c7b2fe639c80", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646166972, "uuid": "4d33785d-abc0-41cf-98b4-e54cbb538ca0", "comment": "Malware payload (Heodo)", "value": "d63e1fd25bd486d7fb8971501cca66c8db61822d3854a03414d0bc9a72dbb490", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646166972, "uuid": "2fca0902-4ea1-404f-9a57-b6471d060199", "comment": "Malware payload (Heodo)", "value": "be3d82366e40c27a81da787cdb9e08881b8dcc6f", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646166972, "uuid": "4f3a4447-3892-44e0-8b26-32e61188996e", "comment": "Malware payload (Heodo)", "value": "6ce0f3e18b348deaf377fb72a9dfb20888298426b52ebdac680a8694f6c160ecaff0a2769d3ac1e880ea17ee7afe7f63", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646166972, "uuid": "ba343324-1c5e-40d3-82b9-aa011b88fbb5", "value": "T1D823D025C1607828C73E8C759200EAD2720A7D04D9D5EF893585BB4C3B96BEB57AF9CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646166972, "uuid": "bdf45725-61ad-4bc1-87a6-46f9c65affda", "value": "768:Cio9DOevZCwrvtD608zdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Uh0VPWft:Cio9D7UtT5fTR4Lh1NisFYBc3cr+UqVC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646166972, "uuid": "2e529085-dfe8-458a-9350-d2d604c175d9", "value": 47699, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646166972, "uuid": "1053fa55-e261-4166-bd9d-c29928987598", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646166972, "uuid": "f722d2b6-f183-420f-845b-e6b8fe606310", "value": "Ommega Publishers_1.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e008247-99a0-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1646167432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646167432, "uuid": "6e08c33f-73ad-48c4-b9f6-be548acfee7c", "comment": "Malware payload (Mirai)", "value": "764afa931ee8a0b427f9e7e1a520c63d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646167432, "uuid": "be2df81b-3564-491d-a9fe-63a4e468b3db", "comment": "Malware payload (Mirai)", "value": "d6433eb7865c278f5dcb8be92c642cf36bad24487df38e4bf882b1d83506ba90", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646167432, "uuid": "a1edc5ff-f1df-4244-b474-9c4ee0f3b9d9", "comment": "Malware payload (Mirai)", "value": "a44c1c0902d407c15b2b5ffeacea46382b754549", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646167432, "uuid": "6ea49d42-14df-4cec-ba37-6c6cb63d7897", "comment": "Malware payload (Mirai)", "value": "117bf2108a6ef3ad10ba8b7e215f3d44c3b2d6e84255d0088f511db3518e2722db1fc4a486355079754c1fcf44ac53e7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646167432, "uuid": "e5aa40c8-608c-42d7-9bb9-8c7ad34cf607", "value": "T175A2D021668BA064EFE05837A0BD1172FF098475F45672FD232443A5DB6A9034EF934F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646167432, "uuid": "0ee01f9f-615f-4287-ab54-63b0e867e687", "value": "384:GnLU1BwCVEO2/Tj2HPft8IcJhzFqiQc+TiIrUSx16rDAmdGU5Ewd1:UYlV+rj2HDeFqiFYrUSxorE3Ubd1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646167432, "uuid": "3eea1206-e97c-43b5-90cc-aef72f95013e", "value": 22196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646167432, "uuid": "643c24ae-0aae-4cf8-9775-405a96be0801", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646167432, "uuid": "f8e15533-f410-46af-a589-785ae7670a0b", "value": "764afa931ee8a0b427f9e7e1a520c63d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f927c75a-9940-11ec-9275-42010a9c0029", "comment": "Malware payload (OskiStealer)", "timestamp": 1646126487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646126487, "uuid": "94d9fd63-e7c5-4006-85bd-9de5cf43b533", "comment": "Malware payload (OskiStealer)", "value": "c38fb20d6d21162311412e98ce480a7e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646126487, "uuid": "5d57c2b3-b5fd-42c1-86be-f82c1411aaf0", "comment": "Malware payload (OskiStealer)", "value": "d8454e6022d16c264f078c2a0b925dc70d08edd251dc6e86f1af4b24afd46bde", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646126487, "uuid": "a0e3951b-e9cd-45ef-8c76-ebbe7ba33c76", "comment": "Malware payload (OskiStealer)", "value": "e1e13c0573045d8e48c6e95fb7e6feff324d3836", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646126487, "uuid": "6729f60b-4018-4e87-aa09-4b506926b7eb", "comment": "Malware payload (OskiStealer)", "value": "d0e969e736ae9f984109ce26d504404bf8027830d4790d32365dcbebe2bb00882328eda99db4912d2b05e1bc79d37c3b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OskiStealer", "colour": "#82739E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646126487, "uuid": "1213b227-26c2-45a0-a6de-997491ff32c9", "value": "T11764224725E6843BE3E31C7261B662FEF3F5561891A85C0747617F3EAB358CA23094CA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646126487, "uuid": "f9e05d9e-ec27-4411-af2d-eeb690ee671c", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646126487, "uuid": "47b5b211-7d34-490c-b191-c06f4fab1573", "value": "6144:rGiQ+/Zdn4WFwxVjhq9esAd4XEYv3EUSs+CjHIZZY+2eZhQP8:s+/H4/q9evd6Jv3EPs+6I7Yeu8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646126487, "uuid": "f5ba4308-b3b8-4e9c-aba6-9a990197e483", "value": 306548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646126487, "uuid": "80ee8c5b-feb9-4535-8f41-1111ec261ae5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646126487, "uuid": "5734b555-c9fe-4613-93b4-32126ae9345c", "value": "c38fb20d6d21162311412e98ce480a7e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18ffda5d-9998-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646163907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646163907, "uuid": "6c0addd0-d995-444d-bca1-fbe2f28765c3", "comment": "Malware payload", "value": "186ec54b52e2ca24990f4e6cb5f4c86d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646163907, "uuid": "0bdbd32d-ef20-4cf0-8ffc-b2676f736816", "comment": "Malware payload", "value": "d884436a17d35656ddeae1a06103d0b787d9f22851fedba571293898f6fd3645", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646163907, "uuid": "ee6117f2-688a-46c7-a1f0-cca638430962", "comment": "Malware payload", "value": "f897f0ece493b818397fc8f0c6f9e6201982f9ce", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646163907, "uuid": "57fc5257-d749-4cac-be2b-ed6ec1519ff6", "comment": "Malware payload", "value": "2cfbe9c3470762c2f25a6903924e560f67f2a2774009541a438b2484203e061b7cd417257e22bac762013cc1a0954dc8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646163907, "uuid": "c0d076ae-603f-4ae1-90f4-5ed4cff1ccec", "value": "T1A6451240B6A0D03EE0B751F4797A93ACA22D7DB16B3056CF52D62ADE56742E0ECB1307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646163907, "uuid": "b68c79a8-8662-4a84-8e46-94817514e8ae", "value": "26b4d512596063f87f095ddd2779dc70", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646163907, "uuid": "a1b20322-0ed1-4d89-a2d4-3dc20aa8128b", "value": "24576:7ADt/dByI01T/fslLidpxa0MePKE7ffkxyn/p8ou6pu:7S+T8VqxkE7ffkzoVu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646163907, "uuid": "00b2127a-8426-4aba-a0bd-e86fd6ee8de1", "value": 1255424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646163907, "uuid": "6ecb844a-540c-445a-be30-b22e70d586a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646163907, "uuid": "2d8953e8-6bb6-440b-86a8-f46a5204e828", "value": "186ec54b52e2ca24990f4e6cb5f4c86d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68ecf4c4-9984-11ec-9275-42010a9c0029", "comment": "Malware payload (Matiex)", "timestamp": 1646155451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646155451, "uuid": "a8c83682-9944-4a34-822a-45ebbdc529ba", "comment": "Malware payload (Matiex)", "value": "b4fd099f95248286fb005d5fc93399d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646155451, "uuid": "8671a9f8-80e4-4d54-85fe-fb546411f98b", "comment": "Malware payload (Matiex)", "value": "d8924e2835e52e70b5c4fa4fa0a91e9b06776f778d065d62773a4564586d486c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646155451, "uuid": "153f09be-3aaa-4bb7-8e56-a0be94d9e532", "comment": "Malware payload (Matiex)", "value": "4fca12d0d25a2115b5958de3aa9830f36361fbbb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646155451, "uuid": "f0c7c29e-e216-4c8f-9f43-3fc29c48ea8d", "comment": "Malware payload (Matiex)", "value": "ff7f7a043e0bae82eb6f4ac0ea8b87cb0972e36e7eb61a4e8a3e02fea6ba8dc02969a232962c96ae2b43ddbedf03b2d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Matiex", "colour": "#AE3DDF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646155451, "uuid": "c0a00cc5-31a7-4980-b629-05e12487327c", "value": "T1F3A4029D722075EFCC6BC8728E662D64E714787A531B8613946739AEAF0D987DF000F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646155451, "uuid": "a0b93551-fe62-4f55-9521-4f18d83bd4d5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646155451, "uuid": "181ade08-2e86-4b59-8f60-8a12223976cc", "value": "12288:CyJGHXM7jgp1VO7F575xNM8t1kkDZJeIQBu1X:ZJGHXyk1o7F575TME1kke", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646155451, "uuid": "16a2b522-6fa6-4596-9e5e-07401c4c827e", "value": 488960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646155451, "uuid": "357e56a0-ed60-4d3f-aa6c-2090e54d6ceb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646155451, "uuid": "5f8cb3b3-1a6c-481e-841a-c61944a87c89", "value": "b4fd099f95248286fb005d5fc93399d9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2198412e-9933-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646120542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120542, "uuid": "0bae418e-bfc0-4c50-a85b-273fc9c31520", "comment": "Malware payload (Heodo)", "value": "c5fac831188c437a1d66663bfa055780", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120542, "uuid": "d34f94e2-e39f-4783-a2dd-006ba6af93eb", "comment": "Malware payload (Heodo)", "value": "d907b7bc1bd3505c152f70643fc5a7ef2d3e46de49dd34f54819de23bbf100bc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120542, "uuid": "31b9f0e8-c075-4cf1-bc66-fe7288aabd90", "comment": "Malware payload (Heodo)", "value": "facb29f0e5f8d44f64fa40f5bf2748201abd1848", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120542, "uuid": "bd38c072-8f0c-49f4-af13-d552eac20a39", "comment": "Malware payload (Heodo)", "value": "7c43a82d812b3a615b30991ce05faadc7ee0baa1220a8769cc58eacb69d1fcf060ab4160990a4758ab62b02d75fc4088", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120542, "uuid": "6b56964b-900c-47b8-81d0-56e8caabb8f9", "value": "T156D47C82F7429EF2C00B03347C32B2586BADEAD5D2158D6B9398A5AE1F35573493DE43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120542, "uuid": "bbbe09d1-8733-4c1f-816d-4ff431a7770d", "value": "e0b213ccd96f46d30dcd8e225f4e9fc9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120542, "uuid": "21bcb651-dae2-4847-9b00-f3489686ec7b", "value": "6144:XjPgWGbb0OEmS9Vzf5WI9nI1LSfcaDMyhKmZHNRuIfv7YtaIIo0cm59CH7PQ:X0bEtf5WyI1LSfcSfxhstaICRLmrQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646120542, "uuid": "3fc39ce9-32ba-4f6a-9693-38b3c6fc09c0", "value": 602112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646120542, "uuid": "098e86db-7870-4160-aed1-687b96a9d1e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120542, "uuid": "2da70eab-e9f4-4ba1-8e7c-00fa9c2e3d76", "value": "c5fac831188c437a1d66663bfa055780", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e290f56-9937-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646122469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646122469, "uuid": "5934be33-ac71-4b48-92a9-6b9e13d935f4", "comment": "Malware payload (AgentTesla)", "value": "16ab8bfb52c65e220cb79e98f919765c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646122469, "uuid": "e6e22fad-89eb-4468-b40b-0cb2b2549537", "comment": "Malware payload (AgentTesla)", "value": "d9ea0b78760df096a1be005cec699a167d7d1a7cbce5b9895f1ac4ec3e067499", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646122469, "uuid": "eca98e68-1caa-45f8-98d8-75099904a564", "comment": "Malware payload (AgentTesla)", "value": "3f2fb7030ffb2ef6a1e8db86cda4a32a809d3935", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646122469, "uuid": "6a8f91f4-d9a6-42dc-8188-b4a701a05c69", "comment": "Malware payload (AgentTesla)", "value": "9c7f21059ec7f732864bec419977b735f5b5bdbf60b874ad8e440c983ebb1000589ca8dd5379271e6518bba07065d108", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646122469, "uuid": "3cd96383-3914-41ea-80f5-3330368a6f34", "value": "T12605CF0839D65039F8369BF1DAC0E7F1DB6EF221E48870F558000E559A56BBC894AEFD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646122469, "uuid": "ee18ee47-22b0-49ba-a5c8-79297aadc8ca", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646122469, "uuid": "e48e6b0e-2dc8-43d6-823a-273268f1a975", "value": "12288:ZE0FR/IFU3GTBJUimni+t7VEXu3bOydQhbNGprcxEwd0IDymxOTVpy2:f3Bimh7aUJQhR/Rumej3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646122469, "uuid": "2184a278-29fa-46ee-a4d9-359852c81399", "value": 820224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646122469, "uuid": "c44c7025-5083-4920-80cc-0d3d29c8b4b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646122469, "uuid": "8ac0e841-9150-404e-87e9-b0d0b93e0bfe", "value": "DHL SHIPMENT NOTIFICATION 2847483951PD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5746a9ca-99aa-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646171742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646171742, "uuid": "878a7301-44ec-485a-ad47-2a7a1c7d27ac", "comment": "Malware payload (AgentTesla)", "value": "30b92b8aa623638e68252f39029d9f4b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646171742, "uuid": "a501f915-bc9c-402c-b630-64207daa0a20", "comment": "Malware payload (AgentTesla)", "value": "da2f769ddbb028967dad6a27b434d72684ec8ca34297756d9c43d85fb7396c13", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646171742, "uuid": "3a5de59c-6362-40f6-9898-b5d3f05107ff", "comment": "Malware payload (AgentTesla)", "value": "9f224d1ad3d3c3e57d38095a448d8bf01ade6d8e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646171742, "uuid": "27619aaa-6577-48ef-bc7f-72b11c6a5331", "comment": "Malware payload (AgentTesla)", "value": "4500e96675c6ed5d2102f29696bd2c6d6899427f3520f8476b84a697386ac4e032f4a65368ca4eb371ef92d67a1c8ead", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646171742, "uuid": "a4171bd6-6649-42a3-9279-183cb25e56ea", "value": "T1F0035D1EAF7C8510D294DB3BABA3C1F84270AF52FC46D98B64D6BF4A74F2B448621135", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646171742, "uuid": "4c2cb677-bc38-4b2f-b03a-d8e1b9e10a2c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646171742, "uuid": "6ea91314-127a-40b5-a825-3cab0fb1e2b4", "value": "384:JIScWR9cpaV8MlSXHPHnYPHktGsPItg3xC3pmedELVseJaC6Sxwwwwwwwwwwwww3:JISFEmMvYPHkosPMgwoeO6eExQn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646171742, "uuid": "20aac2db-55b4-4090-b323-737430e5ab60", "value": 38912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646171742, "uuid": "21408995-d61e-44f0-ac3a-6a99ac1a93fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646171742, "uuid": "a915962c-3d29-4299-8db4-8f58e4971d25", "value": "IMG_061000786300.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11b4b2fe-9934-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646120945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120945, "uuid": "6d25860a-d73d-4a4f-bc7c-5b15f9f8bd1f", "comment": "Malware payload (AgentTesla)", "value": "b0e1c1f413c9dbe31f7b1570e69abed4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120945, "uuid": "1e255a58-2483-4b41-866c-07ae42a74b55", "comment": "Malware payload (AgentTesla)", "value": "da66e54f43301eff1e3a28e179852ce170cf1eb7cf1f82fa65abfa01aa1f844a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120945, "uuid": "01315f04-e7a6-487b-800c-d3623424d2f6", "comment": "Malware payload (AgentTesla)", "value": "c29520a1f24921edeed5d7caca84317151b45daa", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120945, "uuid": "57257dd0-9614-4153-9a33-2e95ce925a41", "comment": "Malware payload (AgentTesla)", "value": "b0687d77d70ab55973b7fc1b2671ea45bd10d3342a9a4140871f2fd824ba0adaa7f1a14889ab1aeff8be7f66029a5653", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120945, "uuid": "53d6fdce-c2a1-4a2a-8622-07d3345745fc", "value": "T171141221E167D015D23D89B52AE2D70FFE307D3A4FE381166354F7832A3E8695C47A89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120945, "uuid": "66e31e1d-bddd-407f-8f37-60284d6de9cc", "value": "3072:Mob0WdpizPyH2Jxhe5nFn/y86JiNePMhvh9Hw86uNYqFrWZ67HQ+0C:zwzzPM2LwJF6LJMePMVws1YZ6k+1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646120945, "uuid": "323e70ff-e10a-449e-9010-8c1ee43a6476", "value": 191096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646120945, "uuid": "87f599d8-89bf-46b8-9624-27a64b8ec6af", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120945, "uuid": "92ff5f35-1a94-409c-a0fc-9f96230c7c34", "value": "Our Orders.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc1681b9-99b1-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646174945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646174945, "uuid": "f4598aa8-cc53-4e3e-ae43-49c162655b0b", "comment": "Malware payload", "value": "98cb46e2b94d0c1447257d89fae57da3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646174945, "uuid": "2193c917-6541-4363-9233-4009ef226267", "comment": "Malware payload", "value": "dad901a594b3593d3fecc4e3e3c4cd5a31709e61843d3a7c605233e35eeff13a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646174945, "uuid": "fea0707d-27a8-4fad-a8ce-98dc169d44b8", "comment": "Malware payload", "value": "6e2a85071554a03fecea9be21a1770a94e30be35", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646174945, "uuid": "ff621c33-4eba-4a13-b1d7-ae17acfb25dd", "comment": "Malware payload", "value": "3b975a01e6e79aac6498c2c52a3f332fe185c196af91c7bf28c50d7977ac96797a2f39fd152f23ad6b989b5e98d01984", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646174945, "uuid": "93c4a3a8-6ce7-4b4b-abd7-6198e7ea4e81", "value": "T102B4AE11B7D0C072C26A35342926E7B656EEBC719AF583876FD03B7E5E301D18A2835B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646174945, "uuid": "a8f5b04e-6791-46c0-ad9e-dacf25b3c2cc", "value": "d02245ac5c961d83d0907c826d8ba5c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646174945, "uuid": "bb1cbb28-f093-42f1-8a32-8ede9c401389", "value": "12288:JhC1q3aXOwkiPs2iCtyjxOAIlgOkar//wJY8Itgm:Jgq3aFkiPs25ax2Bkm8jm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646174945, "uuid": "d32b9a4d-9a10-4f85-9a85-c637320a7637", "value": 499712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646174945, "uuid": "3cc2d1ac-be5a-4fe2-92fc-0a21953a9403", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646174945, "uuid": "6b1b9e27-e4e6-4284-88b9-e8f5be7b8ca0", "value": "98cb46e2b94d0c1447257d89fae57da3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0616d3b1-9920-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646112336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646112336, "uuid": "5ad4ff49-af8b-4b94-ac4c-4d43889ddd4e", "comment": "Malware payload (Heodo)", "value": "bf49f7686652f7be544eec8f8d7892e8", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646112336, "uuid": "9bd4fd7d-997e-4176-96c5-02f2b4712a4c", "comment": "Malware payload (Heodo)", "value": "dafa345b9d73f9f4bffb95ad3954f5ce0fe48aa1ef6ec818237618ab26eed306", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646112336, "uuid": "5397cf86-b8bc-498f-9b62-32817cb979c3", "comment": "Malware payload (Heodo)", "value": "b5651d2e4df9b9c952eb58586de7a12d7b7c822a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646112336, "uuid": "3406cc58-2737-42e9-8078-985af867ef34", "comment": "Malware payload (Heodo)", "value": "12ede0b955c7ab73a266ecb41bab8755bf62efca95725ad68a5af0cfb3058ffaf0f8521e1ddb4e932e59aad59b93c98a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646112336, "uuid": "ed0ffd88-6e70-42e1-b03b-f7b99625cb2d", "value": "T139B42902A612F13DC28FA0754D016A65D0AEC8E5277177E39FAC87C916E7192F12DFC6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646112336, "uuid": "6e82a20e-d6af-4807-8f26-68aab34f9236", "value": "5b43915e0b600e2321d29702480f3853", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646112336, "uuid": "e62671ca-518f-4b7d-97c0-e4546c3199a2", "value": "12288:IOzyEtBX2ZHq79+c6/G5YgvmgZDa6A9TU:lnmZKR+MYzglab9TU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646112336, "uuid": "e1a45a0f-a57a-407d-95d5-aa65a480027b", "value": 512000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646112336, "uuid": "f5bd6038-732d-405c-a0ef-9962e7f8e396", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646112336, "uuid": "a3011016-69b0-4c50-a1af-3c4ae6ff63d9", "value": "f8cking emotet again.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8f39f39-9977-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646150029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646150029, "uuid": "2ad3b2de-670b-4148-839b-f933f424f94f", "comment": "Malware payload (Heodo)", "value": "5d0c5be215dfd2e78abca791922b2d53", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646150029, "uuid": "7dd01365-f953-46c3-9654-4299a396dd42", "comment": "Malware payload (Heodo)", "value": "db5730fbe4093d668ec646f6d91717aec22508964c6b3b4ffcf0145693d9e18a", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646150029, "uuid": "947d37cb-39b4-4e7d-a2aa-a157befbae0f", "comment": "Malware payload (Heodo)", "value": "7c0b975b2e3dc9c9aa3cf23fd24252b9e08d04dc", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646150029, "uuid": "b9b6a615-576e-4bc2-b5b0-364e509e6afb", "comment": "Malware payload (Heodo)", "value": "530af58f5fb8f1a6c7c36eceb15c37bc96b64a6753995e539f8e73d190534e202d2efb7662607d4cd65593042ebecdd4", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646150029, "uuid": "39a019b2-0d04-48c5-9c5f-7e5964c81fe6", "value": "T1B323D025C1607828C73E8C759200EAD2720A7D04D9D5EF893585BB4C3B96BEB57AF9CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646150029, "uuid": "2bc35319-f7c7-46bd-8548-d2842efbed53", "value": "768:iio9DOevZCwrvtD608zdDTKufT9nz0LTyY1NiMZFYpvrLeci3cr+Uh0VPWft:iio9D7UtT5fTR4Lh1NisFYBc3cr+UqVC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646150029, "uuid": "97cf2bf3-ec52-4408-966f-3e491ffbfd50", "value": 47699, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646150029, "uuid": "4600bd4e-96ba-47c0-bd08-2b7e4a3a71e2", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646150029, "uuid": "b7090622-66c8-4ec6-a295-1f81fbc821e6", "value": "Ommega Online Publishers.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5488b7a1-9936-11ec-9275-42010a9c0029", "comment": "Malware payload (AsyncRAT)", "timestamp": 1646121916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646121916, "uuid": "a1aa247e-4197-4bfd-b9d6-7be494d18352", "comment": "Malware payload (AsyncRAT)", "value": "aabe9da7828470a7c779b3daca1ef7d3", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646121916, "uuid": "a390a431-9c43-4582-bd4f-cccbb48ea03d", "comment": "Malware payload (AsyncRAT)", "value": "dbcf11ebb8b378e9a0e87b74af4423bce050f66263e1ed3e971779152a3f43f8", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646121916, "uuid": "02d4aec6-8f9b-4251-bd77-5c52199d70a5", "comment": "Malware payload (AsyncRAT)", "value": "8009609e55a9f08cea09c3760a84d2797f55f618", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646121916, "uuid": "752cab43-562f-4010-8994-c22bf4fe9e0e", "comment": "Malware payload (AsyncRAT)", "value": "8c238a888144d98d75b8b5debb3263ee7231a993c10af1c1e54cad3de6ae9fb116891957e51b1c8e81d026888fd8ad38", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646121916, "uuid": "1b3d3aa3-6edd-4db2-9670-b4f5f5fcdac5", "value": "T1CF43B12C014FECE713499E5DC9764A5638E7227B3D9FA27CDB55076A22FAE8F021C850", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646121916, "uuid": "1a387bd4-73b6-4748-9d41-fc026d459348", "value": "384:nWuAhpUq7qubmQRV2imMbynEvM5oHgH4HJHcH98H/bvto7304cI:WreeRVLrBHgH4HJHcHOHTFwhJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646121916, "uuid": "44b5d41c-f917-4218-864a-999d1766168c", "value": 59339, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646121916, "uuid": "628d0a7c-bb16-4882-ac43-056b34389f89", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646121916, "uuid": "65efe857-150c-4c65-a99f-29b6bf73ac8a", "value": "DJDPR282715.VBS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd799762-992b-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646117368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646117368, "uuid": "6c48b336-fd28-43c4-815d-b3eec462a3ef", "comment": "Malware payload", "value": "f0a1f3711d3cc422da4a06c4c5a5b3f0", "object_relation": "md5", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646117368, "uuid": "a38757e2-9903-4f29-8af6-a8cd7e00a893", "comment": "Malware payload", "value": "dbd1798362d760d65683992586bd02881f95cc0d72c81362e4fddbc48d8e14c1", "object_relation": "sha256", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646117368, "uuid": "55b94767-6c22-4021-ab3c-b43143e33de8", "comment": "Malware payload", "value": "b0958fd740888f992a62c323bbde56202638460b", "object_relation": "sha1", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646117368, "uuid": "1b7e3cab-67b5-4951-b7ae-a729cc0c9b3e", "comment": "Malware payload", "value": "c90ffce168af4acf667e37e2ec662e0ca2b1aabe5544468b8ef11eb8df3a082b1855ea91172e8031823d924347d844ad", "object_relation": "sha3-384", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646117368, "uuid": "b55f58fc-1b9d-41c5-8274-b4092a9aa99f", "value": "T13713BF14C1126509C2B3A53DD838C4F61C6ADC1762244D8FE5DAB9470BA4FBB274EBC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646117368, "uuid": "cc9758d7-b084-4668-b7b7-eb705a31e5bf", "value": "768:BZDRD4S0JS00SneSnjS0yS03S0IMS0bS02ScxbV+cUs70Nn2srTpxKC6yDsfudHs:XVMVU7N22Tbwy40zVMMAZTSAo1/K8NyZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646117368, "uuid": "66e37bab-5ef2-480f-8e23-667cc8162f30", "value": 43644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646117368, "uuid": "684ad338-31d9-4e0e-b790-38a9d92264fd", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646117368, "uuid": "c90dbfdb-7f4c-4ffc-8e94-934379ca7148", "value": "Invoice.pdf.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0ef1e6e-9990-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646160806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646160806, "uuid": "8081ad84-10d7-4a01-a7ef-8f995de78440", "comment": "Malware payload", "value": "8f2e60f03e8b082554f8d84bc4f50655", "object_relation": "md5", "Tag": [ { "name": "obama161", "colour": "#9F5DB8", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646160806, "uuid": "1145db19-621e-44cb-81d7-d6a31df66db3", "comment": "Malware payload", "value": "dbf6f0b873d407f6503d8ebf9b7cc92a95d7d7f8eddc0dc5975c4c2db2d777bd", "object_relation": "sha256", "Tag": [ { "name": "obama161", "colour": "#9F5DB8", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646160806, "uuid": "83f3ea5d-8009-42b3-a5f1-b890011ad35e", "comment": "Malware payload", "value": "47262e316a6dabecaab9f7926b690bf8ebb5d11e", "object_relation": "sha1", "Tag": [ { "name": "obama161", "colour": "#9F5DB8", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646160806, "uuid": "5131831c-e265-4886-ab90-f11b7cfa59cd", "comment": "Malware payload", "value": "0c5506e2048927fbe4f586d311f20dee2dcd150d18aefffe85a8043ec154e8d5d630c6fecad4d47cdd340aabf83515a1", "object_relation": "sha3-384", "Tag": [ { "name": "obama161", "colour": "#9F5DB8", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646160806, "uuid": "22744768-20d4-48bc-aa33-6cd62ea81a86", "value": "T15274123CE2265806C718E83DC61E4EF8EA0601CA3892FA0B56D47A5D7DB65F35FDC198", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646160806, "uuid": "f6858e18-264f-4da5-b416-00316bf8467f", "value": "6144:LO2Vjy1WyndEXJF48WIMpuqaqj9NDsA/DUzYeeKjmFQHL:LOoy0jnnWIMpucj9NsSQY/KjmFQHL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646160806, "uuid": "6be25455-df25-4129-a40b-b07bebe47d63", "value": 341177, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646160806, "uuid": "d2ec24a3-f0c4-40f7-a0fa-e4ab08b29308", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646160806, "uuid": "a4114a54-d12f-4543-9cfb-3b57ab88c66b", "value": "Srv-Interruptt-2065311479-Mar-01.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf4d4a26-9933-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1646120834, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120834, "uuid": "9f145f72-91fd-43d4-afdf-8a79ee7ab74b", "comment": "Malware payload (Loki)", "value": "d5f99fd0660edebbaa75274158809ed3", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120834, "uuid": "424d62eb-17fb-4b25-a541-b10805d91b34", "comment": "Malware payload (Loki)", "value": "dd88037bb810f3d7a98ceb240d0c899a6d2483691f35dca742e8f7eac5ac4c27", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120834, "uuid": "0c605064-9818-4d77-abed-41853ab340fd", "comment": "Malware payload (Loki)", "value": "f160a2d11c718f71621b9c58669d668a586b1923", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120834, "uuid": "67e2c975-2429-444a-8c1d-8e0536ad7473", "comment": "Malware payload (Loki)", "value": "643614c0cebcb47bdf477733c0c3a0c777270f96710fe8c67bc18f9cab3e5dca61c70dc62bfd38ca6a653dd433a5c433", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120834, "uuid": "000d751f-53f2-4ff6-8023-017c675ba262", "value": "T1EF14120ABD55CB90F452B9B7BD928660239CFE6A4681310531CB79250E3DB670C7EEA3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120834, "uuid": "1df72afa-6f8d-4321-b5c0-ea109e8e0fb6", "value": "3072:iDQcrK14M0TYWOhTNaml420IuWfzQZGJ4agmerK5j6kDlXYfz4QTNihi:WQcu0TYW+TNami29fkZGP55jLDlIf8XE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646120834, "uuid": "a926522b-14f5-493f-9ac6-3250973b77f1", "value": 190456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646120834, "uuid": "aafa5b90-ffa2-4b99-b56e-b351d96e396c", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120834, "uuid": "eb1dd832-532a-4bc3-a359-066389929cda", "value": "REQUEST FOR OFFER 28-02-2022.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b53e9a2e-9942-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1646127232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646127232, "uuid": "96c6efc4-94ea-4d47-9a19-f5c742730e4c", "comment": "Malware payload (SnakeKeylogger)", "value": "95de69fb0d53747efeba8300b4556b5e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646127232, "uuid": "d27ec78c-40d0-4119-862e-690160b21110", "comment": "Malware payload (SnakeKeylogger)", "value": "ddb4e3c01cbc9d2d1b5ad5d8299b404ba28b0215b50c0447990fcc79c62708af", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646127232, "uuid": "56d2e257-c470-4856-a172-534e40e0ca7f", "comment": "Malware payload (SnakeKeylogger)", "value": "e8767e06a635b98344eea013327b96f99703289b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646127232, "uuid": "3dfc1a22-4458-483b-ae0d-b1139079127d", "comment": "Malware payload (SnakeKeylogger)", "value": "e13e7d6cfc3bd2751a1a3af0cf6a7f85fe73a1a649ab85945f96087517db14d1da4b2063b0c676974020b201f5fe8014", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646127232, "uuid": "fd0a9374-e6c7-4b96-9ed2-2eddcbb97ee2", "value": "T10673B1A1BE84F629C1266C32CB12DAF5C127BD27DC609A537CC87F1F7933642941172A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646127232, "uuid": "97bbe684-678d-46ba-9d7c-02a737f98dfe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646127232, "uuid": "2ff2e781-9daf-4154-bcda-e208bbafa267", "value": "1536:P3JmQU+iopiA+bHq0R4Co0s7yj7c0q12:P30YzCo8/c0q12", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646127232, "uuid": "e330cf4f-dee0-4b08-b8d2-1197843fd131", "value": 77312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646127232, "uuid": "3993387c-cf9e-4bab-9f56-f9a6c53832b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646127232, "uuid": "e5dddf7b-cfac-4162-b289-35311c78e71f", "value": "95de69fb0d53747efeba8300b4556b5e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df4ba959-9942-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646127303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646127303, "uuid": "b267b3a6-bfcf-44b9-8270-401d18c4c88c", "comment": "Malware payload (Heodo)", "value": "339f8a7eed084e1bed9fdffdaf0ff229", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646127303, "uuid": "149303a0-c1a9-4509-af88-8b426ddbb47c", "comment": "Malware payload (Heodo)", "value": "de87420d98493a52694d94a9b6e982cb221c168d87dc08b5efc14c3174308761", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646127303, "uuid": "0f1a516c-6f71-43b9-b107-89cc445a081b", "comment": "Malware payload (Heodo)", "value": "69f9a796dcaf6feedca5065606101889dabbf363", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646127303, "uuid": "eb1b0f78-bc3e-4a61-8bf9-42eb6eb8bbd5", "comment": "Malware payload (Heodo)", "value": "7c30909aeba3904c9d9de595a345d99a3cd1c92d3c8d265e5de65e70bbb77ee3e71e8cba4a4bea784a1e6687a1843024", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646127303, "uuid": "cfa1f620-39f5-43a2-bd62-7767bf770e1b", "value": "T1DF13E029C4961A9DD737293DD6148EF4124C0E4A96A0FD8F1D44A3AC276A1FB0B4FCB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646127303, "uuid": "257c9b59-b47e-4a80-b43b-68e33a0f3825", "value": "768:jomihd8DOevZCwt79yKfcrND59V+L9Rw4eWrXcTqZ0VfEw/5:jom8eDNylND59V4jwmXc2CVfEA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646127303, "uuid": "0558b222-6414-4d66-a715-e9b828298c8e", "value": 41813, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646127303, "uuid": "dc9b3756-05b5-48ec-8955-fe688c536f5e", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646127303, "uuid": "8b977e1e-e375-42e2-8484-e8ef6ee4223b", "value": "MAIL_0103.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0656834-9995-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646162926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646162926, "uuid": "ffaa2858-0126-411a-8f4a-765fbd0abe4c", "comment": "Malware payload", "value": "2584e189ec7c8d03a2e13615585e16c6", "object_relation": "md5", "Tag": [ { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646162926, "uuid": "526cb434-234d-401e-ad52-96b73d8f8254", "comment": "Malware payload", "value": "df42d0949fba72e0bacb12ea2bcbc1d4a94da6b7d68f4001fe79c1c02a64908a", "object_relation": "sha256", "Tag": [ { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646162926, "uuid": "84bf8599-1228-4d62-a8ac-ba01250306bf", "comment": "Malware payload", "value": "03cb96a77c1895fd575fdb4bf7e3198c5059ad6e", "object_relation": "sha1", "Tag": [ { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646162926, "uuid": "ca621d20-e7e9-40d5-80f8-f0aca39e00ef", "comment": "Malware payload", "value": "b101b3f902285091d9b2a878c636fe1a8fb91be711c1ba5a1a90f043e566c0ce6b1ede8bed8e9db2d12ec3af5263db09", "object_relation": "sha3-384", "Tag": [ { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646162926, "uuid": "9e83f2e7-d4a0-4685-b469-b4d20094afcf", "value": "T1BA440200B831A171CB39B57DA1F2561202C11F14BB21C9C9337EADECAFA69E71F959C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646162926, "uuid": "fb66fd7e-ec4a-4b34-a1bf-12710078f737", "value": "6144:mMDwmXNnZKKH4goy/pIGw7w/b1T/oJrjafmH3n0r:myXNMKuy/aG6w/bp+iI3n0r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646162926, "uuid": "8540896d-770b-4d19-afdf-e0c0b0ca83f8", "value": 268435, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646162926, "uuid": "275262b3-8641-4143-a1d9-20f1c85f5a48", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646162926, "uuid": "d6518dd7-6237-415f-96c8-0aaa2736e73d", "value": "lemtciaifas.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3276496c-992c-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1646117564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646117564, "uuid": "b881884e-8a60-4b20-9aac-2398ae9f2a82", "comment": "Malware payload (Loki)", "value": "9cb3ca5a60a3fe51d08e4687294cf5d6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646117564, "uuid": "e332fc09-0fa4-429a-9bf9-7e506e09853e", "comment": "Malware payload (Loki)", "value": "df5a9a7702209f24b61b8a6cc48a911ffdab1a8591fc91f61fef4466ebbb70f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646117564, "uuid": "7c97d419-8f3c-41bc-bc54-ca56daee9356", "comment": "Malware payload (Loki)", "value": "8c4de0c860d2141594f21efa5c28af6e0646dc21", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646117564, "uuid": "1f9e5413-cb91-494d-9356-c739d0b1f0da", "comment": "Malware payload (Loki)", "value": "68c85f88d750243ed623c98adce683d8ce8d00177a61b8433dac321fc19a84447bf4fd9fe1c2a3d1fc8b33814206c8eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646117564, "uuid": "07fe7437-58be-4ee1-9a6a-fa5cf764ef41", "value": "T1F2E4AE0838EA5039F8368BF1CAD0EBF1DB6DF221E48970F558000E565655BBC894AEFD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646117564, "uuid": "44599006-5624-4ffe-8e59-83c118b74a54", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646117564, "uuid": "88c31196-ea3a-4082-8e78-962f5b3cfe96", "value": "12288:xEh11R/I5y1s65vCtiPTrL2RrdP/tbdWtlaceNafLxQ0M+uOxsntLqoY:uSy135vCQrrKRBP/QYn8hSOxwLq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646117564, "uuid": "89d9d85b-8600-422c-bda1-f22ea09ea88e", "value": 703488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646117564, "uuid": "5b7c2963-7083-4f69-a611-5cee3029755c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646117564, "uuid": "e15e1fb3-649c-4f2c-bc86-12d59cc6d039", "value": "DHL Shippping documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ff70780-992c-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646117587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646117587, "uuid": "2f275729-35fd-4fea-aa87-f9026c6ec9ba", "comment": "Malware payload", "value": "ec8ad35c452660bd7c6557c36f55bc20", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646117587, "uuid": "e733f128-3f7f-45b5-a83d-e14de238df05", "comment": "Malware payload", "value": "df7ef7d0d617b0350d4dfc411aea5992f7354e2cd54d7dd83ddd799179a46458", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646117587, "uuid": "0dc52c57-2a87-46a4-bfe5-0dcd429ca26f", "comment": "Malware payload", "value": "5106196be127f7bdd8b99ba4a03b24779b2590c9", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646117587, "uuid": "a74f9145-86f3-414e-b26d-090e2f169f79", "comment": "Malware payload", "value": "849b1b202831076a48d9535fb03bf469b25281bcfe1c3ac88b081b4943b5c10bdfda166d774a682f073bb51a1ac5c01a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646117587, "uuid": "b75c8949-b224-4e38-9f7a-8c559ff5aa64", "value": "T11993F110FF92EB12D499473DACA7CBAF99217EE85D21050BF1A8771D1CBB990A854F30", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646117587, "uuid": "ab0692b9-ffbc-4452-96ed-452f76cb2c72", "value": "384:Qg+JpFJXtz1Q/N8KeePFeegt34m0Oigb/eMnUvcgRYT++droqUsCXEnAJ2bA1i3s:QPpkKt3glMIpYQtlE4fgvTu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646117587, "uuid": "d51f32ed-3fc3-4fcf-a1cc-b19c6294717a", "value": 89088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646117587, "uuid": "1e786e92-896d-460c-afe5-5580e5182777", "value": "application/vnd.ms-office", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646117587, "uuid": "f1cac27e-5120-42d3-93bc-d0c61265eccf", "value": "Purchase Inquiry_pdf.pub", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce6a69f2-99a7-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646170654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646170654, "uuid": "02569cf1-eb63-4f39-bb7c-ff113ffce94a", "comment": "Malware payload", "value": "776da7027fef28ddc2ec5875927e1147", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646170654, "uuid": "fe06216a-4b48-4142-a1fd-a5d38b600603", "comment": "Malware payload", "value": "e065405ac011bd4221d0a78843fafa66e1ea38411fcc0d97de897e4be0283c54", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646170654, "uuid": "4249acaa-026f-4909-b929-9445deae9df7", "comment": "Malware payload", "value": "6c86ed8914aaef1f7ec41221395f58fb9d75b9af", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646170654, "uuid": "7628e5a0-9eef-499c-bb24-725d435116b7", "comment": "Malware payload", "value": "5fa69d4dee1034415539b20dac128f02db5a8c24a773f733c0dd74f5ed27d043659045ea67756c990fb609c0a08a0b3f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646170654, "uuid": "4a4cedbb-e578-4a7d-b331-08fcc886709e", "value": "T15AB4AE11B790C076D2AA36342512E3B51AEDBC709AF5838B7FC07B7E5E315918A3835B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646170654, "uuid": "8c0780a0-c69f-438d-b181-4d40269548d3", "value": "f08242131de62ca6d7c4b2727b491b3d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646170654, "uuid": "3ad0d52b-1fc2-419c-8e43-d5c3718494b2", "value": "12288:dbFLiEzuSo9guqHuWjr2pye4W6SpktSuHE:5VWSo9guW+6ZE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646170654, "uuid": "c30f0842-73c9-48cb-b92e-4fac127e492c", "value": 500224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646170654, "uuid": "87cfd941-e109-4de6-90a9-4c528384f4d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646170654, "uuid": "3e99deaf-b6a1-4eff-b7be-cbee9b50b175", "value": "776da7027fef28ddc2ec5875927e1147", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac1af367-9956-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646135807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646135807, "uuid": "d240afe0-b3e6-4465-93fe-301b762f1b2b", "comment": "Malware payload (AgentTesla)", "value": "0aed6a8252effb18111b8c543a00cc90", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646135807, "uuid": "6372ec39-3b0b-4bbc-bf52-8c45f96d9d58", "comment": "Malware payload (AgentTesla)", "value": "e0a7b293c7e9c98e43dd7896b2dd5701608ec1ac6cb25baa5a12dc427ea6e990", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646135807, "uuid": "19eb34e2-515f-4ac7-93b4-028c96e16be2", "comment": "Malware payload (AgentTesla)", "value": "7b6953d9aa32d4e0cac04c572966e5520cfe434e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646135807, "uuid": "f780ddf8-59b3-4818-ae23-46aa4888e6d2", "comment": "Malware payload (AgentTesla)", "value": "00b778350ce2b39ac9ace53f7ebe9a9333e1309096676583d54e68c2278d6555aed5b6a596bcece3bec53ff0f4d535c1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646135807, "uuid": "54532d23-3b17-49da-bde7-7eec85140113", "value": "T17CB4AED562F7467BCDF8E7FDF431500A6FB97A2DD216E2691C9022990493FC82683D22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646135807, "uuid": "c4dea0b4-cec5-4e89-a274-e219c8330770", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646135807, "uuid": "5be9685e-0b02-45d8-8be1-fe12840b66f4", "value": "12288:NtCcXU3sX0zqb3XTpTU3+MLPbKjbp0mwzEgA04T1a:XtUYVzXTpTcLbkp7wzEgL4Ba", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646135807, "uuid": "d32b939a-6796-46d2-9fe9-35825ef77acf", "value": 522240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646135807, "uuid": "5d90647b-b530-4a5d-836a-6499c70f3631", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646135807, "uuid": "8884ef04-04c0-424b-bd39-adba57b6d924", "value": "TELEX.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebe58841-9936-11ec-9275-42010a9c0029", "comment": "Malware payload (Gozi)", "timestamp": 1646122170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646122170, "uuid": "ff999a48-9be5-477b-afdd-f2370082ad36", "comment": "Malware payload (Gozi)", "value": "b642698152333b7233f9cf3bb3e76e33", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "inps", "colour": "#CC4ED5", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646122170, "uuid": "122d1644-bd0e-4c7d-ac3f-bbad095a9a4e", "comment": "Malware payload (Gozi)", "value": "e13a056f1ba8250d266ea3e3b6790d142b92d7febb256af5f922bd2cec603e05", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "inps", "colour": "#CC4ED5", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646122170, "uuid": "57c67362-5129-4d08-a5ea-10cf2fac9a20", "comment": "Malware payload (Gozi)", "value": "718f1aee1dfbbf675297b0f8a49bf0e4e2499c36", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "inps", "colour": "#CC4ED5", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646122170, "uuid": "4f033e58-f9d1-4125-a8b2-6ce6082dcff3", "comment": "Malware payload (Gozi)", "value": "72f5169cb34138b12c52895cc25f0b0f07d0a9897aa117133dcac57f4553d67ecd87725b9a84db78e3c2ad2838560877", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "inps", "colour": "#CC4ED5", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646122170, "uuid": "a9b8acd7-8c71-4786-9308-8c1c19dc8daf", "value": "T1BE649E10AA90C035F5B712F88979A3AC753E3EA15B7560CB63D51BEA16396E1FC3031B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646122170, "uuid": "dd53222d-dd59-43e0-b722-99d6792071b8", "value": "070604688899afa7e1438edbf6a9e9e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646122170, "uuid": "8cfb1544-9822-4523-80cf-6aa831b3c0a0", "value": "3072:q768GKVBylhv+SdAq5lbDFKjXmKj5qNSNYaGb57ylL5d3twpy2bhd9/qtU7+i8:J3hv+u15lVKj5SSNQb5G5qphhytUv8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646122170, "uuid": "93e1bdc1-da98-4556-bf00-de617bd6af90", "value": 333824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646122170, "uuid": "ff5742af-cd87-4a90-a80e-093fd0c60b86", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646122170, "uuid": "117a2ded-09ad-4d10-a510-0c9ccfe93e26", "value": "readme.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44517174-99a8-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646170852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646170852, "uuid": "72465a72-c237-4276-bad3-919008faeafc", "comment": "Malware payload", "value": "9cc24dba9d38ce9a7430e47ed95c3036", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646170852, "uuid": "5d012b9f-c4eb-44c6-9048-c99141277362", "comment": "Malware payload", "value": "e16aaf39e55ee5f623e0a356827211f7c69e30ebc3ad9d470b22f2cc0fb13f79", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646170852, "uuid": "02ffef48-b42c-4ac9-be4a-6fcc6121a242", "comment": "Malware payload", "value": "42250f0f4f744be7d8381ee7f4ae6ebc77013817", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646170852, "uuid": "8541f65a-cdd2-45d7-a9ce-1ff7547087c5", "comment": "Malware payload", "value": "690ab5e158c5303f71abf426d41e452f2477399b7143ac8bff40d2007adba02e0ad1edd5139f24a3214cf96cc916c88c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646170852, "uuid": "343533c9-47fa-4d0c-9807-4cd8c7284803", "value": "T18CB4AE12B790C076D1AA36342526A7B51AEDBC709EF5C3876FD03B7E5E301918A3C35A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646170852, "uuid": "a98eb53b-9655-430b-a625-e4a22b9b9bd3", "value": "f08242131de62ca6d7c4b2727b491b3d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646170852, "uuid": "aee396a2-4089-41e2-8715-4a9dd6ac0295", "value": "12288:jE3TMKM/JjdkdO4+BNhOwyl4h43JopSz/o:jE3TM/JjdkS03Ko", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646170852, "uuid": "6770fd40-b1b9-40bf-ae48-8869711b8db6", "value": 505856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646170852, "uuid": "d2256207-7b00-4088-b000-6175ab7c157b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646170852, "uuid": "b942cd12-4392-46de-b168-f9b65ed1288e", "value": "RihEhHEKnnl3mwWZp65niRgeaAio8Ol.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b1540fd-9952-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646134034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646134034, "uuid": "a35ccf71-30f1-4b78-9d6f-5bcf4ddbeaa9", "comment": "Malware payload (AgentTesla)", "value": "c4ef96331824208957f7eb4449a07536", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646134034, "uuid": "6962a3fb-f0bb-4744-9adf-2b51296c139d", "comment": "Malware payload (AgentTesla)", "value": "e1b6a5300f2013d07c49dafeb1a78e73ef0b489f8a9276cee205a612a696eb8e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646134034, "uuid": "5f5e89ba-d360-4c2a-b084-96834d8712c2", "comment": "Malware payload (AgentTesla)", "value": "4f405a20a3c0629892b9cfc301f629062959a802", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646134034, "uuid": "f9cd2b03-410e-4b54-976a-eb2e20d176be", "comment": "Malware payload (AgentTesla)", "value": "734a829acbb2784c3323bcaf58c97ea661fb35dc9dff10fe4f5fdd1179ada131aa479db80a73ea71a8fe770380e07427", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646134034, "uuid": "93c6750e-6698-42bf-af68-915cd14fda28", "value": "T14515BF4835E6207DE836CBB2CAC4EFF0DB69F262D14961B250020E599A0DBBD8D45DFD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646134034, "uuid": "f2627eba-75bb-4736-acfe-6290dc0bd6ec", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646134034, "uuid": "02307a30-98a8-4816-b7e9-ef4d0070ba4c", "value": "12288:eRiX0fLCkIMrj7pL2Iom/Yn6u+U6F4u8c1kDt9NlyXbHxGype+Q2Intp1V7xc6+j:hEfLCkRjJZ06FjxQrj8bHxGyiZT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646134034, "uuid": "44fe6e8a-4559-4a71-a05d-611fc403b3db", "value": 956928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646134034, "uuid": "3938167a-1e0d-4523-a82b-e8fe90ae6643", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646134034, "uuid": "4acbb575-a775-4bcb-b1b4-efa8d5a4aa09", "value": "invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3fef121-9950-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646133324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646133324, "uuid": "0c13ff35-d92f-4269-9ef0-2b31d6bea7a0", "comment": "Malware payload", "value": "0b2849172dd8f44b4e39629e33498353", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646133324, "uuid": "45e71103-3d5a-4075-85ba-143543f636a9", "comment": "Malware payload", "value": "e1ec6e16e890505e7b6443b71df6df302b5e968673710fec8a26b766c7a8b306", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646133324, "uuid": "e4b3601d-4374-4309-a7c4-6236c84fe587", "comment": "Malware payload", "value": "5a4867242551b6ea777492d189a4ab3598b804d5", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646133324, "uuid": "c73e221f-058e-49ff-a5e4-ceed439e1cf1", "comment": "Malware payload", "value": "e43d761742c33fa5a0c4df927f5fadc2add284bdc7588f2dcebea647eada70da9e933817e7b97d2826b33adc5ebc160a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646133324, "uuid": "a95a4cb8-4eb8-4dad-ac42-175cd370c037", "value": "T1F2924B1376A021B1DDF83FF3C8A3D89143F1D24A1493CE5DA44B73A105637FA5B626A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646133324, "uuid": "16b75bbb-f837-4010-b4a4-2a86234cf64b", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646133324, "uuid": "dbc83ef9-9308-4cc8-92c6-17f5611c15f3", "value": "384:apx/WWqOoDCFaaMEIvYJvrRc1wAPU0syAnaZvWlMerTJhM6:aLAtCFaaMpuQw0U0sta871h7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646133324, "uuid": "51396181-b03e-49f0-a150-03c9e1c74aee", "value": 20992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646133324, "uuid": "50fe7c05-c24a-4527-8637-a507fc6ecf19", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646133324, "uuid": "623aae9d-8f09-4ed4-a60e-7f420c2f99cc", "value": "download2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d469dbe-996a-11ec-9275-42010a9c0029", "comment": "Malware payload (NetWire)", "timestamp": 1646144184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646144184, "uuid": "a09005a4-824a-4d93-8c97-7e8591f24638", "comment": "Malware payload (NetWire)", "value": "704a66179ac89fae3ed3e48c7a5cc351", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646144184, "uuid": "6c3382b5-fb0e-49d7-9a4c-c685bc0a0445", "comment": "Malware payload (NetWire)", "value": "e23540742dd2b2813b852d1e8d6ea5ff3ee10063528563fb89587e61e8f7439f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646144184, "uuid": "298f159a-cf7d-4b59-88ea-1048c2fc826a", "comment": "Malware payload (NetWire)", "value": "2c251a91c135259a809b16233a296136de55e893", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646144184, "uuid": "04bedecb-ac8f-47e6-8780-08d7229e5fe4", "comment": "Malware payload (NetWire)", "value": "07e0ee9a123c19d250cfeff844660f692446fb1f25a48bcfc086f8d47928b78b3ac3d9375a0954cc5aa02209d7cbb4fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646144184, "uuid": "f29bb1bc-7786-4e97-b32d-abde8211845a", "value": "T1C514D012B610D4F3D8BC8632D87B89571F66BD3756A0559F3398BB2E2CB2703890B716", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646144184, "uuid": "ad8199bd-29e6-46d0-851d-528274fbfdd9", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646144184, "uuid": "e8f61a52-c8f9-4def-befb-b028bd050192", "value": "3072:O1NjcVVnLpPuf9KA4FZ6WJldHMqZL7jepbk+kNOqILRTKu58/PtRTwH2F5ZDX:2NeZtZ6YbHMqZLn4k+kNIkftZzhX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646144184, "uuid": "3afb5f29-5f76-4638-8dd3-1bdef5cae9ea", "value": 191280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646144184, "uuid": "3f3d7973-c08c-4ef5-a815-eae261b968ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646144184, "uuid": "90a0ed39-9514-4bb6-beff-36c6839a1889", "value": "AWB-SHIPMENT 28022.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67cfb8a8-9942-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1646127103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646127103, "uuid": "df466c80-d804-4e4e-9174-5a9c4c49cc69", "comment": "Malware payload (Loki)", "value": "e4422d8cd41ce92ce8e26ab444f5b2a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646127103, "uuid": "6ed43c4a-c49a-4b30-ae47-a5265c0043b5", "comment": "Malware payload (Loki)", "value": "e23ae455f81c4a8814c505d4d2a08e086925062dfddb5522bec4fe4431a32a2d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646127103, "uuid": "2bfa8de3-e167-480e-bb7b-9269f9818df2", "comment": "Malware payload (Loki)", "value": "75570618e1bfbc81094c16bdbc0e9cd5512b5c2d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646127103, "uuid": "2ddc2bbd-201b-47be-8617-bc6e63e56a47", "comment": "Malware payload (Loki)", "value": "3875f48c15b35485e238b38128b4fcf3ea8b0c3ff07dd9cd46c57a2b128bca916585d04fd37f2ee75e6bcb1df70c39e4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646127103, "uuid": "0f7af519-2096-45a2-883f-db4d7985f493", "value": "T17E64230BAAC07DBBCDCA093A5E73F7B1D5FED64A0128892727541D8EA73768F4184163", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646127103, "uuid": "1ab5f740-058e-45c9-8919-b8f9526c1e37", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646127103, "uuid": "4cec0823-919d-43da-a9cb-11f746696aa7", "value": "6144:rGitn8W7LrveNvukL1fSHx1j0k31wgvlInNrCuJ:xx3rv0vJxf0x1j0k3103J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646127103, "uuid": "7a0f675a-7973-4cf4-a1d9-24a486c98b4a", "value": 310950, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646127103, "uuid": "683a5063-189e-4d34-8e8c-cb055e710624", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646127103, "uuid": "792c480a-1510-4875-8eb8-99d9a331b128", "value": "e4422d8cd41ce92ce8e26ab444f5b2a7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1066e9af-9922-11ec-9275-42010a9c0029", "comment": "Malware payload (DCRat)", "timestamp": 1646113212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646113212, "uuid": "35e64494-2344-4faa-b900-ca816307eee6", "comment": "Malware payload (DCRat)", "value": "99e9f38f133d36996e94f4d7c00b2914", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646113212, "uuid": "82222a07-4ed3-43fb-9fd3-5ef0b404b0b7", "comment": "Malware payload (DCRat)", "value": "e29edc19ac946a1ada63090454d90ea8353cd09c9579d073c2d92d1e30644366", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646113212, "uuid": "ae269a7c-d20d-42d1-a853-24dcfc18b217", "comment": "Malware payload (DCRat)", "value": "8a971f3e02f7754730f1a4a6e47b1ac0d97cc150", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646113212, "uuid": "ae9c67eb-750a-4a20-b0f3-a50da43cdbf7", "comment": "Malware payload (DCRat)", "value": "3f9aed5acf28873318ddcbb3b0b2d1130961e355ba305d83490b0a779879a2dca6f5355df0730ba24afc6de87a1850cc", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646113212, "uuid": "8041173c-152b-408e-9888-2fdfffe1a0c4", "value": "T1CD1595342EEA5029F177AF7DCAE47596DA6FB6A33707984D04A203C60723B42DDD053A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646113212, "uuid": "b02c992d-b0bd-4fc8-a414-b20dd21c27e2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646113212, "uuid": "98b41d5b-ce76-47ea-8156-3a059273a986", "value": "12288:SZy0K2yYEFY9H/xWi6FSNrS4VvMaHMxmj58u1VZCA133XsGth5YXpgvLB:SfK2TE6GUBlOkMx857bPfZV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646113212, "uuid": "61d2485b-f07b-41ea-acb1-323cca396f79", "value": 887296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646113212, "uuid": "4c9a14d3-57db-498f-9a71-a04c4d148c3a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646113212, "uuid": "e89754ba-8248-4fc3-83a2-e45ea9461b0b", "value": "NZRw4SOI22C.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1794bda2-994f-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1646132551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646132551, "uuid": "c1fb70a9-08bc-441a-9fc3-25ef0a35530d", "comment": "Malware payload (SnakeKeylogger)", "value": "c2c1f524ec3a932bba3c27f408886b44", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646132551, "uuid": "52ff0443-1a30-4827-9326-769cb17887a2", "comment": "Malware payload (SnakeKeylogger)", "value": "e2ae7f115adeb023159f7921b4f52dda316ccf274f86834b88ae75c56a80480e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646132551, "uuid": "f1ff5634-06d8-48dc-bf68-dcdb76d186d0", "comment": "Malware payload (SnakeKeylogger)", "value": "f1a988c7b220c8e0b8268179d221096c828aab0f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646132551, "uuid": "bfb31b5c-1eab-4446-9095-2521dffbcd7a", "comment": "Malware payload (SnakeKeylogger)", "value": "8457158e278a60b3f0cabe951da80784398f81e7d054d657c5379e2616b1788f6413c206ab6df2fd2037b68dd85245d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646132551, "uuid": "eac9eac5-68f5-4cca-a9d9-f510b9bc0acd", "value": "T12B05BF4835D6507DE836CBB2CAC0EFE0DB2DF222D54960B650020E599A0D7BD8E59EFD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646132551, "uuid": "5a7cbe3f-f41b-4c7f-bf28-faa0574edfc5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646132551, "uuid": "f06296af-dc17-4a41-b2e5-4be3f6dc8390", "value": "12288:o8bG5w4XokOGz1J1CifPv8vBwKzisUympIxBEr/nu4AEeM1DPgo/9PVxFtT8LjJD:fbRGz71pPEvBwKmsxQIEbiEeIjzD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646132551, "uuid": "9949fa3d-70b6-45fb-9146-daf125f40db4", "value": 863744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646132551, "uuid": "d3d444b7-8a47-4625-8788-a2f1eede105a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646132551, "uuid": "f07827b4-0715-49c9-b8aa-70c1c653b847", "value": "FO1911003 FLS PI 39030.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0d457bb-9986-11ec-9275-42010a9c0029", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1646156431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646156431, "uuid": "d27590ea-a159-49ce-9422-02a4c9972d43", "comment": "Malware payload (ArkeiStealer)", "value": "7ad21a49cb1453d5fc34182d2a0bbe05", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646156431, "uuid": "f902b999-7127-443f-a4b6-3a864f2b811b", "comment": "Malware payload (ArkeiStealer)", "value": "e3328922aab4e17aa15b8d9625c3ae6a08256b3e7966829fe5d3ec757e00bd9d", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646156431, "uuid": "23746d3b-3e70-42d0-b008-f9cc903116fb", "comment": "Malware payload (ArkeiStealer)", "value": "a752250e1016e751c58b155971a2441bc62a0def", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646156431, "uuid": "f6b1c4b1-2199-4551-93f1-30871d10ee19", "comment": "Malware payload (ArkeiStealer)", "value": "c48ca533ef40c8bf71b062d1c52b923c6de047af007d28e2bf2e12aa61a698705d9c1907ca4164b45cafee99e1ff340c", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646156431, "uuid": "6f0992b8-f84c-4292-b68e-1576df01d365", "value": "T1B3749E10BB90D035F5B312F8497A93A8793E79F25B2564CB63D41AEE1A396E0EC31347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646156431, "uuid": "e5c5ba27-c9d9-4e83-b38f-8f6016917579", "value": "803999de15851b525de7455d6fbe3205", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646156431, "uuid": "8a8f7405-8309-4e97-bcac-a3f7cb4ed6ae", "value": "6144:6xdKquJQNtb8jLhQtuEMlpOPYX/H9EU72ZQ1:Idc2Ntb85UuEsqYXVEUyM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646156431, "uuid": "45021c87-38f1-408a-8125-7327260d6602", "value": 345088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646156431, "uuid": "b587e382-e052-4b18-aba1-42a1d4ae4ad4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646156431, "uuid": "330798a5-df3c-41ee-89f4-2ecd89c970f3", "value": "7ad21a49cb1453d5fc34182d2a0bbe05.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "640d9b29-993a-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646123660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646123660, "uuid": "996c753c-e80a-49f3-9dbf-a1ffa5c8826e", "comment": "Malware payload (Formbook)", "value": "695c152964e51fd8b180abf24080d11d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646123660, "uuid": "6d8b596a-5c4d-4517-9085-85144fdf39f7", "comment": "Malware payload (Formbook)", "value": "e33527a622795e4b17dcdf7b39167e13198d4ec62017f558011bd08525227ebd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646123660, "uuid": "7c58d1f3-91e8-4b9d-9fcd-68af7da404b8", "comment": "Malware payload (Formbook)", "value": "cedb3316434c30ceb0fa63c7fa72cb4258097f6e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646123660, "uuid": "10b47d7f-7e7a-47bb-a2b6-258eb5a88e0e", "comment": "Malware payload (Formbook)", "value": "41ecbdfa7a54224a5fe6fc8549d171a79becf82c4c4cfa997f4175710142150ac147baeadf211bcbabca7dd9eb587218", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646123660, "uuid": "afc461b6-e54d-4266-a87f-608d139e049b", "value": "T1B96423236AE0E7B7CED122313C739B25B7F645E801643E931AC69F76369B2135409B83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646123660, "uuid": "9290c3de-5314-4a18-bf6d-3f583337fa18", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646123660, "uuid": "76bd11db-a8c9-4e28-803b-a1382f3556d2", "value": "6144:rGikubO24gdJT79ffMP9nxUP5Vwq8MusifI6loVMmiNqttJXNeFTe5qfbRJ:ot2jd57BMZx85V/usBhOmiNqPJXcFTe4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646123660, "uuid": "c42e845f-97bc-4570-88b7-fbc7cf4c1da9", "value": 318988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646123660, "uuid": "6ad4a220-7fc6-4daa-9376-f8c258c25486", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646123660, "uuid": "e8779d4b-267e-4864-98fb-8d72da4725fe", "value": "SWIFT-79125401032022-pdf.pif", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f697fba5-9938-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646123047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646123047, "uuid": "b2dbae79-026d-48dd-ab21-23b7bd6f447a", "comment": "Malware payload", "value": "84d2e8b2092eb9b34b25eab8c2c8e1e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646123047, "uuid": "ad5a1a2e-8d56-4583-9b69-a9640b4ef653", "comment": "Malware payload", "value": "e36b2fe70c40908fbd6bd5b3165eeb60f4b98a5cc90e25e0dd382be9900cdb6b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646123047, "uuid": "87d41ce5-d5d5-4c8b-a35e-eb7d6af0d182", "comment": "Malware payload", "value": "9967955dc0fe0d346b62fb7a45e68928cf98c27a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646123047, "uuid": "41b7b02d-1153-4477-a411-9ecf765751f3", "comment": "Malware payload", "value": "9f40ec872878416ece76e48a36e355958b4717627e975a50caddf6ef04048c1da600dd09235f2073a516a1edba9be2ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646123047, "uuid": "b5777e15-e93d-4caf-b4b4-6cc4f166eecd", "value": "T133A43F2EBE454662ED1D9130CBD90A44BB668E133240AFD657CF35CA8F7F0652C8DAB4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646123047, "uuid": "8f8baeb4-c488-4fcd-a909-a63fafeccb52", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646123047, "uuid": "b2e75369-f373-4bca-9b89-9776c5b79db7", "value": "6144:0QB3D8rbRXsPSSd222222222222222222222222QaP222222222222222222222W:0QT8nRsP0wPJVchQqj+l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646123047, "uuid": "993bff75-651a-409a-8aff-a69bd1fc31f2", "value": 484864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646123047, "uuid": "a358d714-206f-4ea1-bbdc-f6210326a58f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646123047, "uuid": "ea311c2f-97a9-444e-bfbb-d8804cd53097", "value": "84d2e8b2092eb9b34b25eab8c2c8e1e7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d70f4a6c-9968-11ec-9275-42010a9c0029", "comment": "Malware payload (Gozi)", "timestamp": 1646143610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646143610, "uuid": "5d2fdb7f-db77-4502-929e-9f56dc1070eb", "comment": "Malware payload (Gozi)", "value": "e69c543b35c3291a56ef7ec8de515997", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646143610, "uuid": "8ed8081e-2bcf-4f9c-9cbb-c21fdf4c6415", "comment": "Malware payload (Gozi)", "value": "e40aebcbc975e71e77cd85240d93690a81c876d7045bd9c2284da9dc9ef0efe1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646143610, "uuid": "cfeb197e-2383-478f-a58e-3e80194150ef", "comment": "Malware payload (Gozi)", "value": "17e886c6f65a35225656f2958d7d48e1dc44967c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646143610, "uuid": "812834b6-236a-4fcc-bdff-160adda1ad1a", "comment": "Malware payload (Gozi)", "value": "f633e2ccb7665cb86803d97b42344d4fec9ddedc6d188e74a60296d1d5afb55f059a47eae0f27e8b622623382976d4c2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646143610, "uuid": "da2f9e12-070b-4f4c-8669-f9663afd3260", "value": "T1AB345D6AA2E50A96FD7BD6B9CD53C217D7F338451A64C31F13B0CA9A5F47321B218342", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646143610, "uuid": "73027408-f92f-45b8-b829-f9ad9b338d27", "value": "6144:RyihnaKbEFhck6xW3SJ5gtS3z9pjFAl2kO4a8pf:Ryih1EF2k6S/SD9pyl2j8pf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646143610, "uuid": "e9f582a8-4f49-4ca9-886e-e08ca2b60006", "value": 236544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646143610, "uuid": "95cd270f-7cdc-497a-b4b8-e2a2eba8b3d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646143610, "uuid": "21a0f7c7-7d37-43c2-9947-51cfaae3e9bd", "value": "7260000.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "434c7969-991f-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1646112009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646112009, "uuid": "39a00987-a474-4675-b1ab-3ac3579e963e", "comment": "Malware payload (Loki)", "value": "0aa9eab984ca505e64e1c79d1ff3d12c", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646112009, "uuid": "3ec32cff-ef31-4cce-ba41-faeef9d8bb01", "comment": "Malware payload (Loki)", "value": "e42072ddb4c3667c36973225334c68443f55134f7975ef09942db79d10fb49c7", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646112009, "uuid": "c1a51008-917b-49f7-a4c9-ca288eb8ed88", "comment": "Malware payload (Loki)", "value": "8a6d989159cf6a659125905c5d02d1a5a4e4a69b", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646112009, "uuid": "a488cf95-707c-473b-9081-6580e3286022", "comment": "Malware payload (Loki)", "value": "d7f6f01f26491029da4e4df692c224546835a8cfbd4bca2fafac786e30427a63ce8198be3973a1be88f568154e187331", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646112009, "uuid": "f98e24b0-028b-4238-8b59-da453e1faa52", "value": "T176140288F6A0D835E30919B86B3FE090831EBD056DC1D7C297B575052EB3DA3B44A7AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646112009, "uuid": "4d96bcfa-7ef4-44b3-8aad-fb03ea223f3f", "value": "3072:D4FNHYx7kbX8Yyzy2yf7QRdtm30clY/pt71/WK0Mr+mNMr10KTpeb6SnzZeAHMBW:E4xqsYQ8MUrkL7kZkPOr15pebFPsBQRP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646112009, "uuid": "34eb7928-c3b1-4c9c-9061-83d233138c27", "value": 190648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646112009, "uuid": "86a0f063-0bc3-4a74-bd0b-6ffd708d1a1b", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646112009, "uuid": "d5b16af5-a56f-486d-9d1a-6de3270692b8", "value": "inv 1220363516.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0311bd00-993a-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646123498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646123498, "uuid": "4cfdf869-3c5a-4313-8bfe-fda1d704d986", "comment": "Malware payload (Heodo)", "value": "040f8f05400fe0bf6fd119b18a319099", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646123498, "uuid": "81afd04e-e203-4caa-a422-ee1113e93535", "comment": "Malware payload (Heodo)", "value": "e4681d32e76c46759c2af8c80d1d492c25b52c0c245d3e887308246bf5d0fa29", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646123498, "uuid": "fcfc72e7-2892-4ba9-b9d6-a88065f11f4d", "comment": "Malware payload (Heodo)", "value": "a6107fdbb571406ba5a0dfa514c36b85d4d2a248", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646123498, "uuid": "0f75b3c1-3077-470a-944d-3ee218c57308", "comment": "Malware payload (Heodo)", "value": "549b26aab9e1514126471474daafff895fe21e543dfeef8b763ab9a53534aacfc9ccd0240f780218da388158a968ca18", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646123498, "uuid": "2194efcb-ed87-41d1-81b0-5692506d79a1", "value": "T1E5C4AF12BFD39072CE2F293C503DA77413A95C65971A8863979C9BBE1D3F9428B3190E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646123498, "uuid": "32bbaaac-7420-4217-b237-79eb4568f6a6", "value": "e0b213ccd96f46d30dcd8e225f4e9fc9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646123498, "uuid": "89f999bc-0c94-4e0f-8405-b63262e73a4c", "value": "12288:onEtDywy8SYlHD70WychG0QOCM8T9xvCAyDyPgyQz/VDNeg:onEtDywy8SYdnhG0QrM8hxKA7a1Ne", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646123498, "uuid": "79af2943-7906-4a7f-8744-46eb213c1545", "value": 585728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646123498, "uuid": "96b63fb5-f95f-4dc1-ba2e-206d6e29fb35", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646123498, "uuid": "f5d04312-ce58-4557-a858-3df849418a3a", "value": "040f8f05400fe0bf6fd119b18a319099", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2726e33-9956-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646135791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646135791, "uuid": "64cd3640-fa63-46e8-82d5-f4151f0975f1", "comment": "Malware payload (AgentTesla)", "value": "a650f2088c1ce178699d4507801eef51", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646135791, "uuid": "e30a9d9b-7b17-44d9-b7d9-696f7934f831", "comment": "Malware payload (AgentTesla)", "value": "e4a7994c01c4136e769caf9d9932a8ca00c364cae435b60e688074d47c44f5c2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646135791, "uuid": "d4a2e751-03ba-4b38-aebe-079d72825104", "comment": "Malware payload (AgentTesla)", "value": "31f5b3951521880ed65f1b9cd7fc984e441f9dd7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646135791, "uuid": "89836d96-76ff-44df-93bd-e633aa1dafb6", "comment": "Malware payload (AgentTesla)", "value": "b282bb2d056a771df8eee0c47df06051c0bff643609dcbcc73fbae2fedeee1ec783f24ba6d07c248984b3bc0534020a1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646135791, "uuid": "cb675cc4-8477-4fa3-8198-9a3024a90fff", "value": "T16C05BF0839E75038F836DBB1CAC0EBF1DB6EF225D88960F594000E555A56BBC8946EFD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646135791, "uuid": "3eeb9256-3b59-42e2-9e4c-fe67b3389ce3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646135791, "uuid": "1d4a612e-037d-48a6-869e-69af7253cc02", "value": "12288:BE53R/I7MkUUDFIIdp7yAk8AEkoOSNY/CAR3XcU0nhwEkFLYRCYrbG81jqhMDQ:/zUe3ly58ylR3XcUoh7kZYcaGaBD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646135791, "uuid": "576fe9b3-95fd-4216-8128-0508f369c40e", "value": 798720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646135791, "uuid": "b4abb0be-9b3e-4e9d-bf0b-f8e732bf265d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646135791, "uuid": "8e21a040-9f46-4306-bbfc-ff53cf881323", "value": "PARTICULARS - I.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b13b4695-9938-11ec-9275-42010a9c0029", "comment": "Malware payload (Gozi)", "timestamp": 1646122931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646122931, "uuid": "6da05094-87d1-4cf2-8673-abd9aa3a42e7", "comment": "Malware payload (Gozi)", "value": "f23ea90396dddf955721d67e9af4b709", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646122931, "uuid": "4a669135-75a4-470a-8ff5-f619b7ab3af0", "comment": "Malware payload (Gozi)", "value": "e4aacfd3d9b2712af0b9221d1fe943234d307dd94506ca36730521554bb2ae38", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646122931, "uuid": "8d512985-d5ec-41cf-b226-e1d9ab2174c9", "comment": "Malware payload (Gozi)", "value": "9c62db7b2909140da5ca02db3e31f223e026b02d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646122931, "uuid": "e1998e51-4ee3-4a97-a37d-122a42874c0c", "comment": "Malware payload (Gozi)", "value": "64441af95824591ca8ea05d2eccc09a380e38e3a6e663e15602a9c9267c270f5a2506a8ca2e29d2775f864260b003045", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "ITA", "colour": "#ADAD08", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646122931, "uuid": "546bb4e5-95c8-4198-811f-4c9484c112e2", "value": "T114649E10BA90C035F1B712F8497E93ACB63E7EB15B2562CB62D556EA26343E0EC31357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646122931, "uuid": "131fd98f-95c8-45f6-a1c7-7c0a4342178b", "value": "070604688899afa7e1438edbf6a9e9e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646122931, "uuid": "89dd491d-2c0f-4e89-ae74-d954c327b377", "value": "6144:BN4oxhjh9K9JPuNNcdyyeuWsSXnhCTjzg:v1jh9K9gncd0sS3hCM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646122931, "uuid": "82c91d1c-7115-4b19-9ae3-c691a69abd6b", "value": 332800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646122931, "uuid": "021ee08a-ca02-47b3-81e6-43212d3b17ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646122931, "uuid": "28a8c1e4-0ad0-416f-9042-1583e4103c3c", "value": "f23ea90396dddf955721d67e9af4b709.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a290fa4-99a8-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646170861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646170861, "uuid": "c86647c4-bec3-41a9-beec-53336d5bd291", "comment": "Malware payload", "value": "219ba33803708a181cff8a1cdc936765", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646170861, "uuid": "f5c93022-3e43-48e3-8d1b-46ab1d205ccf", "comment": "Malware payload", "value": "e4c9c954e4910701fe5ebd5819056615407df5c5f08fb5a57d31c7c23651216d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646170861, "uuid": "e4b6a435-376e-46ed-b155-5be0256dd7cc", "comment": "Malware payload", "value": "aa6e32bc9659c213807f04159f7957a0ca195bec", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646170861, "uuid": "e292745a-b9f1-41b0-b213-4266d455758b", "comment": "Malware payload", "value": "7d6bff354e0f39c6291e064ebe7ba20a211a2b9646142b6becdee22c6bd1e7496b437c4c3ccbd7f83c10c728a0e3df7d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646170861, "uuid": "6ac58037-5ecd-4a7f-8ded-8d5b0b912070", "value": "T1A2B4AE12B790C076D1AA36342526A7B51AEDBC709EF5C3876FD03B7E5E301918A3C35A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646170861, "uuid": "05fecc33-45c2-475b-9795-0cc2d04b2fc3", "value": "f08242131de62ca6d7c4b2727b491b3d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646170861, "uuid": "9d3e9c96-d8ae-4010-9dd7-6fd8761970d9", "value": "12288:jE3TMKM/JjdkdO4+BNhOwyr4h43JopSz/o:jE3TM/JjdkS23Ko", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646170861, "uuid": "a750f0b3-9c87-450a-aee8-6f0dd400a47d", "value": 505856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646170861, "uuid": "648a53e8-80e1-49ca-9153-b82302fcbf8b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646170861, "uuid": "450575c7-c155-46b2-99d9-ec16412cd921", "value": "QoupG1F7dMBrQ8F6.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "225e852e-996b-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646144595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646144595, "uuid": "002febf7-aefd-4f16-a060-c0171961b370", "comment": "Malware payload (AgentTesla)", "value": "cc353220091174490dad6f280073badb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646144595, "uuid": "31d745d1-801f-4054-b4b3-e209464f0f9f", "comment": "Malware payload (AgentTesla)", "value": "e4d309967904ca32fa5a00e70161c95621c687e46f2512bac1f061b0303fe863", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646144595, "uuid": "3bfca8a0-633d-4bb2-8d8e-d09c553439c5", "comment": "Malware payload (AgentTesla)", "value": "eb0f180fa8c3b29984312e73007670f5638e291a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646144595, "uuid": "8cc87f60-4b7d-4bcc-874c-0b161aa5968a", "comment": "Malware payload (AgentTesla)", "value": "3b82fc18a4c7c898c1dcd1afdfdd20a9eedaa84aaed5108072e61cf146f19d6a79c8104d6998655b543f16d90d3b7f3b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646144595, "uuid": "8f8e7575-6ea4-4074-9693-69376dd6637c", "value": "T16003E61AB892561EC5D47BF869B0619766367CE10520C18FECF9BF29ED32223DCC126D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646144595, "uuid": "e39b9940-2cae-4280-afa7-f1d3d6785914", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646144595, "uuid": "c8377d3d-f750-48a5-9106-1f310259047b", "value": "384:GGSt3sFy1URJAYQXulaiAMwCKFH2S3dd0hUADkazN:G1SRnxlmMwCK/3deVD/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646144595, "uuid": "738ba11d-9028-45f8-b55b-a2762442facb", "value": 40960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646144595, "uuid": "19e51d0a-c42e-4447-a552-e94c5f65bc84", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646144595, "uuid": "362c9038-1437-4392-a0f9-b98c232543be", "value": "REQ Supplier Survey.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d62e7d9f-99b1-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646174962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646174962, "uuid": "ae64856e-d94a-451b-97fb-47684188f451", "comment": "Malware payload", "value": "e962178011bb019c1ccfda051e1a9e38", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646174962, "uuid": "1d2a27ac-ac70-45c2-89b5-10a0020eff47", "comment": "Malware payload", "value": "e5f117262c2c4903c62adaff8e11850497dac1441ab61597e4ea19b6f03fcb75", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646174962, "uuid": "1f0602f1-9539-4d92-8eb8-2d098fc8570b", "comment": "Malware payload", "value": "f0f6a229b56a4de75bbefe1afd415fc7bd9e6606", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646174962, "uuid": "c89f9727-d10a-4bae-b38f-13c4a1f7429f", "comment": "Malware payload", "value": "e7e6d7d5dd45298a884e6d169c438c5c36d7cbd6470918e58993d747c12035e63f68adb4ba391e3a3596a394c098872b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646174962, "uuid": "d22d4cd7-3e25-46b8-b95c-366bc96235ff", "value": "T143B4AE11B7D0C072C26A35342926E7B656EEBC719AF583876FD03B7E5E301D18A2835B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646174962, "uuid": "2bc37e38-aec1-4824-9ba4-9c9f4925c2df", "value": "d02245ac5c961d83d0907c826d8ba5c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646174962, "uuid": "fbf1b101-60cc-4890-bc17-c6e55cbb62a7", "value": "12288:JhC1q3aXOwkiPs2iCtyjdOAIlgOkar//wJY8Itgm:Jgq3aFkiPs25ad2Bkm8jm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646174962, "uuid": "3572fc59-1495-4a58-8148-db79dfea9b9f", "value": 499712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646174962, "uuid": "d5815c82-6686-4d3e-a15c-e81ddea82c35", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646174962, "uuid": "a5d32800-4fcf-4cd2-8636-ca671aa44b48", "value": "e962178011bb019c1ccfda051e1a9e38", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae3c50c2-995b-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646137958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646137958, "uuid": "0757d922-9a55-4268-b49a-b0661dcd1a55", "comment": "Malware payload (Formbook)", "value": "95e20e34bfa712d353d203a675e1f643", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646137958, "uuid": "c74a5a6c-1259-452a-941c-f3d730ca40ba", "comment": "Malware payload (Formbook)", "value": "e5f3bd60bce911ddbe8272a218b0690fff6b36f5876a51f26914b4b066d17ca6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646137958, "uuid": "48f6e3f5-0952-407b-a205-b07b9104126c", "comment": "Malware payload (Formbook)", "value": "16a7d3efcdfcb2f18bb471b9b1ec85c312afd306", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646137958, "uuid": "827063d1-bab5-4f3c-8683-129cf66d97e1", "comment": "Malware payload (Formbook)", "value": "f856e3a1bf4ec76641453f1a05435a93a4b7e0b858f31197da59d3eef3bee00347f0034cad535789f921e6941a94c5f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646137958, "uuid": "e1fd69da-a23e-4e4e-ac32-64ee695bacec", "value": "T1E3F4BF0439EA5038F83A9BF1DBD0FBF1DB6EE221E44960F564000E554A55BBC894AEFD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646137958, "uuid": "eb136fc7-de24-42ba-a178-339f1a370282", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646137958, "uuid": "1cb92d22-b62c-42fd-a039-784adcef92d4", "value": "12288:XE+LR/ICQhGYAKWWlknOlDizGTUoyP3a6PWP2ulicXn4SaOvwa:f+GYAADE13aWduzEOvw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646137958, "uuid": "913c398c-a447-485b-b787-37ef749fdcee", "value": 763392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646137958, "uuid": "47e21b56-c6a5-43fc-931d-5709a2a0293e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646137958, "uuid": "10717bcf-c284-4d4d-acee-388c6d6bee4b", "value": "No. STB42020.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9db60477-9956-11ec-9275-42010a9c0029", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1646135783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646135783, "uuid": "e51f4de9-7c1d-4946-b990-090b9bc6fbbd", "comment": "Malware payload (AveMariaRAT)", "value": "7f6ab75be580b393be36e6f719a81160", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646135783, "uuid": "b3a7027b-f138-489d-9776-39a25ebdbf41", "comment": "Malware payload (AveMariaRAT)", "value": "e62c0426c4787b0ac507f10bd9d3b6439dd8e5a3558bf6be2c2fbee698753d34", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646135783, "uuid": "9e5dc12f-013b-4178-a1a3-98e4c0f0ee58", "comment": "Malware payload (AveMariaRAT)", "value": "7f0868bbb588515f2e5736d4af50586200edf40d", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646135783, "uuid": "ea3be237-86e5-4952-8bbe-6444178a6354", "comment": "Malware payload (AveMariaRAT)", "value": "5a23455710e9e55c2577d3b0930b48034c81b3869e086df238d35cfe067ceed24bd106155b274de54acbf8a9673ba88f", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646135783, "uuid": "fbe2c9af-76c2-4fc4-8cdc-498aa9aef3ec", "value": "T19315120563E810B5D8B61BB868F312435E72BCA1577A4AFF02D0D97D1E23AD4B531B8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646135783, "uuid": "0d9117d7-ec0a-4504-a4d9-10cdb5e2825e", "value": "4cea7ae85c87ddc7295d39ff9cda31d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646135783, "uuid": "773a2c68-51dc-4288-a0b4-38fe52d42ee7", "value": "24576:6jyrQBpi79AdUs2KV66+PxbH4yrPfjx8PDz:LrQBpC9AvG6+PxLJPbxOD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646135783, "uuid": "e3c2fbc3-bb55-4424-8eb3-39938be0bc28", "value": 915968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646135783, "uuid": "5762dc86-43e9-43a8-84a1-7ad8da56e61a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646135783, "uuid": "e527f24e-a25e-4431-8113-1b347d50c37a", "value": "Doc_30710489927_019_00003_00000095.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01e3bdaa-9941-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1646126502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646126502, "uuid": "1bd6afac-b522-440e-970b-ffb969354072", "comment": "Malware payload (Loki)", "value": "c5527470ba6fce4fa48339ddf236e269", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646126502, "uuid": "dc1ce59d-f259-41f0-93b7-5230b6fb5e3b", "comment": "Malware payload (Loki)", "value": "e641716146191c3e9050288a7899b536cf6b6a5d2eb0290c756482bd27f8927a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646126502, "uuid": "25f77705-c080-4a5b-b653-6abb131688d5", "comment": "Malware payload (Loki)", "value": "a7034223c89bcf390afeec63f91aa8ec2b01a194", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646126502, "uuid": "d5cdc316-e7b4-4774-8eb9-3c9e3aa323a0", "comment": "Malware payload (Loki)", "value": "839ebbc987609d6dc9d50ee337c687830e78f2f167b04bcbee1194ff1240b13215cddea57e5fad1f07da0ede0bd54915", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646126502, "uuid": "53ba0394-c750-4644-a607-8fcdc63aa4eb", "value": "T1A66422241AB09CBFCE09A5368BB38779EFBBB7984830458F0B313D743E9648B151A471", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646126502, "uuid": "f56e5cda-9cbb-4e09-b6ff-d0566cea78e9", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646126502, "uuid": "6d8b8005-2a45-4829-8fe6-aff682fb2ffe", "value": "6144:rGigCnwONPDAQ5MlSMrfp2Pkh+IW06+WuDcoFK7gejjjjUIItzCeg/y+sBZvVWS1:ciFAiMrfp2P++EWuFK7RDjUrJ5g/y+C9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646126502, "uuid": "43596a01-a85c-403c-800b-e5046bc9c14a", "value": 312738, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646126502, "uuid": "57ac2a88-fa6a-4687-bc8c-ee23f54d4b8b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646126502, "uuid": "13581775-42d5-4d76-8d70-07f07cc5f292", "value": "c5527470ba6fce4fa48339ddf236e269.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b832b4f-9941-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646126706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646126706, "uuid": "9dfa4076-95fd-4bf0-ba6a-ca7ebfbc8d40", "comment": "Malware payload (Formbook)", "value": "2c5c3b6c955921bb291d549367ddc51c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646126706, "uuid": "b785cf4b-7051-4ccf-9deb-1d6c1cf9f2c8", "comment": "Malware payload (Formbook)", "value": "e68d65f2d19ca4d1d09bfc86fad9464689e1453f3c4488ef75dbb84041f22518", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646126706, "uuid": "98f55015-da59-4a76-891b-2fc8a2adb106", "comment": "Malware payload (Formbook)", "value": "44675bb69744200c9046e0cb7054d5fcf08c430c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646126706, "uuid": "868b2cb6-d2d5-4181-affb-d914ec6f4696", "comment": "Malware payload (Formbook)", "value": "3d936be3d54099ec49dcc0a8f3a8267bded028798e86bb2fffa0d20fbe840825e6c508167098d39df919fd8847697cef", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646126706, "uuid": "39515136-fee8-4bd6-b3ab-589ff67a7fb0", "value": "T17E642295F7C6DA63D491047022A79EBBA7FFA10806C40EA3AFF4AF1E7CA61C70916115", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646126706, "uuid": "acacc6a0-98e2-43ec-a4dc-2284075b1a4f", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646126706, "uuid": "2698284c-2b78-4411-b6d4-cf58db685768", "value": "6144:rGilfHKBPpnTb1GN0uOP0EDvJleuEHuvFrEXvzJdS6GY2f+M:5vSbGWuqtjuHu9rEfFDGYC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646126706, "uuid": "b02d1f9c-1055-411b-b1dc-67e0c1f21c15", "value": 317429, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646126706, "uuid": "b259029b-c1c9-47e7-971a-9db21aa22015", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646126706, "uuid": "5b469349-28b6-41f4-af1d-ddd36b22fe50", "value": "2c5c3b6c955921bb291d549367ddc51c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4acaa233-9958-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646136503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646136503, "uuid": "9a5d0bc7-7df1-4113-bbcd-77689a8c2ef2", "comment": "Malware payload", "value": "0ae30291c6cbfa7be39320badd6e8de0", "object_relation": "md5", "Tag": [ { "name": "Daxin", "colour": "#652B35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646136503, "uuid": "d1b84a77-ef80-4424-a491-88ec7726befb", "comment": "Malware payload", "value": "e6a7b0bc01a627a7d0ffb07faddb3a4dd96b6f5208ac26107bdaeb3ab1ec8217", "object_relation": "sha256", "Tag": [ { "name": "Daxin", "colour": "#652B35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646136503, "uuid": "4510a2a3-ae75-4cb9-978f-3decee9c019d", "comment": "Malware payload", "value": "c257aa4094539719a3c7b7950598ef872dbf9518", "object_relation": "sha1", "Tag": [ { "name": "Daxin", "colour": "#652B35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646136503, "uuid": "e6c646bf-9a81-45e2-a66e-744711791014", "comment": "Malware payload", "value": "49e061f3422818b2c11d45803ae5f6dec98694dfa5eda4fcad4f13355d056ec5968496f94a51435d81ff3558182a3182", "object_relation": "sha3-384", "Tag": [ { "name": "Daxin", "colour": "#652B35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646136503, "uuid": "a438be94-5283-423d-8e7f-a7ca12c258f2", "value": "T1ECA21843F7910FF0DA621A7618A37765227B5E390B1529C3DF60399A5EBA3D13A312C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646136503, "uuid": "c5fa8888-e9e4-4ba8-89f4-fe595c7f0fc6", "value": "a7bd820fa5b895fab06f20739c9f24b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646136503, "uuid": "2caf7617-5b40-4986-b67c-6a859df43ac3", "value": "384:0mkjGis6VmVLHFoxvFky9uzfVpqQKweg78e789g+g2T5s:1uJF/urpKwKg21s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646136503, "uuid": "2295995f-b511-4190-a88f-663e14766c97", "value": 23040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646136503, "uuid": "1243d334-9325-456c-a731-79a0dff115a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646136503, "uuid": "24f6a637-a205-4b37-914a-d7f2ce9242c8", "value": "e6a7b0bc01a627a7d0ffb07faddb3a4dd96b6f5208ac26107bdaeb3ab1ec8217", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a3ab293-9943-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646127482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646127482, "uuid": "0704d2ec-0dc3-4126-bba4-01a878d8c7b4", "comment": "Malware payload (AgentTesla)", "value": "dc5d32c0fcf8969eba55a15480bb6e51", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646127482, "uuid": "3d678400-63bd-43bc-b357-d5fd6c96954c", "comment": "Malware payload (AgentTesla)", "value": "e6bae7d5e10a4558cc5929bc56a9f78b063f5630e7745653c778fb80d5e80c0b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646127482, "uuid": "2372768c-fcb7-4f63-87e1-19bd14c349c0", "comment": "Malware payload (AgentTesla)", "value": "1e79814a0cdb99866d8451072a5e7ddb44e873a6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646127482, "uuid": "27b33dbd-cdd3-4d22-9e23-9e952f96d6a3", "comment": "Malware payload (AgentTesla)", "value": "5ae1b32cb4987c3c9b2befb2057671cd9aa96dfdd87939fa390c07fde915b49ee12cd321faecb805ea53bff199de2700", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646127482, "uuid": "e45e7e05-5161-4da9-8db5-fac7de20f451", "value": "T1D9A423927A3CF48859A2CB0E6753E07927DDF9608B6239F022F571D3F900DD6D6B6844", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646127482, "uuid": "e96162f8-c803-4e98-8c42-e2cbf9d70bdf", "value": "6144:uZW8WQYMfgrjRmNCFpY9+6Q6mCHs2VQONt/UGZ9610JlW55wxn37Xe0LRpHO+ji2:+6OcRmNgK9+aHv0eJ05563be0LRUu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646127482, "uuid": "ff0a8bc9-4b09-491e-871b-55111e1797fa", "value": 480371, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646127482, "uuid": "7ee60659-d7e7-492c-8167-f94d6dfb7fbe", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646127482, "uuid": "7a07b0c9-feb9-44ed-a154-548a7c4d5cec", "value": "payment overdue.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ede6418-9994-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646162253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646162253, "uuid": "6f4c2f56-78ff-45e0-82f2-4e2e2330bc00", "comment": "Malware payload", "value": "127478cc9fec34ee4e4021b303e2b6ca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646162253, "uuid": "2b88b18c-6504-4a78-b20f-e84342c7d4f9", "comment": "Malware payload", "value": "e6d6100cc97057cd00751ef5ac18261f7796868a420b4507144e9de0a7e80784", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646162253, "uuid": "c17d1dde-9d62-4c1d-9df0-847aea26f51b", "comment": "Malware payload", "value": "1aa91a8d2eb0f51e1c774a3fc676d8f8d22ae7c3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646162253, "uuid": "bf050842-2c95-41d8-9b31-e9b5740ff9b2", "comment": "Malware payload", "value": "735753cfc6c7522b121ee40e759f8650c688d7c9a91cf6b929d32eadb3c91a0f983255140bd563b9a5970d53fd82c7c2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false }, { "name": "spyware", "colour": "#219679", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646162253, "uuid": "fc4ec0e0-9d13-43e3-aaf1-4f4ae1c3bb1f", "value": "T175B54B02FCEA05FAC6BEF23085A652227631746943313BD30F94997D26A9FD46E3E315", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646162253, "uuid": "cd228909-4b22-4285-8293-0ad978b4b48b", "value": "0f8636b1c216cd7fcac45e927ea815cf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646162253, "uuid": "226bc1c8-8a37-4716-a828-4e5f3e89f45d", "value": "24576:3+oRJ4EjM2t/C/VutuogRgpPe758lb0y6HcHCbK+rmbHYbIzIXW:JRqEbhZtuogR+Pe75E0jHcHL/Yb6KW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646162253, "uuid": "98b2ad98-18e2-4241-a539-40723858b3ac", "value": 2330624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646162253, "uuid": "4a9f05ae-1958-421f-85c3-360811f7aef5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646162253, "uuid": "7eebc9a9-146e-4d17-aa99-c0528b49a0bf", "value": "java64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a51ff35b-9956-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646135795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646135795, "uuid": "efc1d893-3d03-4e9d-9b8a-ff42a1d17f79", "comment": "Malware payload (AgentTesla)", "value": "0507c575d462d4f289da8f20a5774189", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646135795, "uuid": "b2512fd0-87df-4e50-870f-ef0734907bbb", "comment": "Malware payload (AgentTesla)", "value": "e70a190f0dae2c2911dccbf6f623dd1ed21550359a0d46989b5b9b953ecf49a9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646135795, "uuid": "36390ac8-341f-40bf-a797-ca37fb6b5d0c", "comment": "Malware payload (AgentTesla)", "value": "8d8cedb67a898ccbc9b23aa4f8a6efad1ad1ac0b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646135795, "uuid": "16c397e5-0f90-4749-84a9-820b39be9339", "comment": "Malware payload (AgentTesla)", "value": "acdec87418a451d7e943ca3c0151cc7068e57b5c41c310782f3aaf59ffdf452edd58017d10b97238facc63669001fa38", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646135795, "uuid": "70b2de0c-2a42-469a-b6c7-27c532eb0ae5", "value": "T1D0927B193395C7B3C4BA4B3258E70F91AA74E365573B4B1DE8C6023ECA837590A96B31", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646135795, "uuid": "b0baf8d2-30d9-4ba7-b3ba-b5eff88b1d6c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646135795, "uuid": "4dd924ec-4a07-4da4-a770-cadac15ec721", "value": "384:YyG1/a2qkwnzjXblFPZl1ixSUaepk0OOyd3zDzYg:FGpa2MXbX+SUaq1LyJPz3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646135795, "uuid": "0a62801b-8793-4394-9013-8086340e7556", "value": 19456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646135795, "uuid": "05e35056-8f43-495f-8a51-ff9fac2a8c0e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646135795, "uuid": "3f830acc-5c31-47b0-984a-98aa494ecd6e", "value": "PO 30US40921.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ccfbb67-99a6-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646169900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646169900, "uuid": "42e87e16-9230-4447-a0b1-8a22f852f5b8", "comment": "Malware payload", "value": "96012d4cd9a3faf7166a429b30621420", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646169900, "uuid": "4eb26b09-de08-4613-8049-2f630df68864", "comment": "Malware payload", "value": "e748192824f59ad70e1049386882c4802c7efd4714a9ccb1d13e441b45880916", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646169900, "uuid": "eb21997e-b5a5-43ec-9571-75b24891f6a3", "comment": "Malware payload", "value": "64bd1ca4e9c058ec9b2a7355b3fc06f24e3db168", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646169900, "uuid": "d68438d3-9ad8-458e-8d2b-d05ef786d178", "comment": "Malware payload", "value": "a2f1f5ae3085899315592214939af2cf1190693877e683fddabb001d8afd05ed90019162a88b0d0ab324d24221d9f081", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646169900, "uuid": "3bd2de53-f99c-49ab-b925-26005a230450", "value": "T1A0B4AE11B790C076D2AA36342512E3B51AEDBC709AF5838B7FC07B7E5E315918A3835B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646169900, "uuid": "43fc5a9a-05c7-4955-a9ea-62db2ba495df", "value": "f08242131de62ca6d7c4b2727b491b3d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646169900, "uuid": "2ad63bc9-b59a-4f30-be59-bbdf9570cb5e", "value": "12288:dbFLiEzuSo9guqHuWjr2py94W6SpktSuHE:5VWSo9guWR6ZE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646169900, "uuid": "0df11fe4-d0d8-4061-840b-f4b2e03e5043", "value": 500224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646169900, "uuid": "cb38f98b-9396-4efe-80c6-fbeb2ea634d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646169900, "uuid": "fc679287-3ccc-41e3-b1dc-050471b123ed", "value": "96012d4cd9a3faf7166a429b30621420", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9f05475-9976-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646149682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646149682, "uuid": "de1da39c-72f6-4416-957a-2aabeaa7df4a", "comment": "Malware payload (Heodo)", "value": "ebd811be06239235f5a6cdc049ba7d85", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646149682, "uuid": "3692c949-e4d8-457d-a8ef-d65dbb1571f3", "comment": "Malware payload (Heodo)", "value": "e7ab426c8ede180a85b321f66f5fda4a8fe12dbf36bf59e97cab4d9c7e052cf6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646149682, "uuid": "5afc2f07-9b1b-4166-bb6c-fddd26b30ef0", "comment": "Malware payload (Heodo)", "value": "243b47ae607d17e66e60988e388de600d49f367a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646149682, "uuid": "3ff956cf-7b13-43ae-985c-dd97d8382c26", "comment": "Malware payload (Heodo)", "value": "3d76c0a327c882262e79440257a237ddfb48ab6a8669f56100b490887a45c8012e3cc984158e323938d22734e5acb296", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646149682, "uuid": "ef954d58-782e-43d4-8907-5eafff58853b", "value": "T1D9B4AE11B790C076D2AA36342512E3B51AEDBC709AF5838B7FC07B7E5E315918A3835B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646149682, "uuid": "83efa6f0-58f1-43d6-acbe-1beb7efd7764", "value": "f08242131de62ca6d7c4b2727b491b3d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646149682, "uuid": "030a2cb6-2b12-4aed-86b0-259cacbc428e", "value": "12288:dbFLiEzuSo9guqHuWjr2pyX4W6SpktSuHE:5VWSo9guW76ZE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646149682, "uuid": "124e5c2a-6ac0-4493-addd-961dddf97137", "value": 500224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646149682, "uuid": "7dc238a3-c748-4dc6-86fa-b213ab8633d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646149682, "uuid": "9a1e802a-0829-4b7c-b8e3-666bf6a05f26", "value": "ebd811be06239235f5a6cdc049ba7d85", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d0b48e2-9958-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646136533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646136533, "uuid": "4bc1cc44-bc6b-4dec-b529-207f05db4942", "comment": "Malware payload", "value": "4b058945c9f2b8d8ebc485add1101ba5", "object_relation": "md5", "Tag": [ { "name": "Daxin", "colour": "#652B35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646136533, "uuid": "270ed3ba-f08f-4682-a7e0-d5e7c88a89e3", "comment": "Malware payload", "value": "e7af7bcb86bd6bab1835f610671c3921441965a839673ac34444cf0ce7b2164e", "object_relation": "sha256", "Tag": [ { "name": "Daxin", "colour": "#652B35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646136533, "uuid": "90c5ecdd-6c20-4816-ab47-e000d53811e2", "comment": "Malware payload", "value": "37e6450c7cd6999d080da94b867ba23faa8c32fe", "object_relation": "sha1", "Tag": [ { "name": "Daxin", "colour": "#652B35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646136533, "uuid": "f335a611-2356-4b0e-9d11-667e0e4a3e08", "comment": "Malware payload", "value": "c880dd2ba7e418b6de236151cce5a54b7d34738d25339521bdbbe84f240f158630d76cc95a07268f05d394475d5b9964", "object_relation": "sha3-384", "Tag": [ { "name": "Daxin", "colour": "#652B35", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646136533, "uuid": "b6b2846d-a256-4c73-b36e-60a4ab478bcb", "value": "T17C636CCA22A41079D4BBC27DC9A1963FE7F2745113600BCF826147EA2F13BE5A739325", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646136533, "uuid": "3d4a1121-043f-42f9-9bda-ec28a882ecff", "value": "c32d9a9af7f702814e1368c689877f3a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646136533, "uuid": "bfd63c3a-07c1-40f0-b7d0-9a814022b175", "value": "1536:ARM1VWgS1lYpKCNTzc8jt4riPJdBnH2dXDGZ8W8tGVxJ:AhgUup7NQiP9H2dz08dsVxJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646136533, "uuid": "c8a40726-164f-4007-ac0f-5111621c4e57", "value": 72272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646136533, "uuid": "fbc76f64-6987-418b-bd52-5561f81bf75f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646136533, "uuid": "5bd99713-4562-4ca2-acc2-13edee8072a5", "value": "e7af7bcb86bd6bab1835f610671c3921441965a839673ac34444cf0ce7b2164e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb37b72c-9999-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646164636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646164636, "uuid": "1939c999-9c9a-426c-b1d1-29a96abd4b57", "comment": "Malware payload", "value": "b0f3cb90dcd8e7dde226c100a8458211", "object_relation": "md5", "Tag": [ { "name": "obama161", "colour": "#9F5DB8", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646164636, "uuid": "c3242cba-f2cb-4f90-8031-b7bd39aba2da", "comment": "Malware payload", "value": "e7de37551a34eeedad94894e8d087d4d9b8242e1441e57e27ba6dc0b0dc23180", "object_relation": "sha256", "Tag": [ { "name": "obama161", "colour": "#9F5DB8", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646164636, "uuid": "441b57cd-fe38-4c7a-a57a-4eb5bad17d6a", "comment": "Malware payload", "value": "90efe57f898be15164c4821931277d3da1d50008", "object_relation": "sha1", "Tag": [ { "name": "obama161", "colour": "#9F5DB8", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646164636, "uuid": "178d77a7-481c-44ca-a6e2-d15e2516ef34", "comment": "Malware payload", "value": "3f7c0b5da901118462b9e0beeaccf3e177ae01f30109591a7d3ca30c37c4b3e8e541b8fbd961cf6443280c6dceeba54e", "object_relation": "sha3-384", "Tag": [ { "name": "obama161", "colour": "#9F5DB8", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "tr", "colour": "#C839D3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646164636, "uuid": "98cde6e0-7e92-49e0-870f-e7caca13327c", "value": "T14774123CE2265806C718E83DC61E4EF8E60601CA3892FA0B56D47A6D7DB65F35FDC198", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646164636, "uuid": "63db7437-6650-4e16-9037-d213ba363fab", "value": "6144:xO2Vjy1WyndEXJF48WIMpuqaqj9NDsA/DUzYeeKjmFQHL:xOoy0jnnWIMpucj9NsSQY/KjmFQHL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646164636, "uuid": "2dee784a-4e1a-4970-b616-310da5ccc08d", "value": 341177, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646164636, "uuid": "1066cefe-39b6-4fae-8713-0fc53bd6531f", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646164636, "uuid": "375ad41f-c7f5-4506-adb7-13882ca8f4ee", "value": "Srv-Interruptt-1195763661-Mar-01.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d814652-9936-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1646121985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646121985, "uuid": "7f5c0d2a-3c0a-4df6-8bef-3928fc40027a", "comment": "Malware payload (Loki)", "value": "11ed9e5f572955419b9293ca3c8531bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646121985, "uuid": "7700433a-c5df-4243-b7be-e113352f38a1", "comment": "Malware payload (Loki)", "value": "e7f51794afaaec564418c1aa3741d18e28dab2e632eba4c052fe524bab8a52bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646121985, "uuid": "7a360ffb-615f-4e57-a3c4-fbed63185006", "comment": "Malware payload (Loki)", "value": "9b92612256a5063a4bbbc9079967817e2216c05f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646121985, "uuid": "721e2604-6abf-4c6d-bbe7-b27b68c51544", "comment": "Malware payload (Loki)", "value": "aa35e0fdfe78afddc7547b3a0e4b36efa0264a2f8cb6040f18f8de07adadd555ad444045f7f461e991f5d5f28ae2d513", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646121985, "uuid": "feecb043-9a93-4d01-9091-94f922110424", "value": "T1E0E4BF0839E65039F83A9BF1DBC0FBF1DB6EE221E44960F564000E559645BBC894AEFD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646121985, "uuid": "4648fb34-4533-4ded-89ff-1d6ffe80afb6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646121985, "uuid": "64f146c1-1bb5-4e2f-b903-34dc7ecebed6", "value": "12288:aEeUPR/Ix9MFdh8vgfpjZJGNd8oxCNfUqLP44j9IOoKeGnsUEW4i:TFpfplJGP54Nj44x6KeQsUN4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646121985, "uuid": "f0d8b4bf-f7c1-48d2-ac30-b52453801b3e", "value": 699392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646121985, "uuid": "7e957f00-47e3-4c96-a4a8-4d8b1c1650ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646121985, "uuid": "d46973c1-7491-4f7c-b60b-5cbe34e6e5df", "value": "Shipping Documentspdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd2a42d1-9974-11ec-9275-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1646148774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646148774, "uuid": "ba419a66-2d1b-43ce-b80e-166a49d1a39b", "comment": "Malware payload (Quakbot)", "value": "054d36aeba2554ca4b063b6152920844", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama160", "colour": "#127CED", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646148774, "uuid": "9a8d3036-a7c4-47f9-bc1d-057d1a3087e5", "comment": "Malware payload (Quakbot)", "value": "e8a2a3c6874dbaa04dfc60b58b5b1b677fbc33f6d2c08eb509f40b05df0d58be", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama160", "colour": "#127CED", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646148774, "uuid": "989734d5-aac1-49d4-901c-f485072b46c9", "comment": "Malware payload (Quakbot)", "value": "976ea70a187039010f98efafa0a0e186d7ccccbc", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama160", "colour": "#127CED", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646148774, "uuid": "aebf38e7-b467-4fab-a73e-adb598cadc40", "comment": "Malware payload (Quakbot)", "value": "b9ccdc17ea311cdf5909a2ba9b36cf86a80de98be4850c6015551f71c157715444a4de3e6cd96927b0e310befebc98fc", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama160", "colour": "#127CED", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646148774, "uuid": "c2993eb7-ac62-473b-85ef-154d1091e23c", "value": "T18994BFB875147DD6E67F477BDA96ACEC03B616229AC7A8CD8064B7C304A3375EE02C05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646148774, "uuid": "d8cd544a-f33b-4149-b7a4-c9cce86171ac", "value": "12288:iNtUdcaW57hA9ww7yqktXs1le7Z2WgNncIdVHop:CaINhuwwlktTZ2VOIdVHop", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646148774, "uuid": "76766bf7-a180-40da-ab4b-d750c2edd3c3", "value": 424960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646148774, "uuid": "419e8159-3b57-4d0d-9d10-e172d78486f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646148774, "uuid": "0736dc6d-6fd2-4bab-8b6b-4196a11e3ed7", "value": "44621.6449050926.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "845a528d-9984-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1646155497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646155497, "uuid": "a79d01f9-8945-4aaf-801c-9fef1aa4d6ab", "comment": "Malware payload (SnakeKeylogger)", "value": "e9d0170c09821024716265e29b6046c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646155497, "uuid": "c9654bc2-6824-4f41-a7b0-3f62d0fc2865", "comment": "Malware payload (SnakeKeylogger)", "value": "e90438b61c6d08d80033b533772fccdb28f9ec7707982b90c322f77a34780af1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646155497, "uuid": "4fb777fb-431d-4d11-be46-daf069c680e5", "comment": "Malware payload (SnakeKeylogger)", "value": "213e136d22459c65236dc97850e9fd8397fa0e1a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646155497, "uuid": "eee92273-f62c-4ad0-82b9-3946c2932afd", "comment": "Malware payload (SnakeKeylogger)", "value": "b285c0fcbb32b68f482e40292963df8d8dcaffa3d4c3bd23dcd27fe1b2ae5a12133d5156d9e8414a4768912ba3679220", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646155497, "uuid": "7f9f8913-d3af-41a6-9b88-42e5036ed95a", "value": "T102F4049C6502F1C4D898C779E42550F416BBED9FFA84DB2B2F423EC93833A1AC606B55", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646155497, "uuid": "bf031e09-0ab7-4efc-a884-b02a803570bd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646155497, "uuid": "d08c99f3-bbbb-4e6a-bf4c-2103f2dc0892", "value": "12288:dr4Nr41r4A7190OFxsSG/x9/hP3A7f6K7:dr4Nr41r4A70Cxq/xjwD6K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646155497, "uuid": "5b2aff64-84ce-4a10-988f-4c17d3c9549b", "value": 791040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646155497, "uuid": "6c5c50e2-3ee1-49b4-850b-3b261afe6d81", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646155497, "uuid": "d5e2a94b-2fa6-4cc8-ac2f-11af8f046d1f", "value": "Agency Appointment + Voyage Orders.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e224304-9966-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646142468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646142468, "uuid": "ee28b05d-4c7c-4ede-864f-42f9cfb49b06", "comment": "Malware payload (Formbook)", "value": "ad2a0fa400fba2fed57d5b96f12c823c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646142468, "uuid": "6d939985-824c-4348-b58b-33deb8e7daf2", "comment": "Malware payload (Formbook)", "value": "e9330d2f7bfc24c38a60bb55c0624c97c5b89672188a0177d2596a9a11491e7c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646142468, "uuid": "4dfbd976-e369-4a16-84ac-a8b4dbca6395", "comment": "Malware payload (Formbook)", "value": "dbddeefaf7898f010c747ede1b86f88c1c05fafd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646142468, "uuid": "ae01ccfe-a7bd-465b-b049-47b5ec405117", "comment": "Malware payload (Formbook)", "value": "8e99ac0ebf8ffbf9dbc14b423645a3fb2badf059b60732b0e0bad14e4a757b85c1be599b968b7a77f10dee824b6c5e61", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646142468, "uuid": "7f20cad8-2ab9-4fd0-a5cd-a283897678ed", "value": "T12A74221BB7A8ABFFFD5293B5077151B9EFB4928441F3028F17AC4EAE5F2A1804D04582", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646142468, "uuid": "95ccc800-d4fa-4e5d-8d05-9ccc673017d1", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646142468, "uuid": "3c195709-1ffe-4399-84c5-2c51c46aa662", "value": "6144:rGi/85sEdhGclHyOl3yeI4+12zl/POvIRnGQDjfGGPdL6fpc:A5bGcJyOEeFrzlevQRdL6W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646142468, "uuid": "5835f46e-455c-458c-aa89-788d9e56c42b", "value": 338685, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646142468, "uuid": "bf6b9134-e4d9-4bca-a339-4f2d27ee8132", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646142468, "uuid": "c31c6c96-631b-4a79-af48-dee95cb3c8de", "value": "triage_dropped_file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99381e58-9991-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646161116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646161116, "uuid": "4e354624-96f0-440f-a34d-53cc873750d2", "comment": "Malware payload", "value": "d34bc8b7fb71c75dbd690d4419ba81a5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646161116, "uuid": "456bf875-987a-4fac-ac6a-fb9122fb78ad", "comment": "Malware payload", "value": "ea94995d23d53a98a949a242022cbd9bc5b7a4320c3fb6c045370b15704e4004", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646161116, "uuid": "1b9ab3dc-185a-4e87-901d-86cf61c66fdb", "comment": "Malware payload", "value": "c30359eadae14df85ae5167dc2f308ef5f7a9969", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646161116, "uuid": "c6dcdeeb-f68d-4749-a7a3-763916a35f92", "comment": "Malware payload", "value": "bf1c4bd985a774f1cd370e4438c2aa2e1f3c8e2c615d81c12cd596578e3e1013b41b090f64f82f21539e6f564c85adfe", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646161116, "uuid": "0b9e8715-3cb9-437a-9f26-6bc9e5819e56", "value": "T1B215AE4835D6603DE8378BB1CEC0EFF09B69F222D54961B650020E299A4DBBD8E45DFD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646161116, "uuid": "c7bcd1c7-c6b7-4df3-87d1-5479cb3d3e6b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646161116, "uuid": "38db5cc1-ae32-4c9a-b464-c23fea2877d2", "value": "12288:EYFxo4Nir5b4v8mvx6/lF4AQ7aGCJTnvmUeqVBEgAXHYquYndYAkKeTkvNSTR/n:rx9ir1Qx6/hQhCJT+Ue2OghqU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646161116, "uuid": "d12c295d-e331-4805-bdf4-8473f8e7de61", "value": 897024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646161116, "uuid": "09b5d212-5cfe-4a69-ac36-429e0dccd1a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646161116, "uuid": "54aa65e8-4b52-4a93-aaf5-cd4a0f946462", "value": "d34bc8b7fb71c75dbd690d4419ba81a5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "107e23a7-996c-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1646144995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646144995, "uuid": "68ff5d35-97fd-47e7-8c31-a3b493e076e1", "comment": "Malware payload (SnakeKeylogger)", "value": "89037257044d7426e87c861cc1f349d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646144995, "uuid": "a0abf3ce-5666-45d4-ab3a-40cd15b46de9", "comment": "Malware payload (SnakeKeylogger)", "value": "eaa07c9bde4c048e900f10410f38506ecb28371240e38a824e8043477d5e89a5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646144995, "uuid": "eab51b61-34b8-4aa4-b31b-4d0f04fed628", "comment": "Malware payload (SnakeKeylogger)", "value": "53e95dd25898a15debcbca881a98e2ecc9603fd4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646144995, "uuid": "592fdfd8-deae-49ed-b6d2-380909645ef8", "comment": "Malware payload (SnakeKeylogger)", "value": "83eb195677ab38f598c2ad326369c26772e46c917aa1c87666a11bdf470410c2511454a1d5b7854bd050891a7ba1c280", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646144995, "uuid": "7ad3ba2c-99b9-49f5-a6e4-4b15a5336271", "value": "T127C32A1D3BF88800E5FF8A7315B15121C7B6F852196ACE1E16C1F51A3A7DA908D16FE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646144995, "uuid": "9fa8df5c-06a2-4ed1-af60-363e26a12ae0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646144995, "uuid": "e22dcfe1-154c-40c2-9704-c9087a873d5f", "value": "3072:CpAixrDw5DmLdzBMVRGip384bC6g4wBWvnbY:EBNcGip5bAGPb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646144995, "uuid": "ee8b7a15-704d-4098-b04d-fab47bbadf48", "value": 129536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646144995, "uuid": "cfbf479f-d5cc-44ea-b248-eb2ab1137f2c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646144995, "uuid": "0aa389e9-8785-4d89-9d84-3c1431c4751c", "value": "NEW LOGGER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe09086c-9939-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646123489, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646123489, "uuid": "80d3110b-936a-4055-bc8e-61dd52cb3db4", "comment": "Malware payload (Heodo)", "value": "8f876cf7e34c4735aa37ac711f28cdc3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646123489, "uuid": "486ba005-c50f-44bc-82d8-2fb50f6ce979", "comment": "Malware payload (Heodo)", "value": "eaa83b76d811f82df8c7103be77d85a334cd12aafd6a1178b47e522a3c9f4484", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646123489, "uuid": "5995e8cd-7f44-4c0f-b910-6a20918bd4a7", "comment": "Malware payload (Heodo)", "value": "c51c73af8912f5f9231a189370d970847afe19cd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646123489, "uuid": "84ae0f12-86be-4c45-9e7a-c1d83a99c652", "comment": "Malware payload (Heodo)", "value": "2bd2fe8ed85e6154d24b5d8123c714323eb09c39a737e393c8f40be8f1302671d45afb8a5ed1ce2e267076217d1346bc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646123489, "uuid": "1d06a8b0-85e5-42b3-9cd5-a797a01a68d4", "value": "T1D1C4AF12BFD39072CE2F293C503DA77413A95C65971A8863979C9BBE1D3F9428B3190E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646123489, "uuid": "6015d2c2-6497-4d62-bf5c-68e8535bab60", "value": "e0b213ccd96f46d30dcd8e225f4e9fc9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646123489, "uuid": "4334355f-2e20-4f6c-93d0-a0301b8af9af", "value": "12288:onEtDywy8SYlHD70WychG0QOCM8T9xvCkyDyPgyQz/VDNeg:onEtDywy8SYdnhG0QrM8hxKk7a1Ne", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646123489, "uuid": "0c9a0886-1b8b-418b-ab80-9519f3c015c4", "value": 585728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646123489, "uuid": "8d4ea62d-07f8-4720-b772-eddb80329913", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646123489, "uuid": "f40b6dad-ceec-4a94-a695-aec0a20f464d", "value": "8f876cf7e34c4735aa37ac711f28cdc3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0097d8fb-98f7-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1646094717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646094717, "uuid": "881cbb78-4383-4eba-827b-39dbc0705f03", "comment": "Malware payload (Loki)", "value": "31af23fdfebfc4bffb756153bdbc0755", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646094717, "uuid": "2903c33e-c28b-4687-883c-6f4feb8d1898", "comment": "Malware payload (Loki)", "value": "eaeb367d52cff9903448e30811241bbf84044ab542245355c0e9f9448eea9fba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646094717, "uuid": "8cf46f3c-eb95-4111-bc18-cd19ecdf8825", "comment": "Malware payload (Loki)", "value": "a1d029e32f3aa3e19b64168b69f188d73aa6a177", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646094717, "uuid": "7d2751e1-f0df-48bd-8afe-acf8a78315ef", "comment": "Malware payload (Loki)", "value": "a6548953407b315a94bde12894fecaf48b6369bea8f9d7bebdad8ff69a0d6030af29b9392866abc68ba8536659aa70f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646094717, "uuid": "6362892c-8a32-408f-815a-e7c30caadaac", "value": "T151641249B7C525E7E9D71A3834F3B27AE3FE6794111E0B4B63246E6E76624D203280E4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646094717, "uuid": "4e3ab8c1-218c-41df-b1da-391f5b41b595", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646094717, "uuid": "11a2f0d7-82f4-4a8c-af1e-d23b7df5f8d8", "value": "6144:rGiZW9cmOVCvT05uwyllFSofFbU6li7NYF0Du8ZBs5G2Evswkv:9Wa7WEHyllVxU6QNYFoeE8v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646094717, "uuid": "3ba35be0-78b2-4f51-a96c-e7a007d63ba4", "value": 315210, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646094717, "uuid": "0d8f8a94-1904-418e-a174-d1c717dfd148", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646094717, "uuid": "77d0402e-c79a-4d35-9a0b-b3b682bb4453", "value": "31af23fdfebfc4bffb756153bdbc0755.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dfb39b7-9941-11ec-9275-42010a9c0029", "comment": "Malware payload (RemcosRAT)", "timestamp": 1646126683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646126683, "uuid": "16472fcc-428e-4729-8d7d-74fd62d84bf6", "comment": "Malware payload (RemcosRAT)", "value": "3b2fcba54f7f9b9e178f5a1d85299ea3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646126683, "uuid": "df726e0a-7de2-4919-85eb-ccd4354dbd90", "comment": "Malware payload (RemcosRAT)", "value": "eb1d29174d0a65b4ff95f172d35532666fed7cd6659ec77591240777b5b76452", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646126683, "uuid": "a61bb52a-0e07-409f-85b1-f02f1215d817", "comment": "Malware payload (RemcosRAT)", "value": "b3af14d92ee6819e6e0c8e1fd5c030e3235da62a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646126683, "uuid": "36f01909-8cb8-4d96-84b9-bdca47934875", "comment": "Malware payload (RemcosRAT)", "value": "9506441b305e4523e4aa46c02e921bb350a364fcb2551ea34d27d1c2af9ffd8df71fe2a6b6499456de0300de5fab5d33", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646126683, "uuid": "e2c2f32f-41c4-4bc1-ae9c-1a3922f3296c", "value": "T11835122EEBEC0D1FC65D0DBA542172B143768753B647FB891AA905B940F23A14A2F393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646126683, "uuid": "48dc4353-1f98-4e97-a82d-33555d4a629a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646126683, "uuid": "3d9dd996-824a-4580-9b59-582aa06e233b", "value": "24576:eXvWVxPmXnHvEWA5FX07fZxNk3xTrbud7YGx9lzma:e/W3P4PK5FX07ZsNmd7YSzm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646126683, "uuid": "acf04845-a508-4c07-8726-cdb821ee0f43", "value": 1076224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646126683, "uuid": "a92526b0-a339-4654-a222-e67297669b56", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646126683, "uuid": "1e86f74e-ceb3-4df1-a7cf-e68f5a3e7a72", "value": "3b2fcba54f7f9b9e178f5a1d85299ea3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "555506d1-9935-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1646121488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646121488, "uuid": "04e166fa-b5a3-4382-9295-cd6bd8c853c6", "comment": "Malware payload (SnakeKeylogger)", "value": "9f9f6b9be0df6ec8d8442e852fc11b62", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646121488, "uuid": "887060ab-bacd-4733-b105-9f4528743c91", "comment": "Malware payload (SnakeKeylogger)", "value": "ec4d5729e0c5cf1bac80aa8a3c8debde962dd6236f2f2a3cdd2ddd76549fcfb8", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646121488, "uuid": "a416bee0-85d1-49b3-b977-798452d55cb6", "comment": "Malware payload (SnakeKeylogger)", "value": "c6b3a793424e865692ee1980228060fb7c8450cb", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646121488, "uuid": "51f98860-e9d4-4ae2-9e7c-d2dd063aefaa", "comment": "Malware payload (SnakeKeylogger)", "value": "523791f7b2416ce45dc4f8fd2d3f8e324807a92d6ed403537576b32cad7f45326d4541b7375b39d011a0fb826517e374", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646121488, "uuid": "20f9d530-9e86-4300-b0a7-9d95fea8cb4f", "value": "T11BF423A5C57CD1BEA2543DF21CBC74D49A67DC1C699A376F308CF12C8A964F240B4E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646121488, "uuid": "c1570fd5-5a12-4cbf-8fd3-398ad497d5e8", "value": "12288:pVUDbRZrbvC+OsSul4qb18JlMIZykq7dZtCTpUnRo6J7JAT12VlY6W:QDbDCsCqbunMKykE3mqtH02VO6W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646121488, "uuid": "b1e1a14d-a419-4fa2-9da9-f192ee01def4", "value": 739393, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646121488, "uuid": "2fffd7c2-f470-43fb-a426-b68df58de3cd", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646121488, "uuid": "ed0d8766-cf8b-4a9b-9f90-c06d835aba32", "value": "proforma invoice.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f53d735-9985-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646155945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646155945, "uuid": "7758f854-59d5-4ac4-8d58-f64890ca1e5a", "comment": "Malware payload", "value": "d06a6d69ea0900ed701efb60a370b561", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646155945, "uuid": "5862a9d5-d1d9-468b-bd3f-098e74744c54", "comment": "Malware payload", "value": "ed68c52130df139c9a182af30be80ff0b6b9645ccaf09f021cc7bebdced97385", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646155945, "uuid": "091f1059-c9d3-4ef6-a3be-92c5e23a4dd5", "comment": "Malware payload", "value": "637b20b78627127080c238a5fda874c70a7bbe3b", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646155945, "uuid": "dcf5e1cf-d0f3-42b2-81ac-f9dd73a4ac12", "comment": "Malware payload", "value": "697658a2159fbe19669a3b8456e5ebccd5e9f813f5bd7e875951e33c113279e359b6b3c41eed2c1b148edd15a5696c2b", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646155945, "uuid": "b2a4ca36-feea-430d-a307-d00dfcf865bb", "value": "T19514029C2234CD6AF19B63BB24CF981C9FA1EE1EA7D450D8282FF11C09B36414B9E575", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646155945, "uuid": "889742fc-0e78-487f-be0b-ee1e19cc109d", "value": "3072:DxeIFeV+l2AGdybB5NKYlmiWs2k3BHWC5Wmwy7d1LX0+/FAWeC:dP5MAGQjNnlGm2C4mwYlkIFAbC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646155945, "uuid": "4a44e439-0fa1-43ac-98c7-5ef1c4959f03", "value": 191416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646155945, "uuid": "90015704-10a3-4589-a8dc-ed97003b6b10", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646155945, "uuid": "be12507e-5c09-436b-b007-855fb83f2425", "value": "+9053598666_2119-091312-110.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e71db3f9-99ab-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646172413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646172413, "uuid": "04e3d5a9-9508-4e12-8b48-07564e8e5a43", "comment": "Malware payload", "value": "258f44263cbeb0189375f9bfc8453260", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646172413, "uuid": "a90f4ec3-d8a6-42f4-b999-170ef674b4ca", "comment": "Malware payload", "value": "edb304e89702ccbf4db4127ba3519a2ea15db5dbca256eed2daaeeb976e14e35", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646172413, "uuid": "4bc66d1b-ff07-4116-8026-232fd63d6442", "comment": "Malware payload", "value": "63041174ccb5f3621f2b614dc1a91065454cf250", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646172413, "uuid": "f19703c8-e9c0-41f6-8622-164aa6cedd95", "comment": "Malware payload", "value": "366297adfc45db3784e14b2ae1a88dd3486eeeffa4d956ef6a534a1ebadcfd5f120e28b5bfd0b2c75babb52b9cc741d8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646172413, "uuid": "aefa607f-612d-452c-b161-f2cb8b0ba575", "value": "T123B4AE11B7D0C072C26A35342926E7B656EEBC719AF583876FD03B7E5E301D18A2835B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646172413, "uuid": "67d45ee5-d30d-44ea-9d6b-31f6c2ab17d5", "value": "d02245ac5c961d83d0907c826d8ba5c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646172413, "uuid": "e0dce22b-a894-48a8-bfd1-1bb846f1a57f", "value": "12288:JhC1q3aXOwkiPs2iCtyjLOAIlgOkar//wJY8Itgm:Jgq3aFkiPs25aL2Bkm8jm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646172413, "uuid": "92e1d591-5518-47e8-926d-46877d3c839f", "value": 499712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646172413, "uuid": "d4199833-9510-4335-8186-91fa37858b76", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646172413, "uuid": "375da797-b366-4696-8994-7134203aedf7", "value": "258f44263cbeb0189375f9bfc8453260", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e55fa43-998a-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646157930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646157930, "uuid": "0e4e409e-d99d-40ba-ab54-3caf364aa315", "comment": "Malware payload", "value": "fcfaf451a01431be7b8ca48651d3d9a4", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "conti", "colour": "#3F4B04", "exportable": true, "hide_tag": false }, { "name": "conti source without locker src.", "colour": "#0F0580", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646157930, "uuid": "6c2662b3-3715-4eca-8461-79a2df4bf7a6", "comment": "Malware payload", "value": "ede451e9a65e55d0827e217a25cf895163c46bc42432f7cbed0f46d99769c385", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "conti", "colour": "#3F4B04", "exportable": true, "hide_tag": false }, { "name": "conti source without locker src.", "colour": "#0F0580", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646157930, "uuid": "90218d15-7391-49be-a38f-2adfa1432655", "comment": "Malware payload", "value": "fddd8d21f2232d4c434a04cce7c72fb6b6574dc4", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "conti", "colour": "#3F4B04", "exportable": true, "hide_tag": false }, { "name": "conti source without locker src.", "colour": "#0F0580", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646157930, "uuid": "22e8f0ae-466a-43b2-8b05-84682652a9ab", "comment": "Malware payload", "value": "0fee52e540ab14b8fc8d1a6c3f9bf73b60692337e93852cd9a3a2c6e62fabbe6f5198af442c72daa7c522577c9e8c6a1", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "conti", "colour": "#3F4B04", "exportable": true, "hide_tag": false }, { "name": "conti source without locker src.", "colour": "#0F0580", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646157930, "uuid": "4c9d7e13-4b8c-4477-9dba-a071e5bc5b72", "value": "T16CA533560A6890E0527C8EF1FEF8917F39B22270AB1BD50EBD5F83C6FD219985719903", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646157930, "uuid": "dec6e7a5-3141-40b3-b866-76a0eebaaa17", "value": "49152:rlfNRv32qv9+E7BzaFWR9KqJmGj/sXl/OBru/3Wnl:Nvv3j+E7tac99Jm0/sXl/O4fWnl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646157930, "uuid": "02beccbe-c8eb-4c0c-b4c6-0e089c48dc36", "value": 2209054, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646157930, "uuid": "ff32194b-9920-4e8c-bff8-64bfb7f59d12", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646157930, "uuid": "6f471cd9-284e-4983-a981-9181109f655b", "value": "conti_locker.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "092173ae-9954-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646134675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646134675, "uuid": "6ffba54b-e8e7-4b58-bcd9-3d1113f66193", "comment": "Malware payload (Formbook)", "value": "53396d485c926a1d433bdad055f0aec4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646134675, "uuid": "8c6d1efd-1567-4601-91de-9f1a488b7d0b", "comment": "Malware payload (Formbook)", "value": "ee179e6521feb096721ac2888a9b4d7819811fbe0f88cc9367f097f626848e59", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646134675, "uuid": "eb162ae1-e956-4034-b5f4-0b51f24f1605", "comment": "Malware payload (Formbook)", "value": "b484e05667c08893cbb74d253aa7392a89ab8ad3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646134675, "uuid": "1cff4c82-4900-4d44-a3a3-6ebf6039d25b", "comment": "Malware payload (Formbook)", "value": "2a4b68eb454c6501d48a1c3801fcbf2fb9ce6787ca26094994e1eb969c7f3a5c9781ef1b7a76a93d5483b8a7a3159410", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646134675, "uuid": "f552cc55-e99d-4877-9937-5a3ece8003f2", "value": "T15E15AF4834E6607DE836CBB1CAC0EFE0DB6DF232D54960B650020E59960DBBD8959EFD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646134675, "uuid": "8f4b267d-6f70-4d40-9086-7bd8bbab4299", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646134675, "uuid": "cef7ad10-2e64-4477-abe7-e4365c744da4", "value": "12288:B33J6T+407pB5aGsWN2rg1dGW+XNWD9FEU2Q79BCM02teFaPnUggDyi9OzDsdORf:Db4UfE7rgrG/NWoERUM02rU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646134675, "uuid": "a83ebd3a-b34a-41f9-bc5f-ec3645257e73", "value": 885248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646134675, "uuid": "41c95735-04ac-4ab8-8fd2-2846f9f2fb34", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646134675, "uuid": "42228388-d228-43cc-9339-d1fe860715bf", "value": "grace.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f3fec0e-9931-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1646119760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646119760, "uuid": "e15eddfd-84cc-4539-b3df-fb9deaf764e7", "comment": "Malware payload (SnakeKeylogger)", "value": "83455fe3ae7a282ebc13c569dd96a338", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646119760, "uuid": "881a2599-79c8-4fb2-86e3-dc00f136821c", "comment": "Malware payload (SnakeKeylogger)", "value": "ee7e65f5b2c58f03f080647c57d14cbf1dc9f1c9eceac8d96e61e7e59373c9d7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646119760, "uuid": "cbd02ee8-d90d-4d71-b41b-e04d7cbe3322", "comment": "Malware payload (SnakeKeylogger)", "value": "3b9d3615d00ba4793a46a8b4cf0e62386cd9ae98", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646119760, "uuid": "88e5f520-e5d0-4526-8073-317bf9e41491", "comment": "Malware payload (SnakeKeylogger)", "value": "496561a0198348a76199c792dc29edd98cc3b653a51be871c8f33a0fcb580b51f6db6eef5a70268f4ba84076714dcc9a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646119760, "uuid": "1cd23f67-081b-4464-9aab-0059b27fd20c", "value": "T1BB84DF5172377B96C2783BFDA96D813417B8BC551842D299FEC0B2CE243EB401762B9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646119760, "uuid": "82092f7e-cdb5-404c-a61a-b69203756188", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646119760, "uuid": "f9f4b1bc-2ed5-4589-9097-c47b05c50124", "value": "6144:XWtvJ/xaWAYzafAEjvjC30HOUsBpJMO/kQ:YFxzFzapbXcBAO/k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646119760, "uuid": "92f0ec65-dd03-4f26-ad47-872659516a19", "value": 378368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646119760, "uuid": "de3cc183-ebab-48e4-804d-4867e501853a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646119760, "uuid": "56fbe147-326a-4ae0-9e47-304fb9a18233", "value": "83455fe3ae7a282ebc13c569dd96a338.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df6e15d0-9985-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646156079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646156079, "uuid": "09d83724-293a-41d9-8aeb-c81acef6c022", "comment": "Malware payload (AgentTesla)", "value": "71435befef5c09ed44d846aeaa7abc85", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646156079, "uuid": "ad8626d3-3c6d-4a70-8180-4b1440ad67d0", "comment": "Malware payload (AgentTesla)", "value": "ee8656bc04cf46426dee986274be3144f9f0615720de3d06efe50d5f9496e134", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646156079, "uuid": "3ffd1b1e-b8f7-4baa-b90d-8b5627c006b4", "comment": "Malware payload (AgentTesla)", "value": "827e922966d0a8c2b82a7df9a96a9e913f2af6e2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646156079, "uuid": "f172b8bc-91e4-4faa-9fe6-e9e640cd3dd8", "comment": "Malware payload (AgentTesla)", "value": "95595937cd68eb6dad5f4d02af0fdf82c5c9f4b9839a3906aa43f76c55e1bff6bf68108685d79898319dd20626b6a025", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646156079, "uuid": "852eaabf-703c-49ca-95aa-581b65e98c7f", "value": "T18915BF5834D6607DE8368BB1DAC4EFE0DB6DF222D54960B254020E199A0DBFD8E05EFD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646156079, "uuid": "64024c36-7665-4f2e-9f32-b187de9a682a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646156079, "uuid": "88bce206-35f8-4bdf-8d18-cfb576b31b0c", "value": "24576:A/avs4gRun8h0FO/927cNMUc6vHJtgepnW/JaeAU:e45n8a6UbYJtzt3U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646156079, "uuid": "eaa22147-2a9e-4fac-8a60-f8d37e4e9dd3", "value": 947200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646156079, "uuid": "185cea85-77a1-431f-9a1b-fc32266f9612", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646156079, "uuid": "78ac2546-1568-48a4-8722-44bd6600123b", "value": "e-dekont_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19940dd4-9946-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646128689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646128689, "uuid": "94fd838f-956e-43a2-b9c9-b96dd6c5625a", "comment": "Malware payload", "value": "8c20f165fd9c418d5c2258e26869ea29", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "Zimmi Consulting Inc", "colour": "#2C39C1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646128689, "uuid": "3c48e516-54c7-4034-a10a-324411692753", "comment": "Malware payload", "value": "eedb63fc49270abf961bac922b91c045b8824edbd7267a027d139a39ca7ccf16", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "Zimmi Consulting Inc", "colour": "#2C39C1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646128689, "uuid": "02ab5c30-4582-4576-867b-91e2791f7dd1", "comment": "Malware payload", "value": "c2f612ce4e02c93eba4f2b0ea5c3837a1c1b3af4", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "Zimmi Consulting Inc", "colour": "#2C39C1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646128689, "uuid": "087e9e75-d478-45c8-b3aa-a0d688cfd0d4", "comment": "Malware payload", "value": "a7153ef2a6f9596e5d935caf0636e0eb5df32bb9f5e1ff50c3795926930ae651b8d3c80c472140e7379ade8682092684", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "solarmarker", "colour": "#1340D1", "exportable": true, "hide_tag": false }, { "name": "Zimmi Consulting Inc", "colour": "#2C39C1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646128689, "uuid": "8b8b1ae4-236c-4e9b-9e3e-17019c0111e1", "value": "T15A1633CADC16BB6BD72EC0AF0DCD59247C2742BE8DB25B23306678835D42653742892F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646128689, "uuid": "970a3421-846c-4674-84f1-0a3ad050b03a", "value": "98304:VHBlOvtkSg+pshDn0o/nZQ7e8bHqTetvHcuS6sARe:YtkSg+pshIWZQjbKTeZcuS6BRe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646128689, "uuid": "f4033730-2200-4ea3-b7f0-fbaba04f341b", "value": 4391496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646128689, "uuid": "620cfbd4-bc6f-4092-ada1-02860777e9b7", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646128689, "uuid": "fcf92dad-3312-49ad-8045-73d8557ba18d", "value": "2f7287a8b0c612801e77de6c2f37e22e0a67579f203a0aaf40095bf6ff70e6ee.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70183480-9933-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1646120674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120674, "uuid": "9339c341-3ce5-4369-82e7-a9c73224cf2f", "comment": "Malware payload (Loki)", "value": "11faeeb6b5f236a303cb228e58ecc4b9", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120674, "uuid": "12439b7b-e28d-4faa-86ad-69035b9d2ce3", "comment": "Malware payload (Loki)", "value": "eefe6dac1c83017f2a49a7357db85997ea4a07915385a28e27e68ac692a84a35", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120674, "uuid": "0fe2aa7d-4296-4fbd-8040-c74bdc93e4cd", "comment": "Malware payload (Loki)", "value": "91b9bf482955112301b71539b5943af3767a0c69", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646120674, "uuid": "bfa7e2e6-8fca-46c9-b828-3e8b7ed6c9af", "comment": "Malware payload (Loki)", "value": "08fe554f10ee4abdf64132130918fecc98c10b5d51a2369a1b3a6af92dec2e6ecee9e7edb0a06678793a065a4ee828f4", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120674, "uuid": "62f28171-8173-4f6b-83f8-251ba4e82c5d", "value": "T17614023DF31AA8B5E935F7BD450AEA8F981CAF40BD02B0A115863A731879C31C5DE176", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120674, "uuid": "a7aab018-2ab2-4da7-a2f2-0e947b39277a", "value": "3072:xp4lOhXPSsQG/Zt5Qqzk83gPjeHXklufUcvSkckxukjQnp4X/S5zvOAvPVy:XNhX3QE7Se3kh+SfyukjIpgS5zXPVy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646120674, "uuid": "d85f070f-e35d-4333-a2db-63e531e24754", "value": 190824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646120674, "uuid": "52812f69-9c8d-4d01-9362-34842ca09e31", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646120674, "uuid": "f7f669ad-a452-48f0-b77b-4666303d8f83", "value": "VSL MV GRAND SEA.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca3e62e9-9942-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1646127268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646127268, "uuid": "f9b819ea-9d75-44cb-b950-b2f7a29505f3", "comment": "Malware payload (Loki)", "value": "01a719938de7651a358f0e28bc2d3fd1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646127268, "uuid": "824a9414-a554-44c7-a571-fe7f32d7b061", "comment": "Malware payload (Loki)", "value": "f0a8402a314c9edd311c5f116bedb2655f588ec920548f7c62ce1d5c36d0e8e7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646127268, "uuid": "562d1971-35ea-4c62-bac9-dfab70e7c35b", "comment": "Malware payload (Loki)", "value": "72de659c8926223eb56b6a829c4a404f669b5307", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646127268, "uuid": "35a207f5-c818-4e31-97a4-65ae83486f8e", "comment": "Malware payload (Loki)", "value": "eab80c0861a84c81f99b9c598b98583a267dc59e7d85cde4db30e9eef7ae310411c5152a183605aaaad2636fb153440e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646127268, "uuid": "b01b8285-970c-4d3f-bf9b-80c7afe87c90", "value": "T177642258F68898B3F4AB0B3010F7CFF9AB358779655219235FE02EBE2E741854C1A961", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646127268, "uuid": "5601c330-6d73-4888-97e2-babc0878a2ad", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646127268, "uuid": "d33ca030-0091-4a74-a3a2-f2d1466c5ede", "value": "6144:rGiqZNJwADQcwyzFDA/0mw35iEQp4aCiTfjeSkNPCh9tEH05BJo7ViM+18w18p:Gf0cwy+/035ds4aCifeSEcUoBeJLF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646127268, "uuid": "2f2a3af4-b9b9-4bf3-a1d3-cd18be1f5cdd", "value": 308508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646127268, "uuid": "5be9449e-4287-4934-b7a7-42c539129ff7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646127268, "uuid": "4eae15cb-2fb4-4a31-b597-acd8b896281b", "value": "01a719938de7651a358f0e28bc2d3fd1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87ec685d-995d-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646138753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646138753, "uuid": "99c6fd0e-43db-43c5-bdf9-3b5e87f6868b", "comment": "Malware payload (Formbook)", "value": "75b63a4bf9afed7f9900275d245df7f8", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646138753, "uuid": "2c30f81e-0a0d-4c6d-9ae4-08084e8e04aa", "comment": "Malware payload (Formbook)", "value": "f158c883db7803a14c124e29a3adb1b72cca3168d904f7cee2a6ebbbdc535ca3", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646138753, "uuid": "735b4620-5675-4905-ac05-3e6c2d27b15d", "comment": "Malware payload (Formbook)", "value": "ed2d1f0974628efaaf1437712b5cf09165a8222b", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646138753, "uuid": "79c9679a-e55b-46e7-9c12-833d22665aef", "comment": "Malware payload (Formbook)", "value": "fceb89460123126ae26b123515cab1fcbd5b847c3fb418d4dc5810c8c72cdb70e59a08868a6958b3aef1f1efec164196", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646138753, "uuid": "ac627d44-3ff1-43e1-9879-99474954f1a5", "value": "T16914126D9FA12976CD7E023F4D3D92080BA6EC355D4060A660AFBD4D1BF25C48C5CBAE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646138753, "uuid": "9e159291-7d3f-451e-bb44-9801974b3951", "value": "3072:1c+WX2+q1au/OrMUIDPUYzdeMyh0wB3TXN+yQspWt+3F65zCcJ7pRkC73ZCA:y+WXxVuFUYPUYpqf3hgsUtWs5VR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646138753, "uuid": "f096565f-6d36-4ff1-8110-01900387f4ea", "value": 190536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646138753, "uuid": "003e0be5-38f6-49cd-b7cc-bc4db720d1d4", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646138753, "uuid": "f2960c6c-06fc-432f-852a-233738ef6bb4", "value": "PurchaseXOrderXNo.XXPO-4147074X.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66765ec6-9936-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1646121946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646121946, "uuid": "b825e2d0-f654-49e7-a3ac-c4f4ef231b7b", "comment": "Malware payload (RedLineStealer)", "value": "3050bec85096f1cc90e39f91344737f7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646121946, "uuid": "cb2c29b9-fee6-4e1a-bd3b-f3512cbe0108", "comment": "Malware payload (RedLineStealer)", "value": "f17e1cfd36a8b50f468c93d86bdd7cf443f3db0e18bc75ecf5e9c2aa21149d54", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646121946, "uuid": "23308d69-0030-47f0-a453-df75a6ac42c2", "comment": "Malware payload (RedLineStealer)", "value": "38d226515655c9b9a523bce0f485f541c024f0fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646121946, "uuid": "3969a83c-6107-453a-a35f-670a3fd8f47e", "comment": "Malware payload (RedLineStealer)", "value": "a6c0dfee974421f1c0034b66aeee98a886fa55444737e9faf059295ae9cf66b7f46fce3e55f727127dc5a3515f4beefc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646121946, "uuid": "292c6431-0ac1-4501-85f4-36345612b81d", "value": "T1EB649E10B7A0C035E1BB12F8857A93ACB63E79A15B3461CB62D567EE56357E0EC3130B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646121946, "uuid": "fbc0c20a-9a6b-456f-b3df-d646fa48277a", "value": "571651a80e4ab2d7da8009fcddc6a93c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646121946, "uuid": "64248551-df6c-4c6a-a7de-a4963ce8b555", "value": "6144:icd3Ta5KqysnbrSN3cVc6p+ZE3Th+Hi+8CSYP+Y:FVa5FysyJcVRp8wTAi+82/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646121946, "uuid": "eeeb047d-dbd4-4a88-90ec-df280fd0daa1", "value": 332800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646121946, "uuid": "46fe55af-ae2d-4774-a861-fb608a497b5c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646121946, "uuid": "c26ff534-b315-41f5-af86-72e35c04fa2f", "value": "3050bec85096f1cc90e39f91344737f7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f7cf8cf-9942-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646127142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646127142, "uuid": "ff71995f-8a64-4010-8a5a-a9617a9b3705", "comment": "Malware payload (AgentTesla)", "value": "5b1499509c000ef4a371c5464adc095c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646127142, "uuid": "11483857-ea89-450a-8410-684f8124e0ec", "comment": "Malware payload (AgentTesla)", "value": "f1c501a55890d4b116bd0d76d81a2c3a6e6256c20d05e644202b07f7ce7f478e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646127142, "uuid": "511751f7-f34d-48aa-a141-646d24daaf12", "comment": "Malware payload (AgentTesla)", "value": "474f47ac31933edfb4420a504dfd823790389edd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646127142, "uuid": "56fc9ad7-bd55-4b69-a87b-890253c01d1e", "comment": "Malware payload (AgentTesla)", "value": "87af87c46dc3aee89a0aa5e1717807ac4bbb81fb5008a17550ba418b9332ecdf6938a5e7f53ad42d3c28e5ad70e40598", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646127142, "uuid": "c0e3e909-261b-40f8-8820-11937e0058a2", "value": "T15FE4238D3A1B1743F1858F24A1490B8812A79180BF3AC1346753BBD8B5662F5F5B3F9E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646127142, "uuid": "4552ece1-186f-4d83-beec-0b7d0424b719", "value": "12288:zvIDo72S66latLkD3rTg8zZn6Vq0fxLIGhE3lfFmmX2Ytz8:zYyTg8zQn8M2fgmXFo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646127142, "uuid": "6a20d521-8e25-446a-90ca-ef5d352e9fc6", "value": 707947, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646127142, "uuid": "a374dbde-f408-4ca8-b76a-5e1e4e753037", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646127142, "uuid": "7ad2bbb2-15bd-4e3b-988f-ca1feee9b7c2", "value": "Copy of Shipping Documents.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4d20673-9955-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646135365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646135365, "uuid": "8a013a1f-c34b-4c33-a965-ae0736d953f9", "comment": "Malware payload (Heodo)", "value": "1451f93bf8c3dd65ab337f1d387bcfa9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646135365, "uuid": "5b8e3460-6063-42d5-87c7-c983a47f3544", "comment": "Malware payload (Heodo)", "value": "f1cd058b4ecc7b9cccbe8637d5a229c970f0613acfd6683e0913a5f007bfceb7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646135365, "uuid": "7def1cfb-38f2-47af-ac60-969d421ca03d", "comment": "Malware payload (Heodo)", "value": "accfb64302f60c1017784e83043be233d1b3f2ff", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646135365, "uuid": "08e83e47-4e92-4b85-a576-590fdff65dce", "comment": "Malware payload (Heodo)", "value": "6c6f3024f5c9a190dd8e5d34345bf48dd18108e6a2a7b4f90eed0b00ba4460d9664aaaac43bef097840949c94dc5dca0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646135365, "uuid": "0ee4e9d3-a822-46e7-99d8-b78e4ef81b62", "value": "T147C4AF12BFD39072CE2F293C503DA77413A95C65971A8863979C9BBE1D3F9428B3190E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646135365, "uuid": "1d6fa9cb-324a-4353-8154-dadeacd840a5", "value": "e0b213ccd96f46d30dcd8e225f4e9fc9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646135365, "uuid": "f16bbb36-4053-4adc-a8e8-4ffd93795cd2", "value": "12288:onEtDywy8SYlHD70WychG0QOCM8T9xvCIyDyPgyQz/VDNeg:onEtDywy8SYdnhG0QrM8hxKI7a1Ne", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646135365, "uuid": "dff7dc32-1112-4d2e-8dcf-8690a0a4834f", "value": 585728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646135365, "uuid": "ec5cfc7c-8b5f-4aff-b222-da2b48c6265e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646135365, "uuid": "9de2ee34-bed4-4d80-938a-5fb37ef5c522", "value": "1451f93bf8c3dd65ab337f1d387bcfa9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fae11e7-995f-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646139544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646139544, "uuid": "065b18bc-fd29-410c-9cb2-23754edfe534", "comment": "Malware payload (Heodo)", "value": "c9240311ca1b1e69515b6a54d3669727", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646139544, "uuid": "f505ed27-5bae-4e4e-95fa-b961ca347c68", "comment": "Malware payload (Heodo)", "value": "f26b195219bbe20f70f3b43645a64e543893d1ad6ea4034da2e9b45a6c8f12af", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646139544, "uuid": "bac8a023-6b52-40d1-8b5b-b662e0649684", "comment": "Malware payload (Heodo)", "value": "2a11b1f9c2b090e60fd318e4b88f01bab841de9e", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646139544, "uuid": "5fedfc08-735e-4c85-85e0-ab100bccedaa", "comment": "Malware payload (Heodo)", "value": "1269a725c2a14c483a17fcba3eef9784e41b4d9b52308dcd8023534f27c9a011d7f76774b982b17d70370a294562bbf0", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646139544, "uuid": "cf151478-cf65-449d-a6da-8d1fd3ff6e94", "value": "T19813D019C4665ADDC327693DD6149AF4120C0E0A89A1FA9F1C54B39C2B6A1F70B5FCF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646139544, "uuid": "75701ef3-1c1c-4470-86c1-0ad75d949c61", "value": "768:K/omdH+DOevZCwttqyKfcrND59V+L9Rw4eWrXcTqZ0VP2HLp:momdH+DoylND59V4jwmXc2CVCF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646139544, "uuid": "4588c7c9-a0df-4b38-80ed-1eeed6a5158e", "value": 41827, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646139544, "uuid": "1395cf9e-c98e-4854-bca5-6bd479f5bca8", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646139544, "uuid": "828b5690-4c2f-4fbf-901c-70864be69fe2", "value": "Invoice_513304056_CW33435164.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab733e73-9956-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646135806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646135806, "uuid": "359574af-528f-449c-8c2f-62b240c4fabe", "comment": "Malware payload (AgentTesla)", "value": "fb8c48f2765ef4083402247135312781", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646135806, "uuid": "d08c49dc-c591-4f04-b69f-8a41f5364217", "comment": "Malware payload (AgentTesla)", "value": "f318e7f5f061989f22764a25a591a322831dbf7ed0080a06253760d7e98929f0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646135806, "uuid": "b7476e2b-d4ca-4a2f-a975-f2302f6a0d31", "comment": "Malware payload (AgentTesla)", "value": "bc2e8529bc55fb5ba039cbbc3d961192fcaa3208", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646135806, "uuid": "8d614e3b-e234-4378-b0de-21c83e2ac8a6", "comment": "Malware payload (AgentTesla)", "value": "ad80f74924bd31092177fd252d6009ff56339fa8c38baad386d37127c37ab65e863425af6557478c660cfbf6b3dfaed3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646135806, "uuid": "e7b6fc63-8ff2-4448-80b6-6d7a69f69121", "value": "T1CF05122072A82E33C97C10FD455229616BF5012675A3E3C5ADC7E1EB23E1BDB0A51EDB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646135806, "uuid": "bc3cb9b1-08fb-4fcb-a782-aa2d04441273", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646135806, "uuid": "151b5368-8381-4615-9815-57c9d805042d", "value": "24576:VXLuaLUYhfn/Kam2HtnhxcyEP7R2ytX5Xm:xXtdm2CQytp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646135806, "uuid": "731ad3b1-f97e-49a4-98cf-3f079d937140", "value": 795648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646135806, "uuid": "9667a6d6-77fe-4388-b720-4dabb8b9e87c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646135806, "uuid": "5af5554c-d4d8-4d4f-99cc-dc972d5f08cd", "value": "TDS PAYMENT INVOICE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79123a8b-994d-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646131856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646131856, "uuid": "8edd0230-a021-41ba-8824-7692e1477b12", "comment": "Malware payload (AgentTesla)", "value": "7e745c92459c25e1a5eb045a4ea1a638", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646131856, "uuid": "975a4d0e-6958-40b0-8db5-6223c7ecd5b5", "comment": "Malware payload (AgentTesla)", "value": "f32313541169b4b774215aed7bf6c06e5823a8441ec1de28a647676bc68c02f2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646131856, "uuid": "a19ea52f-4c3b-41bc-9c6d-27040e78fd35", "comment": "Malware payload (AgentTesla)", "value": "0ee50a80e54f5da3885bc0b72451b9a00b41ac98", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646131856, "uuid": "cc766ca1-41a9-4b03-95a1-fab9d6ec4936", "comment": "Malware payload (AgentTesla)", "value": "9e3657e4c058047b2508f45bd44aca1f613a86fec0c996495058d4ef2b250ac7509444c25b4806d2bc5b41a2b7aaab66", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646131856, "uuid": "16c1ff33-7bca-4acb-9ce0-a211af125ed1", "value": "T13F24C36CB5D1FE8CD61C3135C62BB1118DD548B01A58807A2A7167EB32B32BEB64FD39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646131856, "uuid": "65e249cf-788e-426c-8b53-b7c4117ed279", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646131856, "uuid": "ea3c138d-1f4b-4b0d-a9ac-dcacb745e093", "value": "1536:MUMkm7MYqt3NgtHMm+CtV6pEzBgntoRJnQ4qe1mM:z3rdmAS2ntoRJQde1f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646131856, "uuid": "e554df19-da68-40f2-85d3-c645148c8f7d", "value": 209920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646131856, "uuid": "ae1d72d3-2ee2-4e10-b7a5-3d35a4e84eec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646131856, "uuid": "6bc6e464-9def-49df-b158-6bdeba0a8b7f", "value": "Balance Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7b12445-992c-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646117814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646117814, "uuid": "c9796344-4ad6-4b4a-902d-c6a5cbc9cd4c", "comment": "Malware payload (AgentTesla)", "value": "b8853601958d7927a7f76d0ef62df0a5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646117814, "uuid": "48222974-b6da-47e5-9478-e744f45b5253", "comment": "Malware payload (AgentTesla)", "value": "f40efd6dfe213fdabdf99ee9fbf9396104a0ca77c7b9bd82fb9687bfaef300c3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646117814, "uuid": "9a4e40dc-0476-41b4-a11f-4074f1fa9bf8", "comment": "Malware payload (AgentTesla)", "value": "4113dacb3e8b114881f3ee393a6ea7879f0dd822", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646117814, "uuid": "e2790b34-36f5-411e-9a4c-9b1f39a41d0a", "comment": "Malware payload (AgentTesla)", "value": "73fdab8ec3eb4f5557f196603a5652863f320d82bddd59a1054f044e21d9578e0f9bef7a70f42e36b5ed7843551962f3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646117814, "uuid": "f1ebb5a0-8226-4115-9e9d-3df85965f5ec", "value": "T1E613B596FEEC4571EDD58B7E6CB2CE701662BCFA9830982C24DD7E2B39737404621126", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646117814, "uuid": "a720b521-01f6-4300-ab59-5c284867bca9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646117814, "uuid": "3da3a252-753b-4ff5-a8c9-3ee14b7219a0", "value": "384:rg7dN0dyICfgccn5gA/Qe3P1hwDBS/mPcLHC6XoxKXXHrzCH2:E7OyICocsgPBcmiXLuH2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646117814, "uuid": "a83564fa-5702-44f5-87da-defdd78ddc59", "value": 41984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646117814, "uuid": "888f5709-a5c8-4a36-8702-004d921da29a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646117814, "uuid": "84a9c34d-f4dd-48ee-92b7-d9586e924831", "value": "IMG-SCAN280222.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5587ea2-9967-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646143205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646143205, "uuid": "7a6b365f-7cbb-4e64-8e91-8497e167ad5b", "comment": "Malware payload", "value": "7e008451e300e6a6d286183ec8446729", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646143205, "uuid": "67930ef7-fd1d-40d4-b4e4-fc9d5ca744f1", "comment": "Malware payload", "value": "f41a63c8be51589077bf1561a65023b0a346cd612af7b6853a801643fabbec00", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646143205, "uuid": "c26b2410-9d34-4dc9-bfe8-e1614a8b331c", "comment": "Malware payload", "value": "cc537329797dcb327092c0ef56f4614316a10d4b", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646143205, "uuid": "ffcc8d3e-9ed6-481c-94a3-543f5258758a", "comment": "Malware payload", "value": "91ab1d5d8a6d06da0340e0166c65b957ef3eb9dfd5f209ef43bb27187492c110b24be20f3c794a8817e0d34b86bf63dd", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646143205, "uuid": "eef29e81-de69-4511-92a4-9a1264a43261", "value": "T1FBB533106AD117C9D554CE2B2FCC9936043BEFCA7964EDD782E38AE1100EED5AA538B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646143205, "uuid": "6258ff62-6983-499c-a6dd-08ccc27dbfd0", "value": "49152:G1wBp0uBd5QU2GmjKSGLZyQOA/K2ATGgnT06JjF0h6lMNAeeS3es1to:G1wwAjzIQOMK2GNKslgus1S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646143205, "uuid": "92b780f8-d60a-4057-9487-fec1a47a3e6f", "value": 2490368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646143205, "uuid": "6c58d487-fb18-407d-9d64-255a0a86cdba", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646143205, "uuid": "49cf4688-cb62-4dd9-b773-81571b83aa4f", "value": "f41a63c8be51589077bf1561a65023b0a346cd612af7b6853a801643fabbec00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b0ce4a8-995b-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646137765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646137765, "uuid": "faeeae9d-8bc1-45f5-adfb-6c8323a00ed6", "comment": "Malware payload (AgentTesla)", "value": "9c805f0bd056a7cc2c65e03f85a4be86", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646137765, "uuid": "2e083312-6033-47b4-8371-f0b0b5dcebe6", "comment": "Malware payload (AgentTesla)", "value": "f4898507d11006720d9ed51cd16c53ecfee6c662d9d42c85734b4873ac59c72d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646137765, "uuid": "acf1215b-8257-4561-bfe5-1c17f804ea48", "comment": "Malware payload (AgentTesla)", "value": "4a0b2beebbaab1dbb829db737cd0f91947af1b02", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646137765, "uuid": "f48855f0-5caf-4eb3-9536-8bd8c765ccdb", "comment": "Malware payload (AgentTesla)", "value": "4ba9a87c9d999d9c91eac7ab824571c6cfd42bae1aa26de6711680d6b38ed4520c0ec30c889302b9872eb852908c9f19", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646137765, "uuid": "6ce2b40e-01f5-4817-9134-a95631c99c84", "value": "T1FC25CF4834E6607DE836CBB2CAC4EFF0DB69F122D54960B654020E59860DBBD8E45EFD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646137765, "uuid": "60491ff5-c96a-4996-9e95-2dcc595cb004", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646137765, "uuid": "05ec10f6-7776-49e8-bcca-2bdf98d8f2c7", "value": "24576:bW3DN5gvAMwM9/dmkQAbLCuEwua6JJ3c+FOJQL:a3DNavwMVokQAb+ujuHJRcQGQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646137765, "uuid": "a8f4fcbc-c1f4-4d66-bfb7-ca9089db0a68", "value": 969216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646137765, "uuid": "bf019ff1-89aa-4eff-9f39-b97b6878275c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646137765, "uuid": "1797b59f-f887-4b14-b3a9-c46ed9ba4a50", "value": "New Purchase Order for March 2022.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be6178a3-994a-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646130684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646130684, "uuid": "998ee7ce-e891-434d-b0f5-b015f7f66f5e", "comment": "Malware payload (Heodo)", "value": "80e970f328d0ed0207d2d4173c1c3eef", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646130684, "uuid": "1d30f277-92a5-40ca-9dc0-6ea805db4072", "comment": "Malware payload (Heodo)", "value": "f4b6055fdc6e8b62ab02d533ac54e9d55e879ea3177652e75743b2d5e7038c88", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646130684, "uuid": "e9994719-4201-44aa-947b-443c5f873979", "comment": "Malware payload (Heodo)", "value": "46f2e85d937811352b18e32161e811a0d10b0c51", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646130684, "uuid": "1cdb2597-79af-4fb2-a0c2-5c909a3b2ba6", "comment": "Malware payload (Heodo)", "value": "0a9eb08fc98ca365e365a19a059cda5dea08ff28ec3ce84135c381030b1539dfc17782474feaec04b8c8249222479fbb", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646130684, "uuid": "15c5dc57-edb9-4002-82e2-1f0ea07af044", "value": "T14CD47C82F7429EF2C00B03347C32B2586BADEAD5D2158D6B9398A5AE1F35573493DE43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646130684, "uuid": "23e84810-aab2-4b2d-8058-f25614af9aca", "value": "e0b213ccd96f46d30dcd8e225f4e9fc9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646130684, "uuid": "051827c3-982e-4ef7-ab4d-0c32e35729ed", "value": "6144:XjPgWGbb0OEmS9Vzf5WI9nI1LSfcaVMyhKmZHNRuIfv7YtaIIo0cm59CH7PQ:X0bEtf5WyI1LSfcsfxhstaICRLmrQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646130684, "uuid": "bd0facae-2861-4a57-b632-6f8c8c777e9d", "value": 602112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646130684, "uuid": "44047d94-b078-41f4-9b7c-61e2aa29297a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646130684, "uuid": "3a607db8-fee8-4f85-b16e-cb93f669769d", "value": "Th8WbbnYp.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8cfcdfc2-99b3-11ec-9275-42010a9c0029", "comment": "Malware payload (njrat)", "timestamp": 1646175698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646175698, "uuid": "48fac554-ed01-428f-bab5-7e0d9560d241", "comment": "Malware payload (njrat)", "value": "c0800599f5547f06798f0e5e68b3d3e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646175698, "uuid": "97db708b-a76f-46af-a71f-f23f6975ff63", "comment": "Malware payload (njrat)", "value": "f5831bc29659b48db69bfdc31e956e7e646e4dfa58a8b8c768370014a0c9568b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646175698, "uuid": "7105f7dd-6709-4b90-a4ed-f32d4fd23729", "comment": "Malware payload (njrat)", "value": "2b09c4611fe6358e9d2e61954cc32ec34ab5bef5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646175698, "uuid": "2d8b07dd-fe54-47f0-8a7b-8d0f584536a6", "comment": "Malware payload (njrat)", "value": "e30a311fd56e76fee5e19726717b510b85ea8c682beda844ca30d21e060c67ff4e9a10827ed4bbfc04e5e1ce65f28b5a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646175698, "uuid": "5033d38a-0b03-484d-a904-8a5a804beac1", "value": "T18B13E78CB784E175D5FF8BF0B492B2990B71A01BA902930F99F154D94FB3AC09611EE7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646175698, "uuid": "0b3a385e-c2e2-4418-8760-7a4a276de3db", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646175698, "uuid": "c02199b6-71c1-4470-9395-bcca2a197ea7", "value": "384:xZyirsVqb08yPwp/qp26gMg9WcJ+9D9O5UE5QzwBlpJNakkjh/TzF7pWn0/greTD:jbrs8Y5PwFKxc9XvQO+9t+L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646175698, "uuid": "4df0df9d-ef61-4dbe-b3da-d2c2216c9cb3", "value": 44032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646175698, "uuid": "b0b7f51b-e114-426a-afff-b4e5429dac47", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646175698, "uuid": "5346d6b8-5891-494b-9ee9-4600d3752069", "value": "c0800599f5547f06798f0e5e68b3d3e7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52ca25fe-998f-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646160138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646160138, "uuid": "f461b59f-5cab-4cde-8863-7a872d88c7dc", "comment": "Malware payload", "value": "def31c1285e963b8440b3ab9b22a6fdd", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646160138, "uuid": "8d649abf-0eea-47c4-bfc1-f297672214dc", "comment": "Malware payload", "value": "f5937a4b2dfb254c0a0f534e482be5b1e7bf953bab04df8809362c65b9c95a56", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646160138, "uuid": "2074c168-31b8-44c7-a46f-0d09e7c06952", "comment": "Malware payload", "value": "ecc371a8a1031b2e1e1fe4a26775c0a81ffb2e3a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646160138, "uuid": "f3132eef-0327-4fc9-a3c3-4fea36c3f7b2", "comment": "Malware payload", "value": "4d47cae6be1c11b90530283836077a6845344da89feff571930d33369d807a27b136d4fa84b278c9215628332c0c527d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646160138, "uuid": "29539c6f-4428-4ddd-8bf0-641650839187", "value": "T1D9B4AE12B790C076D1AA36342526A7B51AEDBC709EF5C3876FD03B7E5E301918A3C35A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646160138, "uuid": "a2ff4880-d6c3-4797-8be0-c02002baa94c", "value": "f08242131de62ca6d7c4b2727b491b3d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646160138, "uuid": "05b5d098-bd5a-4a57-9cce-0defed7ba4d6", "value": "12288:jE3TMKM/JjdkdO4+BNhOwy24h43JopSz/o:jE3TM/JjdkSN3Ko", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646160138, "uuid": "2b21370a-9e5c-4fd5-9aaf-9812b3f8c4a3", "value": 505856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646160138, "uuid": "8167e686-407b-4493-99e0-6bf86396b148", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646160138, "uuid": "175555fb-79b7-4ac9-a2d9-46af113258f0", "value": "GDEjyEkOM4N66l9gkxNaLc3EDOcl5Mk.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5138e3db-9936-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1646121911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646121911, "uuid": "df6ddfc8-fc8f-4803-971d-5a82f8c79f74", "comment": "Malware payload (SnakeKeylogger)", "value": "b06085061c85fc7e86bcd2c3549f7d18", "object_relation": "md5", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646121911, "uuid": "acbd03c2-9a07-4318-8872-491ab324144b", "comment": "Malware payload (SnakeKeylogger)", "value": "f593c384d96007e4f35761d3aa937e41feb5ab9c7a9c0834171fe379d5f86ea0", "object_relation": "sha256", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646121911, "uuid": "cbac2345-85a2-4ace-8266-d67551356d5f", "comment": "Malware payload (SnakeKeylogger)", "value": "cf4928f253bf24f95c31f4a05ba26eef3007e4fe", "object_relation": "sha1", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646121911, "uuid": "9e13151d-a58c-4eda-bb3a-732c6768bdea", "comment": "Malware payload (SnakeKeylogger)", "value": "cf2dd966d550ad8e5a40ab855d87a289798a0ae7f2a59e17490a0b2a28e2a15447d416f911f910c82dca42c93e00b2bd", "object_relation": "sha3-384", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646121911, "uuid": "bf88a4a2-467e-4e40-98b7-182a468d9936", "value": "T1BFF4339D59CBDE330F089BC9AE7253C0B1949C6707A98F6B18CDB1E6871AC7345B413A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646121911, "uuid": "be9b6967-96d3-4526-b5e0-145e9e796dd4", "value": "12288:J5+uWNHo0bq6eyhggxmQmkEhKJ17HtEhnoRTmUV9H/Fs02x5dFgcz0:X+rjbT6gMQmlgJ1uhwme9fFhUdFng", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646121911, "uuid": "d03a9268-f27d-4d64-bd9c-9efc6337b81d", "value": 782829, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646121911, "uuid": "d8d03f3f-c9d1-4f32-8eb3-678edb4e8a83", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646121911, "uuid": "83fc5d32-ced0-40d2-a627-14d3497dbeaa", "value": "nYw44rpbgqGA0gn.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42a30783-995b-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646137778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646137778, "uuid": "c57e5f24-8056-4a79-a360-61ec2a68295e", "comment": "Malware payload (Formbook)", "value": "25638fc9da9f3f3c6888fa9348d37498", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646137778, "uuid": "fa104fef-bb9b-46b5-b1b8-6c1e6d479419", "comment": "Malware payload (Formbook)", "value": "f5c46286398236732b22a56856c6df79c9f627a01f7c2a2017af4fe7ff0dd783", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646137778, "uuid": "52d66c36-6341-41c9-b020-912eac77df97", "comment": "Malware payload (Formbook)", "value": "ed011fe185aa803175cc53b90b755536dfdd9fab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646137778, "uuid": "6e7416a0-c81b-421d-9bf6-7d8c446cc5a9", "comment": "Malware payload (Formbook)", "value": "ea23a988b5a389d51927624c1dcae7f846c2e874fb230183f197b366879f887ac74c126db2147dbda2b8feb918b55b3a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646137778, "uuid": "c875d562-3044-4479-a692-52e966d61ed7", "value": "T159F4AE1838E65039F83A8BF1CBC0EBF1DB6EE261E48970F564000E555A55BBC8946EFD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646137778, "uuid": "5716b010-dcbb-4b53-bdb6-4015ebfd970d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646137778, "uuid": "93001069-f259-4f79-81da-fc42cd6a6a03", "value": "12288:aEnFR/I/kaB+gCDbeLDe9fd4F+Rr7vRc4Enh1+sTQ+fQoj4znG02vIBAO0u:bapucF+pRc4En/+sTFYoj4LKvI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646137778, "uuid": "2ffc237d-baea-418f-9916-b5daa0e28a6c", "value": 775168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646137778, "uuid": "63f5698f-0a8b-41b2-9b92-cf860a8ae8b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646137778, "uuid": "09e67196-1181-423d-88cb-2b6dc0fcfce7", "value": "fde42VIkXMpAQg8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9156f86-9985-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646156042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646156042, "uuid": "b2ceb5c2-fb13-4e54-b643-d1a4a63ec699", "comment": "Malware payload (Formbook)", "value": "85d2640f9e61a3404128cf946b8c2482", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646156042, "uuid": "3b71db59-6d90-42c0-b90f-0092431c3d1a", "comment": "Malware payload (Formbook)", "value": "f62bb43d02b33488c3f05d94bdbc0bd2936f415d028f1fe075c7b8d7cee664a8", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646156042, "uuid": "7282770b-5212-4d17-bcbb-19e482839ef3", "comment": "Malware payload (Formbook)", "value": "6b511f1af51990a633810f5f7be6547d8f960e6a", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646156042, "uuid": "a23c4c36-d856-48e8-a391-b2c24532cb13", "comment": "Malware payload (Formbook)", "value": "d03a0eb5bd9acb04bb1bee9324f14d3b031fced2e332e2acff0f94e2995ababe0f900255d9719226a09cdcc1bfc523ba", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646156042, "uuid": "31bd9c20-4a14-4e48-af65-958c56465f64", "value": "T16C1402724A28CF1DD9ABC53458116CE5F3648C1B8B1D7699207237AD8EBED059E31A0E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646156042, "uuid": "0317f0cf-0972-4090-822c-80d5438404b5", "value": "3072:IRHsz59VPROF4dzeM+vC+D8Zm6BvjUVpe7+748GV5LESsKMJzPKlIof/:4+FRK48xvC+D8Y6FceYbKL4KMpPKK2/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646156042, "uuid": "3c029d0a-0dd3-4875-a6b4-8eb32c80cbb0", "value": 191336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646156042, "uuid": "ab2276ad-8240-4867-8072-cd3eba57759a", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646156042, "uuid": "264c1d15-6421-4acc-8ccb-95a236196305", "value": "SHIPPING DOCUMENTS.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a861d5d5-9973-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646148256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646148256, "uuid": "482f58e6-052e-449a-a94f-5db251f85b9c", "comment": "Malware payload (AgentTesla)", "value": "8658d6b266ed0a5a91ed23528597eb1b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646148256, "uuid": "d0b5a410-c8af-41b5-95bc-8da904d697b2", "comment": "Malware payload (AgentTesla)", "value": "f68592085e4409b99fe5f16f31c41f3e7fbfef093ff407c81be9788f9acf95c4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646148256, "uuid": "ffacc6e7-a38f-4438-9970-ec6462397728", "comment": "Malware payload (AgentTesla)", "value": "4367d76bd34f1ae2940ecc0cd314e451b73f59a9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646148256, "uuid": "2c0460d7-a0dc-4ea1-8738-609d139ae899", "comment": "Malware payload (AgentTesla)", "value": "b3140bc3506e798a02a9c40668cbc67f34818c22c678fe6d4268b76718df4ca6c361c2e38a3bac6b7643c31892d0f83a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646148256, "uuid": "3382c8be-c38f-414c-8d9c-f8a95b6a8c36", "value": "T1F5B3FE50E94DACD9E7E8C1B3B93A9B100575BBDB92F8819F2265371452B37C320B7D0A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646148256, "uuid": "99f9d351-4f9d-4a74-891b-aa67ed3f7c0f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646148256, "uuid": "86063276-9f5b-444a-80a4-d20b9265bdfb", "value": "3072:BbPry8o05lhUqrAMgTPA1p8Dja+auDOLQyDl9hFjO4rW6ZQY7j1lQ7wXVA0+biOP:BbKCvK4O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646148256, "uuid": "eea8af60-86d5-4daf-87ec-0c49ab3a36d2", "value": 111104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646148256, "uuid": "17775d3e-33fc-4702-841e-369548d81743", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646148256, "uuid": "918edfc7-fa6d-442a-b81e-fbf666c83c52", "value": "8340167.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d63d354c-992c-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646117839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646117839, "uuid": "25206e72-34df-4ef6-aa0e-35c5a687ea0d", "comment": "Malware payload (Formbook)", "value": "346a9dff18e0f856cede3bf4a08dd8f1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646117839, "uuid": "fc9039fe-9271-4861-bc71-f21e566a50be", "comment": "Malware payload (Formbook)", "value": "f725b6a2466a6f4c7084eeab5994e30b8ef836633c1a84d85c1899deb1808d3c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646117839, "uuid": "9668ba55-5a4e-4fce-9a82-dbf5ee0a218b", "comment": "Malware payload (Formbook)", "value": "fb14b24abd737c27f5a4f040b82cb07c787ad7c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646117839, "uuid": "e332eb6e-44ae-49a4-bebc-41aa6e75f5c8", "comment": "Malware payload (Formbook)", "value": "965fa089af922f0a4f9b71d4dec6e4aedf512c816bac25bb947aea142a50005645f360a5feb276cd3b27cb60e97ee8e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646117839, "uuid": "20033f6e-aaed-448b-ac17-b09224af1bf7", "value": "T161F4BF4838EA5139F93A8BF1CBC0EBF1DB6DF221E58860F568000E559605BBC8955EFD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646117839, "uuid": "cc4478b0-e624-4080-8987-d40081474307", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646117839, "uuid": "a9b1bb11-5afe-4485-9e26-54755f91e85d", "value": "12288:tEhAkR/IOufp859zO9Q2r4D0F/EBk2e4Yf0h9GFDnGGJ4:fI9eL9FEBV5hgFpy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646117839, "uuid": "fde7dbe0-3ad1-4892-a611-cf783402209e", "value": 762368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646117839, "uuid": "da1d6560-845f-4bf9-9f67-d3581ecd99d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646117839, "uuid": "b76a5bbf-0115-4ef2-9df5-2253f304b229", "value": "Purchase_Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86369b4e-9984-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1646155500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646155500, "uuid": "8817df9e-8d98-402b-b783-b0c43a599517", "comment": "Malware payload (SnakeKeylogger)", "value": "5a60306ce02dd4f2265ebfc38885eeb8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646155500, "uuid": "32625e4c-e87a-45bc-a8ec-c64fd9d72018", "comment": "Malware payload (SnakeKeylogger)", "value": "f8a72b7d8b01a7e16fcd318177e3c76abd503ef664ff3d4968dced8d3b59e42b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646155500, "uuid": "193a1e41-0721-4b60-b137-3c986e513aff", "comment": "Malware payload (SnakeKeylogger)", "value": "95a2d7d6fd16f761f8f18e8be902268d0b915462", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646155500, "uuid": "df952898-4599-493f-adaa-3bf3b5e08c70", "comment": "Malware payload (SnakeKeylogger)", "value": "fc74d90a77b6b8edfe4803b0752b7180a04c6f0a27531437f7b6531b2522ed19c46b728769c375fb021d3e409a3e395e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646155500, "uuid": "058e0f7a-0d34-4d7c-add0-f4af3cfe85ca", "value": "T1CA05AE4835D6607DE836CBB2CAC4EFF1DB29F122D549A0B254020E199A0DBBD8D45EFD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646155500, "uuid": "796aaf56-04ab-4b63-bb49-db411cb44553", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646155500, "uuid": "f96827ca-58ee-4c49-a43a-6c9eefac63be", "value": "12288:IuSOPgwuX1slSLebQP6jKxGi6hcTbNxlTbG2tyvfqLYGEtmF3I1zfR1RHz:XSegpXESLTJz6O1TbQMp5I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646155500, "uuid": "a7391cc9-6139-49c6-98d0-e71eb2bbea45", "value": 840704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646155500, "uuid": "f0653d3e-607b-435f-abb1-452197eaac03", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646155500, "uuid": "effcc51a-88c7-4165-ac0b-f218cf1a2e60", "value": "IMG BHG70093184352.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f27ce21-9945-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646128323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646128323, "uuid": "26d8d402-9f05-48fb-81ce-9dac3ae4b761", "comment": "Malware payload (AgentTesla)", "value": "094036e2a3d0ff4192d783723467b8dd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646128323, "uuid": "e4a1ff47-e882-4910-af71-195d414556c3", "comment": "Malware payload (AgentTesla)", "value": "f8da084f4719bf3efeff6351d65ccdcc006502f5349a1ee53328b1f395ac1fef", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646128323, "uuid": "8617a120-7953-4b17-85c7-f7c127d33f2c", "comment": "Malware payload (AgentTesla)", "value": "08c58da5bb00c20684b91c34f408a020998ca9be", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646128323, "uuid": "490076cc-1e72-4c78-8a23-163e61203e91", "comment": "Malware payload (AgentTesla)", "value": "535d6eec0fb6d14a41ad6f40df4d63d664564d9e57673f265ee63c9a3d05e7e1aaf02d0137dd4e4ab774a950cbc97676", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646128323, "uuid": "17c7b464-90e5-4c64-8c5d-c0e0709b2884", "value": "T14F9423D7769A4E1D19A3CE63BB3250F8B39E2488718078D16329585FBF9DDB3C8D1890", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646128323, "uuid": "33c0964f-30e6-4484-be03-a7854da1232d", "value": "12288:CQfLllurhXvtck0cQjitL0fF+YF4hf+dyUh9zhh:CQTlcr9l3RBLYc+z9zhh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646128323, "uuid": "ed02106d-fb23-466e-bdd0-53bfd3f49222", "value": 439058, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646128323, "uuid": "934b4f16-a86e-4209-80bc-81e0c7953642", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646128323, "uuid": "0f5c9b59-a872-4179-addb-ae2de3462cee", "value": "Order.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cb2d173-9977-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)",